Built by veterans, for government security teams.
CVERiskPilot delivers vulnerability management purpose-built for federal, DoD, and state agencies: native POAM generation and NIST 800-53, CMMC and FedRAMP compliance mapping, from a veteran-owned vendor.
CVERiskPilot LLC · San Antonio, TX
CMMC status · as of October 2026
Phase 2 is suspended. Self-assessments and SPRS affirmations still apply.
CMMC Phase 2 had been scheduled to begin Nov 10, 2026. It would have made C3PAO-assessed Level 2 certification the default requirement for DoW contracts involving CUI. In July 2026 the Department of War (DoW) suspended it and set up a CMMC Reform Task Force for a 60-day review. That review ended in September 2026, and its recommendations had not been made public as of late September.
Suspended
- Level 2 (C3PAO) and Level 3 (DIBCAC) assessments as contract requirements: DoW may not designate them while the suspension lasts.
- New contract requirements may name only CMMC Level 1 (Self) or Level 2 (Self) assessments.
Still enforced today
- CMMC Level 2 self-assessments against the 110 requirements of NIST SP 800-171 Rev 2.
- A current CMMC status and affirmation in SPRS, the Supplier Performance Risk System, which offerors generally need to be eligible for award.
- DFARS 252.204-7012: safeguarding covered defense information and reporting cyber incidents.
- DoW says it continues to enforce NIST SP 800-171 Rev 2 during the suspension, through Level 1 and Level 2 self-assessments and select government-led assessments.
Why AT 3.2.x training evidence still matters
A self-assessment score and the affirmation in SPRS are your own statements to DoW, and select government-led assessments continue during the suspension. An honest affirmation scores a requirement as met only when you can show the evidence. The three Awareness and Training requirements are easy to over-score, because no scan finding, ours included, can show that they are met:
- AT.L2-3.2.1Managers, system administrators and users are made aware of the security risks of their activities and of the applicable policies, standards and procedures.
- AT.L2-3.2.2Personnel are trained to carry out their assigned information security duties.
- AT.L2-3.2.3Security awareness training covers recognizing and reporting potential indicators of insider threat.
The evidence is your training records: who completed which training, when, and what it covered. Keep them in your assessment file next to the POAM and findings you export, so every AT requirement you affirm as met is backed up.
Sources, checked October 2026
- Department of War memorandum implementing the CMMC Phase II suspension (dodcio.defense.gov, PDF)
- Inside Government Contracts (Covington): CMMC Reform Task Force updates, September 2026
- Summit 7: CMMC Phase 2 suspended with 60-day review
- Fortinetics: CMMC Phase 2 suspended
General information, not legal advice: the CMMC clauses in each contract or solicitation govern what applies to you.
Map your findings to CMMC Level 2 practices with one CLI command, then estimate your SPRS score before you affirm it.
Native federal compliance support
Purpose-built for the frameworks your agency already uses. Automated evidence collection, not checkbox theater.
FedRAMP POAM Generation
Automatically generate Plans of Action and Milestones from scan findings. Map vulnerabilities to FedRAMP control families with correct formatting for ATO packages.
CMMC Level 2 Mapping
Map findings to CMMC Level 2 practices. Track maturity across all 14 domains with evidence collection for assessment readiness.
NIST 800-53 Controls
NIST SP 800-53 Rev 5 mapping: findings are linked by CWE to specific controls such as SI-10, SA-11, IA-5 and CM-6, with compliance evidence records.
Remediation SLA Tracking
Track remediation against your SLA policies, with notifications when a case approaches or breaches its due date. NIST 800-53 mapping supports FISMA programs; scheduled monitoring of connected scanners is planned.
Simplified government acquisition
Veteran-owned status and transparent pricing designed to reduce procurement friction for contracting officers.
01
Veteran-owned
CVERiskPilot is 100% veteran-owned, founded and run by a veteran security practitioner.
02
Simplified Procurement
Audit Readiness ($149/mo) fits typical micro-purchase pilots; Federal Assessment is scoped per assessment boundary.
03
Scoped with our team
Tell us your CUI boundary and target assessment date. We scope the Federal Assessment with you before anything is purchased.
Compliance packages
Transparent, government-friendly packages
Audit Readiness ($149/mo) fits typical micro-purchase pilots; Federal Assessment is scoped per assessment boundary.
Federal Assessment
Defense contractors and federal suppliers handling CUI
Get to a defensible CMMC Level 2 or FedRAMP-style POAM before your assessment.
- Everything in Audit Readiness
- CMMC Level 2 self-assessment workflow and SPRS estimate
- FedRAMP-style POAM generation
- CMMC AT.L2 training evidence (3.2.1–3.2.3) via the awareness path
- Case approval workflow for risk decisions
- SSO, set up with our team
- Built by a 100% Veteran Owned company
Audit Readiness
Small GRC and security teams preparing for a commercial audit
Walk into your SOC 2, HIPAA or PCI DSS audit with a POAM already built and training evidence tied to real findings.
- 1,000 AI triage calls / month
- Up to 5 users
- Unlimited scan uploads
- Findings mapped through their CWE to your framework controls
- POAM export (CSV, JSON, XLSX)
- Learning paths, knowledge checks and a team training dashboard
- Training assignments, completion tracking and auditor evidence export
- AI chat on your workspace data
- Jira and ServiceNow ticket push
- Email support
All packages include unlimited local CLI scans. Run without an API key, the CLI reports the core 6 frameworks; add an API key from any package to see all 13.
Modernize your agency's vulnerability management
Schedule a tailored demo for your team. We speak NIST, FISMA, and CMMC — because we've lived the mission.
Veteran Owned · FedRAMP-format POAM export · Made in USA