DRAFT: pending approval. This site is not published and nothing here is final.

For small defense contractors

Built only for CMMC Level 1.

NexusIQ helps small defense contractors scope their FCI, work through all 17 practices, and prepare an assessment review packet for the Affirming Official. Your FCI files stay where they are.

Book a 20-minute demo Try the scoping preview
  • Veteran-owned
  • CISSP-led
NexusIQ · Level 1 workspace Try the tabs
Sample machine shop Sample data. Not a real company.

Policy · What we do

How the sample company handles contract information

17practices
59assessment objectives
Reviewassessment review packet
Who can see contract information
Office staff and shop leads only.
How people sign in
Unique logins for every person; no shared accounts.
Visitors
Sign-in sheet at the front desk; visitors escorted past the shop door.

Evidence · Where it lives

Where the proof is, not the files themselves

  • Visitor sign-in Front-desk sign-in binder Confirmed
  • Device logins Company drive / Access folder Needs a look
  • Antivirus updates Endpoint console report Confirmed

NexusIQ keeps pointers to where proof lives and who confirmed it. Your contract files stay in your own systems.

Review · For the Affirming Official

Ready for the Affirming Official to review

Assessment locked for review.

Sample data.

  • All 59 objectives marked met, or N/A with a reason
  • Evidence pointers confirmed
  • Changes since last lock remain visible

Assessment locked for review. Next: the Affirming Official reviews the packet. The SPRS entry and affirmation happen in SPRS, not in NexusIQ.

A fictional machine-shop example. Sample data only.
  • 17practices
  • 59assessment objectives
  • 5steps
  • Your files stay where they are

01

The problem

Curious what Level 1 work looks like day to day? See a made-up day at a small shop.

  1. If you build parts, ship supplies, or write software for a defense prime, the contract probably says you have to protect the government’s information.

  2. Someone at your company has to figure out what counts, where it lives, and whether the basics are in place.

  3. Then one person signs their name to it, every year. Most small shops do this with a spreadsheet, a shared folder, and a lot of guessing about whether it’s enough.

02

How it works

Five steps, in plain English. More on how it works

Step 01

Scope your FCI

A guided wizard helps you decide what counts as Federal Contract Information and where it lives.

FCI scopePeople and systemsOpen questions

Step 02

Work the 17 practices

Walk through all 17 practices and 59 assessment objectives in plain English.

17 practices59 objectivesEvidence pointers

Step 03

Lock the assessment

Lock your answers before affirmation so everyone is looking at the same record. A lock in NexusIQ is not an SPRS entry or affirmation.

Locked recordSame recordNot an SPRS entry

Step 04

Review, enter, and affirm in SPRS

NexusIQ prepares an assessment review packet. Your authorized SPRS user, someone with the Cyber Vendor User role in SPRS, enters the assessment details there. Your Affirming Official reviews and affirms in SPRS. This can be the same person. NexusIQ does not enter, submit, or affirm for you. The Affirming Official remains accountable for the affirmation.

Assessment review packetCyber Vendor User entersAffirming Official affirms

Step 05

Stay current

See what changed and what’s due before the next annual affirmation.

Annual cycleChanged pointersNext review

03

Why NexusIQ

Evidence · Where it lives Sample data

Know what changed, know what’s due

Built around the annual affirmation cycle.

Visitor sign-inFront-desk sign-in binder Confirmed
Device loginsCompany drive / Access folder Needs a look
Antivirus updatesEndpoint console report Confirmed

Policy · What we do

Your FCI stays where it is

NexusIQ records where your evidence lives instead of collecting FCI files into another system.

Your FCI files stay in your own systems. NexusIQ records where evidence lives.

Review · For the Affirming Official

Built only for CMMC Level 1

No tangents, no feature sprawl.

Sample data Assessment review packet 17 practices · 59 objectives

Open items remain visible

04

See a sample packet

A fictional machine-shop example. Sample data only.

NexusIQ · Level 1 packet Sample data. Not a real company.

