Book a demo
Assessed against CMMC 2.0

Know which policies
are still true.

Your documents passed the last audit. Then eighteen months happened. Luescor reads every SOP and policy you have, maps each one to the controls you are assessed against, and shows you where the evidence stopped holding up, while there is still time to fix it. Your documents never leave your cloud.

30 minutes. Send one policy beforehand and watch it get assessed.

luescor · assessment example
Documents0 of 4 indexed
NIST SP 800-171 · 110 requirements
 
0%
Coverage
110
No evidence
Covered Partial No evidence
Frameworks CMMC 2.0NIST 800-171ISO 27001 SOC 2HIPAAPCI DSS Essential EightGDPRISO 17011 Not seeing yours? →
The problem

Nothing tells you when a policy stops being true.

A process changes. Someone leaves. A tool is replaced. Each one is small, none of them triggers a document review, and the procedure on file goes on describing a company that has quietly stopped existing. Nobody finds out until an assessor reads it back to you in a room.

01 · DRIFT

Practice changes. The document does not.

The way something is done changes on a Tuesday. The document describing it changes when somebody remembers, which is usually never. Nothing in between flags that the two no longer agree.

02 · MAPPING

Nobody has re-checked the mapping

Which document satisfies which control usually lives in a spreadsheet built once, by someone who has since moved on, and never verified against the documents again.

03 · EXPOSURE

You find out from the assessor

A finding against a document you believed was fine means a corrective action, a response deadline, and a re-assessment. On CMMC it can mean contract eligibility you cannot afford to pause.

Where this sits

Your systems are already watched. Your documents are not.

Compliance automation platforms connect to your stack and check configuration continuously. They do that well. They were never built to read the procedures on your file server and tell you whether they still describe what you do.

Compliance automation

Watches your systems

Monitoring
MFA enforced on all accounts now
Encryption at rest enabled now
Backups completed now
Endpoint agents reporting now
Offboarding completed now
Vulnerability scan current now

Continuous and automated. Everything here is a machine state that can be queried, so it can be re-checked every few minutes forever.

Answers: is the system configured correctly?
Luescor

Reads your documents

Unchecked
Access-Control-Policy.docx approved Mar 2024
Jun 2024 VPN vendor replaced
Nov 2024 Approver left the company
Mar 2025 Access review moved to quarterly
Today Document unchanged since approval

No integration can answer this. It takes reading the document against the requirement, and noticing when the two stopped agreeing.

Answers: is the documentation still true?
How it works

Connect, assess, maintain.

Connecting takes minutes and the first results land the same day. The third step is the one every other tool hands back to you.

01

Connect your storage

Point Luescor at SharePoint, an S3 bucket, or an Azure container. Documents are read where they already sit. Nothing is copied onto our infrastructure, and access is scoped to the one location you nominate.

02

Assess against the control

Each document is read requirement by requirement. You get the passage that satisfies a control, a plain description of what is still missing, and a count of the requirements nothing in your library answers.

03

Maintain it between audits

Versions, review dates, and sign-off on every document. When something falls out of date you hear it from us with months to spare, instead of from an assessor with days.

Who it's for

Organizations where the paperwork is the audit.

If most of your evidence comes from cloud integrations, a compliance automation platform will serve you better. Luescor is for the other case.

DEFENSE SUPPLY CHAIN

CMMC and NIST 800-171

Contractors and subcontractors where a written procedure is the artifact an assessor examines, and much of the environment is on-prem or air-gapped.

ACCREDITATION AND CERTIFICATION

ISO 17011 and 17021

Bodies whose entire management system is documentation, assessed against a standard with over a hundred clauses and no integration that can prove any of it.

REGULATED ENTERPRISE

Where integrations only reach half of it

Organizations running significant on-premise, custom, or legacy systems. Once automated evidence collection has taken what it can, most of what is left to prove is documentation.

Coverage

Every requirement, checked one at a time.

Not "you should have an access control policy." The specific requirement, the sentence in your document that answers it, and a straight answer where nothing does. CMMC Level 2 is 110 practices. ISO 17011 is 155 clauses. Each one gets its own verdict.

Not seeing yours? →
CMMC 2.0 Level 2110 practices
AC.L2-3.1.1Limit system access to authorized users and processesCovered
AU.L2-3.3.1Create and retain system audit logs for monitoring and reportingPartial
IR.L2-3.6.1Establish an operational incident-handling capabilityCovered
SC.L2-3.13.11Employ FIPS-validated cryptography to protect CUINo evidence
NIST SP 800-171 Rev 2110 requirements
3.1.2Limit access to the types of transactions authorized users may executeCovered
3.5.3Multi-factor authentication for local and network accessCovered
3.8.3Sanitize or destroy media containing CUI before disposalNo evidence
3.12.4Develop and periodically update the system security planPartial
ISO/IEC 27001:202293 controls
A.5.1Policies for information securityCovered
A.5.15Access control policy and rulesCovered
A.8.16Monitoring activities for anomalous behaviourPartial
A.5.30ICT readiness for business continuityNo evidence
SOC 2 Trust Services Criteria64 points of focus
CC6.1Logical access security over protected information assetsCovered
CC7.2Monitor system components for anomaliesPartial
CC8.1Change management over infrastructure and softwareCovered
A1.2Environmental protections and recovery infrastructureNo evidence
ISO/IEC 17011:2017155 controls
17011-4.4.6Impartiality risk identification and mitigationCovered
17011-7.12.4Assessment team competence recordsPartial
17011-9.3Internal audit programme and reportingCovered
17011-9.7.1Complaints handling procedureCovered
What you get

Documents you can hand over.

