Frequently asked questions

Valontir is a compliance workspace for U.S. defense suppliers who need to meet NIST SP 800-171. It tracks all 110 requirements and 320 assessment objectives, stores your evidence with timestamps and integrity hashes, computes your SPRS score the way the official methodology computes it, and generates the SSP and POA&M documents your primes and assessors ask for.

Small and mid-size U.S. defense suppliers: machine shops, fabricators, and manufacturers holding DoD contracts or subcontracts with DFARS 252.204-7012 in them, usually without a security team on staff. If a prime has asked about your compliance status, your SPRS score, or CMMC, you're who we built this for.

No. Nobody sells certification for NIST 800-171, and no software makes you compliant by itself. Compliance is the state of your actual practices. What Valontir does is give you the structure: what each requirement asks, what evidence proves it, where you stand, and the documents that show it. The work is still yours; the organization, scoring, and proof are what we handle.

NIST SP 800-171 is the list of 110 security requirements. DFARS 252.204-7012 is the contract clause that makes them mandatory when you handle Controlled Unclassified Information (CUI). SPRS is the government database where your self-assessment score lives. CMMC Level 2 is the certification program that assesses the same 110 requirements. One set of requirements, four names depending on who’s asking. Our blog covers each in plain English.

No, by design. Valontir operates outside your CUI boundary: it stores evidence about your security practices (screenshots, settings exports, policies, records), never the controlled information itself. Our guidance and your acceptable-use rules keep it that way. This is deliberate: it keeps Valontir out of your CUI system boundary and your assessment scope.

Every evidence file is hashed at upload, so you can prove it hasn't changed since. Workspaces are isolated per organization. Access is protected by multi-factor authentication. The full posture is on our security page.

Your workspace becomes read-only, and you have 90 days to resubscribe or download what you need: your evidence files, your published policies, and your generated documents, including the full assessor package that bundles them with a verifiable manifest. We send reminders before anything is removed. Nothing is deleted quietly.

The requirements are ordered by what to fix first: the foundational access and boundary requirements at the top, based on how the DoD's own methodology weights them. Open the first requirement, read its plain-English guide, mark where you stand, attach proof, move on. The dashboard shows your score and what needs attention as you go.

Every requirement carries one: what it asks in normal words, what good looks like in a small shop, the evidence an assessor accepts, the common gaps that cost points, and a plain reading of every assessment objective. Written for a shop floor, not a security operations center.

22 pre-written policies and procedures covering all 320 assessment objectives, written in plain language for a small shop. You fill in your names and roles once, adjust anything to match how you actually operate, and publish. Published versions are frozen with a hash and an effective date, so you can always show exactly what was in force on any date.

Your score starts at 110 and subtracts points for unimplemented requirements, weighted 1, 3, or 5 per the DoD Assessment Methodology, including the partial-credit rules for MFA and FIPS-validated encryption. Valontir computes it from your actual objective statuses, live, so the number is always current and every change is logged.

Your System Security Plan (SSP) and Plan of Action and Milestones (POA&M), generated from your live workspace, plus an assessor package: your documents, policies, and evidence with a verifiable manifest.

Yes: time-boxed, read-only guest access with watermarked exports. They see your program; they can't change anything.

Contractor Core includes 5 team members and unlimited read-only members. Contractor Plus includes unlimited team members.

14 days, full access to the plan you pick, card required at start. It converts to a paid subscription at day 14 unless you cancel, and we remind you before that happens. Cancel anytime from the billing page.

Yes, from the billing page. Switching during the trial is free.

Contractor Core is $399/month, Contractor Plus is $699/month, per organization. Annual prepay gets 2 months free. Details on the pricing page.