Sample machine shopSample owner, Affirming Official

Sample machine shop Level 1 packet

Policy: What we do

How the sample company handles contract information

Who can see contract information
Office staff and shop leads only.
How people sign in
Unique logins for every person; no shared accounts.
Visitors
Sign-in sheet at the front desk; visitors escorted past the shop door.
Old drives and paper
Shredded or wiped before disposal.

Written once, reviewed each year by the Affirming Official.

Sample machine shop Level 1 packet

Evidence: Where it lives

Where the proof is, not the files themselves

Sample evidence pointers
Practice areaWhere the proof livesOwnerReview status
Visitor sign-in Front-desk sign-in binder Office manager Confirmed
Device logins Company drive / Access folder IT contact Needs a look
Antivirus updates Endpoint console report IT contact Confirmed
Media disposal Facilities records Office manager Open

NexusIQ keeps pointers to where proof lives and who confirmed it. Your contract files stay in your own systems.

Sample machine shop Level 1 packet

Review: For the Affirming Official

Ready for the Affirming Official to review

Assessment locked for review.

Sample data.

  • All 59 objectives marked met, or N/A with a reason
  • Evidence pointers confirmed
  • Changes since last lock remain visible

NexusIQ prepares this packet. Someone at the company with the SPRS Cyber Vendor User role enters the assessment details in SPRS, and the Affirming Official affirms there. NexusIQ does not submit to SPRS.

Sample only. Nothing downloads.

The Affirming Official remains accountable for the affirmation.

Preview

Is Level 1 worth a closer look? Try the scoping preview.

Five quick questions. This is a preview to help you decide what to ask next. It is not an assessment, and it is not a compliance determination.

This preview is general information. It does not assess your company or make a compliance determination, and it is not legal advice.

  1. Do you have a contract or subcontract with the Department of Defense, or with a company that works for it?

    A prime contractor’s purchase order counts.

  2. Does that work involve information from the government or a prime that isn’t public, such as a purchase order, delivery schedule, statement of work, or email about the contract?

    This is usually called Federal Contract Information, or FCI. Controlled Unclassified Information (CUI) is not covered by Level 1. If drawings or technical data are marked, or the contract calls them CUI, stop: that is beyond Level 1.

  3. Does any of that information carry a marking like “CUI,” or involve export-controlled or technical defense data?

    Check markings, distribution statements, and contract language. No marking does not prove it isn’t CUI: ask your contracting officer or prime.

  4. Does your contract or solicitation mention NIST SP 800-171, DFARS 252.204-7012, or CMMC Level 2?

    These usually show up in the clauses section.

  5. Do you know where the contract information lives (email, laptops, a shared drive, cloud storage, paper)?

    A rough list is enough.

05

Frequently asked questions

Does NexusIQ make me compliant?

No. NexusIQ helps you organize and track your Level 1 work. Your company and its Affirming Official are responsible for the accuracy of your assessment and affirmation.

Does NexusIQ store my FCI?

NexusIQ records pointers to where your evidence lives and is designed to keep FCI files out of the platform. Describe where evidence lives, not what it says. Don't put contract numbers, part numbers, drawings, or controlled information in descriptions, notes, or links. Don't paste links that open without signing in.

Security & architecture

Who enters and affirms the assessment in SPRS?

NexusIQ prepares an assessment review packet. Someone at your company with the SPRS Cyber Vendor User role enters the assessment details in SPRS, and your Affirming Official reviews and affirms there. This can be the same person. NexusIQ does not enter, submit, or affirm for you.

What does it cost?

Contact us.

Pricing

Swipe to compare →

01

Starting from scratch

A guided wizard helps you decide what counts as Federal Contract Information and where it lives.

Try the scoping preview

02

Have a spreadsheet already

NexusIQ records where your evidence lives instead of collecting FCI files into another system.

Book a 20-minute demo

Level 1 doesn’t need to be complicated.

Book a 20-minute demo.

Book a 20-minute demo