Products
Two products, built on senior-assessor analysis of all 320 NIST SP 800-171A assessment objectives. The full Concura Reference Library is included with both. Hover or tap a card for full details.
Where CMMC stands right now: third-party (C3PAO) assessments are suspended during DoD's 60-day review — but Level 2 self-assessments, SPRS submissions, and annual affirmations remain required, and a defensible self-assessment today is the same evidence base a C3PAO reviews if they return.
Which one do you need? It comes down to one question: are you building an environment, or documenting one you already have? If your environment exists — whatever it looks like — and you need to assess and document it, you want Level 2 Self-Assessment. It works for any architecture. Enclave Builder is narrower on purpose: it is a guided build for a VDI CUI enclave in Microsoft GCC / GCC High. If you are not standing one of those up, you do not need it, and Concura Complete is not the safer choice — it is simply both products.
Concura Level 2 Self-Assessment
Conduct and document a defensible NIST SP 800-171 Rev 2 self-assessment — determinations, SPRS score, POA&M, and the annual affirmation that follows — with Lead Assessor guidance beside every objective.
- All 320 NIST 800-171A objectives with senior-assessor analysis + verbatim NIST/CMMC source text
- MET / NOT MET determinations with basis and pinned evidence, objective by objective
- SPRS score computed under the DoD Assessment Methodology, with your scope statement
- POA&M and operational plan of action tracking — overdue items stay flagged until closed
- Annual affirmation — your Affirming Official must attest in SPRS at the time of assessment and every year thereafter. Concura keeps the affirmation clock, the Affirming Official of record, and the evidence behind each year's attestation
- Continuous monitoring between assessments — control drift, expiring evidence, and lapsed periodic reviews surface as they happen
- Three-year reassessment clock tracked alongside the annual affirmations
- Upload your own SSP and artifacts; AI assessor interview (voice or text) drafts your narratives
- Exportable SPRS entry package, scored self-assessment report, POA&M, artifact index
- Delta Corp example SSP, Knowledge Base, completion tracker, community
Billed annually as Consultant Works, LLC. Use the same email at checkout that you use to sign in.
Concura Enclave Builder
Stand up a CMMC L2 ready Microsoft GCC High enclave with the CW Reference Architecture — the guided build that documents itself.
For customers building a VDI CUI enclave in Microsoft GCC / GCC High. If your environment already exists, or is not VDI, you want Level 2 Self-Assessment instead.
- Sequenced guided build: identity, endpoints, email/documents, logging, boundary, backup
- Downloadable build scripts with evidence output at every step
- Evidence-to-SSP pipeline — confirmed steps auto-draft your narratives
- Implementation instructions for the GCC / GCC High VDI build
- Full Reference Library: all 320 objectives, Delta Corp example SSP, Knowledge Base
- Pair with Setup Assistance below for hands-on build help
Billed annually as Consultant Works, LLC. Microsoft GCC High licensing is not included — quoted separately and billed as a pass-through.
Concura Complete
Both products, one subscription: build the enclave, implement the controls, and produce a defensible self-assessment.
- Everything in Level 2 Self-Assessment
- Everything in Enclave Builder
- One sign-in, one bill — $2,000 less than buying both separately
- The build's evidence flows straight into your determinations
Billed annually as Consultant Works, LLC. Microsoft GCC High licensing is not included — quoted separately and billed as a pass-through.
Enclave Builder Setup Assistance
Hands-on help standing up your enclave with the CW Reference Architecture — for Enclave Builder subscribers.
- Kickoff, scoping, and tenant-readiness review
- Per-phase build guidance and troubleshooting across the build flow
- Evidence collection and SSP review
- Assessment-package walkthrough
- 30 hours included at a discounted $250/hr
- Additional time at the standard $300/hr
- Microsoft GCC High licensing is not included — quoted separately and billed as a pass-through
For Enclave Builder / Concura Complete subscribers standing up a new CMMC L2 enclave.
Concura Consulting
Direct senior-assessor (CCA) time when you want a human in the loop.
- Control-interpretation questions
- SSP review for one or more control families
- Self-assessment determination review before you submit your SPRS score
- Scoping decisions (CRMA vs CUI Asset, enclave boundary)
- Mock-assessment Q&A and pre-assessment readiness checks
- Prepaid via Stripe; buy any quantity; unused hours don't expire
Available to active Concura subscribers. Buy from your account once your subscription is active.
Concura Managed
Configuration Drift and Security Monitoring: we continuously monitor your Microsoft environment, compare it with approved baselines, detect and report drift — and, when applicable, align and explain each change against potentially affected CMMC requirements.
- Continuous technical monitoring of your systems through Microsoft Intune, Defender XDR, Sentinel, and Purview
- Baseline monitoring — your environment watched against its established, documented configuration
- Control-Aware Drift Monitoring: drift detection and reporting that, where appropriate, aligns and explains each change against potentially affected CMMC requirements
- Plain-language drift reports — what changed, and what it means for the potentially affected requirements
- Microsoft GCC High licensing is not included — quoted separately and billed as a pass-through
In development — not yet available for purchase. Tell us you're interested and we'll reach out when it launches.
Learn more before you subscribe
The prospectus is a four-page overview of the value-vs-consulting math, product pricing, the senior-assessor backing, and how customers actually use Concura. The live demo is a 30-minute Zoom session with a senior assessor — not a sales pitch, a working session for you to decide whether Concura fits your situation.
