Continu-US · CMMC Level 2
Continu-US for CMMC Level 2
Every one of the 320 NIST SP 800-171A assessment objectives, verified from the systems you already run.
Continu-US checks your endpoints, firewalls, switches and routers*, Microsoft 365 and Azure, AWS, Google Cloud and Google Workspace, and keeps the evidence to prove each result. Your system security plan and SPRS score are built from that same evidence, and it all runs in your own Azure environment, Commercial or Government.
Continuous verification
All 320 objectives, checked continuously
Evidence from your endpoints, cloud tenants and accounts, network devices, ticketing system and SIEM is checked on a set cadence, and each result is mapped to the NIST SP 800-171A objective it supports. You see an assessment-ready view of every control, kept current automatically.
Drift alerts
A setting that moves from its approved value shows up the day it happens, with the device and the before and after values.
Findings and dispositions
Every failing check with its affected devices. Record false positive, informational or not-applicable decisions with a reason, scope and review date.
Stated vs. verified
Import your implementation statements and see where what you wrote differs from what your systems show: the gap an assessor finds first.
Recurring activities
Reviews, tests and trainings scheduled and tracked with evidence, so periodic controls don’t slip between assessments.
Assessment artifacts
The documents your assessment turns on, built from the evidence
System security plan
Generated as a Word document from the built-in template, or your own, and filled with what the platform already holds: family tables with implementation statements beside the verified result, asset tables, inherited controls and the providers’ responsibility matrices. Anything the platform can’t fill is highlighted and listed before the document is produced, rather than shipped blank.
SPRS score
Calculated from the same objective results the rest of the platform reports, so the score you submit and the evidence behind it can’t drift apart.
POA&M register
Create items in one click from any failing finding, pre-filled with the weakness, plan and milestones. A 180-day clock, change history and spreadsheet export.
Evidence packages
Assessment-period reports, per-device results and hashed evidence packages, organized by objective, that an assessor can verify independently.
Scoping
Results that reflect your boundary, not the whole catalog
Asset categories
CUI, Security Protection, Contractor Risk Managed and Specialized assets are categorized in the inventory. That decides what counts toward your results and the asset tables written into your plan, including the authorized CUI user count.
Inherited controls
Objectives provided wholly or partly by a provider are recorded with that provider and its customer responsibility matrix, and carried into your plan’s inherited controls section rather than evidenced again locally.
Not-applicable objectives
Objectives that don’t apply to your environment are recorded as such, so your results cover your actual boundary.
One organization or many
Monitor your own environment, or many: an MSP across its customers, or a prime watching its suppliers, each with its own scope and framework.
Evidence sources
Works from the systems you already run
No new platform to adopt: a lightweight, signed check script runs on your endpoints, and everything else comes from what you already have.
Endpoints
Windows and Linux hardening, encryption, logging, patching, accounts and services, reported daily over an encrypted channel by a tamper-checked script.
Cloud
Microsoft 365, Azure, AWS, Google Cloud and Google Workspace: identity, email, data protection and configuration, plus email DNS. AWS, Google Cloud and Google Workspace are collected through short-lived, read-only federated access, with no keys or passwords stored.
Network
Firewalls, switches and routers*: configurations evaluated against your baseline, with passwords and keys stripped before upload.
Ticketing system
Vulnerability remediation and change records, so process controls are verified from real tickets.
SIEM
Alert and case handling, so monitoring and incident response are backed by actual activity.
Your team’s records
Documents, recurring activities and implementation statements, kept beside the technical results. Word and Excel evidence attaches to the activity it supports.
Bring your own STIG, CIS or Group Policy baseline. Results are grouped by benchmark or GPO, and STIG Viewer checklists are exported per device.
* Specific firewall, switch and router brands are supported.
Built by a C3PAO
Built by assessors who know what evidence holds up
Continu-US comes from Anthony Timbers LLC, an authorized CMMC Third-Party Assessment Organization (C3PAO) with Certified CMMC Assessors. We’re also a FedRAMP 3PAO and a PCI QSA company, accredited to ISO/IEC 17020.
One set of evidence also maps to NIST SP 800-53 Rev 5 (the 1,824 determination statements of 800-53A) and to PCI DSS v4.0.1, so you can switch views without collecting anything again.
We never assess an organization we manage, advise, or license Continu-US to. Continu-US indicates results; determinations of compliance are made by your assessor. Continu-US supports your compliance program; it doesn’t certify it, and it doesn’t guarantee an assessment result.
Capability brief
Continu-US CMMC capabilities
The full CMMC edition of the Continu-US capability brief, including deployment and security details.
See it on your environment
Run it yourself as a licensed platform, or have ATLLC run it for you as part of our managed security services. Either way, onboarding is guided, and a typical small or mid-size defense supplier is fully onboarded in 4 to 6 weeks.
More on Continu-US: Overview · PCI DSS 4.0.1 · Pricing · MSSP partners
One firm. Four authorizations.
MSSP
CMMC Level 2 Certified MSSP
24/7 security monitoring and incident response for small to mid-sized businesses and DoD contractors.
C3PAO
Authorized CMMC C3PAO
Official CMMC Level 2 certification assessments, authorized by the Cyber AB.
3PAO
FedRAMP 3PAO
FedRAMP Rev5 and 20x assessments as a FedRAMP Recognized independent assessor, accredited to ISO/IEC 17020.
QSA
PCI Qualified Security Assessors
PCI DSS assessments and consulting, listed as QSAs on the PCI SSC website.
Team credentials
ISO/IEC 17020 accredited