NIST 800-171 · CMMC · ISO 27001
Skans ships meeting the technical controls of NIST 800-171 and CMMC at mandated defaults — FIPS mode, hardware-backed MFA, a CIS/STIG baseline, TLS everywhere — and assembles the evidence pack from live state on one command. The organizational controls stay yours, spelled out per control in a responsibility matrix with any gaps tracked in a POA&M. It supports your certification; no product can grant it.
On by default
The hard technical controls don't wait for a hardening sprint. From the first boot the appliance runs its cryptography in FIPS approved-mode, admits operators only with hardware-backed MFA, applies a CIS/STIG baseline, and encrypts every device and service. The posture starts compliant and stays enforced — a severed WAN changes none of it.
Measured, not assumed
Compliance is read off the box, device by device, never inferred from a policy that should have applied. Each managed device carries an X.509 identity and an agent-measured scorecard; a control Skans hasn't actually measured stays Not Verified rather than turning green. Agentless devices are marked N/A for agent checks — they never silently count as passing.
Live posture
Skans maps its live technical checks to the NIST 800-171 control families and reports posture from current appliance state — not a spreadsheet from last quarter. The same measurements crosswalk to all 93 ISO/IEC 27001:2022 Annex A controls via NIST's published OLIR #155 mapping, so every link traces back to a reference standard. It never rolls that crosswalk up to a single "you're compliant" score — that would be a lie over a standard that is mostly organizational — so it reports honest buckets over a fixed denominator instead.
Assessment-ready
From the Compliance hub, a single command produces a timestamped, air-gap-friendly .zip assembled entirely from live state — no hand-collation the night before. Inside is the system security plan status, a live POA&M of open gaps, the responsibility matrix, the asset inventory and the audit log, all under a signed manifest. Alongside it, an append-only, hash-linked audit chain lets you prove nothing was edited after the fact.
Where the boundary sits
Being straight about the edges is part of the point. Skans does the technical heavy lifting and generates the evidence; it never pretends to be your certification.
Roughly a third of NIST 800-171's 110 requirements are organizational — physical, personnel, planning, program, and the process parts of incident response. Those stay yours, spelled out per control in the responsibility matrix.
No product makes you "CMMC compliant in a box." Formal Level 2 standing needs a third-party assessment by a C3PAO; ISO 27001 certifies your ISMS, not an appliance. Skans generates the evidence — it doesn't replace the assessor.
The audit chain detects modification cryptographically, but it isn't write-once media. We describe it as tamper-evident — never as WORM or immutable — because that's what it is.
The appliance runs in FIPS 140-3 approved-mode — capable, not the same as a CMVP-validated module. Per-release module pinning is an open item, and an independent penetration test remains yours to run.
Talk to us
Built for the teams running networks the cloud can't reach. Email us for a technical walkthrough — architecture, controls, and exactly how it stays offline.