Concura.AI
Senior-assessor expertise that takes a DIB contractor from 320 NIST 800-171A objectives to a defensible CMMC Level 2 self-assessment — at a fraction of the cost of a traditional consulting engagement.
↓ Download the PDFThe CMMC challenge
If your business handles Controlled Unclassified Information for a Department of Defense contract, you're being assessed against the Cybersecurity Maturity Model Certification — Level 2: 320 NIST 800-171A assessment objectives to address, document, and defend.
The standard playbook is to hire a CMMC consulting firm:
- $25,000 to $75,000 for an SSP development engagement
- 6 to 12 months of calendar time with back-and-forth
- A senior assessor whose attention you compete for with their other clients
- A finished SSP you didn't write and may not fully understand
For most small and mid-size DIB contractors, that's the only option. Concura is the alternative.
What Concura is
Concura packages a senior CMMC assessor's expertise on every one of the 320 assessment objectives into a subscription your own team drives. There are two jobs to do — stand up an environment that can hold CUI, and assess and document it defensibly — and Concura sells them separately, because not every contractor needs both.
Add Enclave Builder Setup Assistance for hands-on help standing up the environment, or book Concura Consulting time when you need a human assessor for a specific question. Built by a senior CMMC assessor, not by software people guessing what compliance is.
Your data is stored to the standard you're being assessed on
Your SSP narratives, voice transcripts, company profile, uploaded logo, and build evidence are stored in Microsoft Azure GCC High, which is FedRAMP High Authorized as a platform — the same cloud certified for Department of Defense Impact Level 5 data. Most CMMC-adjacent tools (Vanta, Drata, Hyperproof) run on commercial cloud built for SOC 2 / ISO 27001 audiences. Concura is built for DFARS 7012 contractors; the infrastructure reflects the audience.
Choose your product
Concura Level 2 Self-Assessment
Conduct and document a defensible self-assessment — determinations, SPRS score, and POA&M.
- All 320 NIST 800-171A objectives with senior-assessor analysis + verbatim NIST/CMMC source text
- MET / NOT MET determinations with basis and pinned evidence, objective by objective
- SPRS score computed under the DoD Assessment Methodology, with your scope statement
- POA&M tracking — overdue items stay flagged until closed
- Upload your own SSP and artifacts; the AI assessor interview drafts your narratives
- Exportable SPRS entry package, scored report, POA&M, artifact index
Concura Enclave Builder
Stand up a CMMC L2 ready Microsoft GCC High enclave with the CW Reference Architecture — the guided build that documents itself.
- Sequenced guided build: identity, endpoints, email and documents, logging, boundary, backup
- Downloadable build scripts with evidence output at every step
- Evidence-to-SSP pipeline — confirmed steps auto-draft your narratives
- Implementation instructions for the GCC / GCC High VDI build
- Full Reference Library: all 320 objectives, Delta Corp example SSP, Knowledge Base
- Microsoft GCC High licensing is not included — quoted separately and billed as a pass-through
Concura Complete
Both products, one subscription: build the enclave, then assess and document it.
- Everything in Level 2 Self-Assessment
- Everything in Enclave Builder
- One sign-in, one bill — $2,000 less than buying both separately
- The build's evidence flows straight into your determinations
- Microsoft GCC High licensing is not included — quoted separately and billed as a pass-through
Add a human when you want one
Enclave Builder Setup Assistance
Hands-on help standing up your enclave with the guided build.
- Kickoff, scoping, and tenant-readiness review
- Per-phase build guidance and troubleshooting across the build flow
- Evidence collection, SSP review, and an assessment-package walkthrough
- 30 hours included at a discounted $250/hour; additional time at $300/hour
- Microsoft GCC High licensing is not included — quoted separately and billed as a pass-through
Concura Consulting
Direct senior-assessor (CCA) time when you want a human in the loop.
- SSP review, control interpretation, scoping, mock-assessment Q&A, readiness checks
- Prepaid via Stripe, bought in any quantity, one-hour minimum
- Unused hours don't expire
The math
| Approach | Year 1 cost | Typical time to complete | What's included |
|---|---|---|---|
| Traditional CMMC consulting engagement | $25,000–$75,000 | 6–12 months | The consultant authors with you |
| Concura Level 2 Self-Assessment | $7,000 / yr | Weeks of in-platform authoring | Senior-assessor content, determinations, SPRS score, POA&M, exportable package |
| Concura Enclave Builder | $5,000 / yr | Guided stand-up | The guided GCC High build, evidence-to-SSP pipeline, Reference Library |
| Concura Complete | $10,000 / yr | Build and author in one place | Both products; build evidence flows into your determinations |
| Complete + Setup Assistance | $17,500 yr 1 | Guided stand-up with help beside you | + hands-on build help (30 hrs) |
| Complete + 10 hours of Consulting | $13,000 yr 1 | + live assessor checkpoints | + direct senior-assessor time |
Even the fullest Concura combination — both products plus 30 hours of hands-on build help — comes in at $17,500, below the cheapest traditional consulting engagement. And you keep the authoring control, the assessor expertise, and a senior assessor on demand.
Common questions
Which product do I need?
If your CUI environment already exists and you need to assess and document it, that's Level 2 Self-Assessment. If you still have to build the environment, that's Enclave Builder. Most contractors starting from scratch need both, which is what Concura Complete is for.
Where is my data stored?
Your SSP narratives, voice transcripts, company profile, logo, and build evidence are stored in Microsoft Azure Government, GCC High — FedRAMP High Authorized as a platform.
Do I need a Microsoft account to sign in?
No. Concura sign-in works with any email address — continue with Google, or enter your work email and we'll send a one-time code. No new password, no Microsoft account required.
How many people can use it?
Five active members per company, on every product, at no extra charge.
What if I cancel?
The annual subscription is non-refundable once active, but you can cancel auto-renewal anytime; cancellation takes effect at the end of your current term.
Can I print or download my SSP?
You can generate and download your own personalized SSP .docx and assessment package — that's the point. Concura's reference content is for online viewing within your subscription.
Will Concura work for my architecture?
Level 2 Self-Assessment works for any architecture — the objectives, determinations, SPRS scoring and SSP tooling assume nothing about your environment. Enclave Builder is narrower on purpose: it is a guided build for a VDI CUI enclave in Microsoft GCC / GCC High. If your environment already exists, or is not VDI, Self-Assessment on its own is the right product.
Get started
Read a sample at concura.ai · Subscribe to Concura · or have a senior assessor reach out below.
↓ Download this prospectus as a PDFHave a senior assessor reach out
Leave your details and a Concura assessor will follow up. We'll answer your questions, talk through your CMMC posture, and help you decide whether Concura fits your situation.