DRAFT: pending approval. This site is not published and nothing here is final.

Product

How NexusIQ works

NexusIQ is built only for CMMC Level 1. It helps you scope your FCI, work through all 17 practices, and prepare an assessment review packet for the Affirming Official, without moving your FCI files into yet another tool.

Five steps

NexusIQ organizes the work. It does not certify or guarantee anything. Your company and its Affirming Official remain responsible for the accuracy of your assessment and affirmation.

  1. Step 1: Scope your FCI

    A guided wizard helps you decide what counts as Federal Contract Information and where it lives.

  2. Step 2: Work the 17 practices

    Walk through all 17 practices and 59 assessment objectives in plain English.

  3. Step 3: Lock the assessment

    Lock your answers before affirmation so everyone is looking at the same record. A lock in NexusIQ is not an SPRS entry or affirmation.

  4. Step 4: Review, enter, and affirm in SPRS

    NexusIQ prepares an assessment review packet. Your authorized SPRS user, someone with the Cyber Vendor User role in SPRS, enters the assessment details there. Your Affirming Official reviews and affirms in SPRS. This can be the same person. NexusIQ does not enter, submit, or affirm for you. The Affirming Official remains accountable for the affirmation.

  5. Step 5: Stay current

    See what changed and what’s due before the next annual affirmation.

A day in the life of a small shop

This machine-shop example is made up. Here is what Level 1 work can look like on an ordinary day.

If drawings or technical data are marked, or the contract calls them CUI, stop: that is beyond Level 1.

A made-up example

  1. A purchasing email from the prime includes a purchase order, delivery schedule, and statement of work. That’s contract information.

  2. The office manager notices three people save the purchase order and statement of work to their own desktop folders. NexusIQ’s scoping questions ask where contract information lives, and now she has an answer.

  3. A visitor from a supplier arrives. The sign-in binder gets filled out. Last month’s page is already an evidence pointer in NexusIQ.

  4. The IT contractor updates antivirus on the shop-floor PCs. He adds the date to the pointer list.

  5. The office manager marks “This changed” in NexusIQ because a laptop was replaced, so one pointer needs reconfirming.

  6. The owner, who is the Affirming Official, reviews the packet NexusIQ prepared. The assessment details are entered in SPRS, and she affirms there herself.

A made-up example. Real shops vary.

What Level 1 covers, in plain words

This list summarizes the 17 practices in plain words. Check the official guide for the full requirements.

DoD CIO CMMC Level 1 Self-Assessment Guide

  • Limit who can get inOnly authorized people and devices reach company systems.
  • Limit what they can doPeople only run the functions their job needs.
  • Control outside connectionsKnow what connects to your network from outside.
  • Control what goes publicReview what gets posted on public sites.
  • Identify and verify usersEveryone has their own login, and it’s checked.
  • Wipe media before disposalDrives, USB sticks, and paper get cleaned or shredded.
  • Limit physical accessDoors, locks, and who has keys.
  • Escort and log visitorsVisitor sign-in and escorts.
  • Boundary protectionSomething like a firewall watches and controls traffic between your network and the internet.
  • Separate public systemsYour public website or guest wifi isn’t on the same network as the internal one.
  • Patch flawsInstall updates on a regular schedule.
  • Malware protectionAntivirus on, and kept current.
  • Scan files and systemsRegular scans.

See it for yourself

Book a 20-minute demo.

Book a 20-minute demo