CMMC and NIST 800-171 platform
Brehon walks a small defense business through every one of the 110 NIST SP 800-171 Rev. 2 controls, captures the evidence behind each one, and generates the SSP, POA&M, and SPRS score a contracting officer expects to see. Built by a CISSP and CISM. Runs on an instance that is yours, not a shared pool.
Two ways teams arrive
The 2026 DoD SBIR BAA requires a current NIST 800-171 self-assessment score in SPRS before award. Brehon gets you there in weeks, with tiers built around that deadline.
See Brehon for SBIR applicantsYou do not have a Phase I award, but a prime contract or a DFARS 7012 clause now requires a Level 2 posture. Same 110-control workflow, same generated SSP, POA&M, and SPRS score. Start with a call and we will size the right tier.
Book a fit callThe platform
One tool. Three jobs. All three required before a contracting officer will sign.
Not a checklist PDF. An interactive workflow with plain-English explanations, decision trees, and small-business-specific guidance for every NIST SP 800-171 Rev. 2 control.
Upload, link, or note. Every control has an evidence row. Every evidence row has an audit trail. When the assessor or contracting officer asks, you have the answer.
Defensible documents in the format the government expects. The output is yours. Print it, hand it to a C3PAO, upload it to SPRS.
Where your data lives
Brehon is not a shared cloud you have to trust with your CUI. Every customer runs on a dedicated, single-tenant instance: your own database, your own encryption keys, your own backups. No other customer's data has ever touched it, and your SSP, POA&M, and evidence export out anytime.
Pricing
For single-site teams comfortable with the work.
7 to 14 days
Most popular
For teams that want it done with them.
21 to 30 days
For teams with a Phase II topic already in sight.
90 days
All tiers include the SSP, POA&M, SPRS score package, and a defensible audit trail.
From the founder
I'm David Moline. By day I run cybersecurity for a DoD contractor in Stuttgart, where I've spent the last several years watching small defense businesses get crushed by compliance requirements they had three months to figure out. I hold CISSP and CISM, I'm finishing graduate work at Johns Hopkins in generative and agentic AI, and I built Brehon because I kept seeing the same problem from the inside: the small business does not need a six-figure consulting engagement. It needs a tool that knows what to ask and what to do with the answer.
Brehon is that tool.
David A. Moline Founder, Solas AI
Questions
No. C3PAOs perform the third-party assessment for Level 2 (high-risk). Brehon gets you ready for that assessment and handles the self-assessment side. We can refer you to assessors when you're ready.
SPRS scores run from -203 up to 110, where 110 means all 110 controls are met. There is no universal pass mark: under DFARS 252.204-7019 and 7020 you post whatever score your assessment produces, and each prime or contracting officer sets the floor they will accept, usually backed by a POA&M for anything not yet met. One number worth knowing: a score of at least 88 (80 percent of the 110 controls met) is what lets you claim a conditional Level 2 self-assessment under 32 CFR 170.21 while you close the rest on a POA&M. What primes actually scrutinize is the score together with an SSP and POA&M that hold up.
New registrations: 2 to 4 weeks. Renewals: 1 to 2 weeks. Build it into your timeline.
CMMC readiness costs are allowable on DoD SBIR contracts. TABA may apply. Talk to your contracting officer.
Two ways in
The guide is the cheapest way to find out where you stand. The call is the fastest way to find out what to do about it.
Self-serve
7-Day SPRS Sprint Guide
A PDF that walks you from zero to a defensible SPRS submission.
Talk first
15-minute fit call
Tell me your topic and your timeline. I'll tell you which tier fits, or that none of them do.
Book a 15-minute fit callDirect calendar. No SDR in between.
Hi! I'm the Solas AI assistant. I can answer questions about our services, pricing, and how we help service businesses save time with AI automation. What can I help you with?