What's included in the Delta Corp example SSP
Every Concura subscriber gets the Delta Corp example SSP — a complete, fictional-OSC system security plan that demonstrates a defensible CMMC L2 implementation in Microsoft GCC High with AVD. It covers all 14 NIST 800-171 families, all 110 controls, all 320 sub-objectives, with full implementation narratives, GCC-H inheritance citations, and per-objective supporting artifacts. Use it as a tailoring template — and as the starting content your AI-assisted authoring builds from.
Billing
Concura products are billed annually in advance: Level 2 Self-Assessment $7,000 / year, Enclave Builder $5,000 / year, or Concura Complete $10,000 / year for both. There is no separate trial — every subscriber has their full product from day one. Annual subscriptions are non-refundable once active; you may cancel auto-renewal at any time, and cancellation takes effect at the end of your current term.
Frequently asked
Which product do I need?
If your environment already exists and you need to assess and document it — determinations, SPRS score, POA&M, SSP — you want Level 2 Self-Assessment. If you're standing up (or rebuilding) a CUI enclave in Microsoft GCC High, you want Enclave Builder. Doing both, in either order, is Concura Complete — the build's evidence flows straight into your assessment.
Third-party assessments are paused. Why do I still need this?
The pause suspended the C3PAO requirement, not the compliance obligation. NIST SP 800-171 Rev 2 self-assessments and SPRS submissions remain required under DFARS 252.204-7019/7020, and self-attested scores carry False Claims Act exposure. A documented, evidence-backed self-assessment is what defensibility looks like right now — and it's exactly what a C3PAO would review if the requirement returns.
What is the annual affirmation requirement?
A CMMC Level 2 self-assessment is not a one-time filing. Under 32 CFR 170.16 and 170.22, a senior official of your company — the Affirming Official — must affirm in SPRS at the time of the self-assessment and annually thereafter, and again after any POA&M closeout. What the Affirming Official attests is not "we were compliant on assessment day" but that the organization "has implemented and will maintain implementation of all applicable CMMC security requirements." The self-assessment itself is redone every three years; the affirmation is every year in between. DFARS 252.204-7021 carries the same obligation into your contracts, and a false affirmation is the exact fact pattern False Claims Act cases are built on.
None of this was affected by the pause on third-party assessments — the Department suspended the C3PAO verification mechanism, not the self-assessment, the affirmation, or the enforcement behind them.
Where is my SSP data stored?
Your SSP narratives, voice transcripts, company profile, build evidence, determinations, and uploaded artifacts live in Microsoft Azure Government — GCC High, the cloud environment used for Department of Defense Controlled Unclassified Information and Impact Level 5 data. Your data never transits Concura's public-content infrastructure.
Can I print or download anything from Concura?
Concura's reference content (the 320 control pages and the Delta Corp example SSP) is for online viewing within your subscription — printing and bulk extraction are disabled to protect the senior-assessor expertise that makes it valuable. You can generate and download your own personalized SSP .docx, your scored self-assessment report, your POA&M, and your assessment package — that's the whole point. Code snippets (PowerShell commands, Microsoft Graph queries, etc.) in the implementation guidance remain copyable — those are operational helpers, not extractable narrative content.
Do I need a Microsoft account to sign in?
No. Concura sign-in works with any email address — Google, Microsoft, or any work email. Choose "continue with Google," or enter your email and we'll send a one-time code. No new password to remember, no Microsoft account required.
What happens if I cancel my subscription?
Your data is preserved for 30 days, then moved to cold storage for 12 months. You can request export at any point during that window. After 12 months, data is purged. We'll always notify you before purge. If you subscribe to both products and cancel one, the other — and your data — carries on unaffected.
Can I file the SSP and self-assessment as my own documents?
Yes. Your SSP narratives and your determinations, once authored, are your work product. Concura provides the structure, the assessor-perspective starting examples, and the AI-assisted tools — but the resulting documents belong to you, including the right to file your score in SPRS and present your SSP to assessors, customers, and authorizing officials as your own.
Does the tool decide my score for me?
No. You make every determination; the tool computes what the DoD Assessment Methodology yields from your determinations, and shows you the Lead Assessor perspective on what each determination has to survive. AI assistance only ever suggests — a human confirms everything, and you sign your own SPRS entry.
Will Concura work for an OSC that doesn't use VDI?
For Level 2 Self-Assessment — yes, whatever your architecture. The 320 objectives, the assessor guidance, the determinations, the SPRS scoring, the POA&M and the SSP tooling do not assume any particular environment. Customers handling CUI on endpoints, across distributed operations, or on-premises use it exactly as VDI customers do. Concura's worked example (Delta Corp) happens to run VDI in GCC High, but it is an example to tailor, not a requirement.
For Enclave Builder — only if you are building a VDI CUI enclave in Microsoft GCC / GCC High. That is a deliberately narrow, opinionated guided build, and it is the one product with an environment precondition. If that is not what you are standing up, buy Level 2 Self-Assessment on its own; Concura Complete would just be paying for a build you cannot use.
Who's behind Concura?
See the About page. Concura is built by a senior CMMC assessor with deep field experience. The reference content is authored or reviewed by working assessors — not generated by a generic AI. The voice cleanup uses AI, but the underlying control-by-control assessor expertise is human-validated.