Every output is an artifact an assessor will accept, not a dashboard screenshot you have to talk them through.

PDF

Assessment report

Coverage per control with the evidence cited, ready for an assessor or for your board.

DOCX

Drafted procedures

Where nothing covers a control, a draft written from your own context and marked clearly for review. Never invented as fact.

LOG

Revision history

Version, author, approver, date. Written as it happened rather than reconstructed under deadline.

CSV

Gap register

Every unmet requirement, what is missing in plain language, and who owns closing it.

Document control

Built for the eighteen months in between.

Most compliance tools are built for the six weeks before an assessment. Those six weeks are expensive precisely because of everything that went unrecorded before them. This is the part that stops the next six weeks from happening.

VERSIONING

Every revision recorded

What changed, who approved it, when. The history an assessor asks for already exists by the time they ask.

CADENCE

Review dates that surface

Every document carries an interval. Overdue ones appear on your screen before they appear in someone else's finding.

SIGN-OFF

Approval as a record

Who approved which version, and when, recorded at the time. Not reconstructed from memory and an email thread on the week of the assessment.

Data residency

Your documents stay in your cloud.

This is the first question every security team asks, so here is the direct answer.

  • Your storage, your credentials. Documents and assessment records are written to your own S3 bucket or Azure container, using credentials you issue and can revoke at any time.
  • Nothing retained by us. Document text is held in memory only while an assessment runs, then released.
  • Your AI accounts, optionally. Bring your own Anthropic and OpenAI keys and the model calls bill to you, under your terms with those providers.
  • No shared storage, ever. An organization without its own storage configured cannot write data at all. That is enforced in code, not promised in a policy.
Talk to us about your environment
01
Your SharePoint or cloud storage
Source documents, never moved
02
Read into memory, assessed
Transient. Nothing written to our servers
03
Results written back to your storage
Coverage, notes, evidence, generated documents
Questions

The things people ask on the first call.

Then you should not buy this, and we will say so. The first assessment is what we lead with because it is the fastest way for both of us to find out whether there is a problem here worth paying to solve. If your mapping is current and your documents genuinely say what you do, you do not need us. Establishing that in week one costs you half an hour. Establishing it in month six costs considerably more.

Underneath it, on the part it does not reach. Those platforms query system state, and system state is queryable, so they do it continuously and well. A procedure is not a system state. Whether it still describes how your team works is a reading problem, not an integration problem, and it is the part those platforms hand back to you as a policy template to fill in. If your evidence is mostly cloud configuration, start with one of them. If most of what an assessor will read is documents, that is the gap we sit in.

Tell us which one. Frameworks are loaded as control text rather than built into the product, so the list reflects what has been loaded so far rather than what is possible. Internal standards and customer-specific requirement sets have the same shape as a published framework and are handled the same way. It is worth a conversation rather than an automatic no.

No, and the distinction matters more here than almost anywhere else. Where a control has nothing behind it, Luescor produces a draft from your own organizational context and marks it as a draft. It will not describe a process you do not have, it will not claim a control is met because a draft exists, and it does not approve anything. A named person still reviews and signs every document, and the record shows that they did. An assessor is entitled to ask who approved a procedure, and "the software" is not an answer that survives the question.

Both are supported. SharePoint connections resolve the tenant's cloud automatically and work against commercial, GCC High, and DoD. On-premise is less of an edge case than it sounds: because Luescor assesses documents rather than querying systems, an air-gapped environment produces exactly the same result as a cloud-native one. It is usually the environments with the least automation coverage that have the most documentation to prove.

Documents and results sit in storage you own and control, which is covered in full above. The question that section does not answer is the AI one: model calls are made to Anthropic and OpenAI, and by default they run under our accounts. You can supply your own API keys for either provider, in which case that processing runs under your agreements and your terms with them rather than ours. Luescor is hosted on commercial cloud infrastructure and is not FedRAMP authorized, which is worth knowing early if you are scoping a CUI boundary.

Nothing moves. Your documents, coverage history, notes, and generated procedures are already in your own bucket in open formats, because that is the only place they have ever been. There is no export process, no data request, and no window to act inside. Losing access to Luescor means losing the tool that reads them, not the work it produced.

The first assessment runs once storage is connected, and the number that matters arrives with it: how many requirements currently have nothing behind them. That number usually lands higher than the team expected. Getting it early is uncomfortable, and it is the entire reason to run it now rather than on the eve of an assessment, when the same number stops being a work item and becomes a schedule problem.

Send one policy. We will show you what it misses.

A working session, not a slide deck. Send a single document ahead of the call and we will map it to your framework on screen, clause by clause, while you watch. If it comes back clean, we will tell you that too.

Book a demo

30 minutes · One document · No preparation needed