Client
Establishes scope, uploads evidence and works through outstanding requests with assistance. Answers the CUI question for each file.
Handoff: 37 files sent to Northwind Assurance, each bound to revision 4 with its hash.
AegisForge is the assessment platform for firms and the organizations they assess: CMMC, FedRAMP, RMF, NIST 800-53 and 800-171. Aegis, its agent, reads the evidence and proposes; every rating and every determination stays with a person, on one record.
4.2 Prior to authorizing access to any organizational system, Human Resources completes the background screening defined in Appendix A and records the result in the personnel file. Access is not provisioned until the screening result is recorded. Rescreening occurs every five years or on change of role.
Page 4 of 9The client drops what they have. Each file is screened and fingerprinted, matched to the open request it answers, and shown for review. The client changes any match, submits, and sees what is covered and what still needs attention. Aegis offers the next action.
| Dropped as | Proposed match |
|---|---|
| scan_0427.pdf | Personnel screening procedure v3.2 → PS.L2-3.9.1 |
| IMG_2231.png | MFA policy, privileged accounts → IA.L2-3.5.3 |
| export (3).xlsx | Local administrators, PMC-APP-01 → AC.L2-3.1.1 |
| diagram-final-v2.pdf | Boundary diagram r2 → SC.L2-3.13.1 |
| … 33 more · 37 proposed · 1 file held for a marking | |
| REQ-…-019 | Personnel screening procedure | OpenEvidence attached |
| REQ-…-018 | MFA policy | OpenEvidence attached |
| REQ-…-021 | Admin group membership | OpenEvidence attached |
| REQ-…-017 | Boundary diagram | OpenSuperseded · r1 still cited |
| REQ-…-020 | Access control policy | Open · nothing matched |
A client drops a ZIP into AegisForge.
The assessor opens an objective and the relevant artifact opens beside it. Aegis identifies the passage that supports it, or contradicts it, and suggests a rating with a rationale. The assessor edits, confirms, and the saved result carries its source trail.
4.1 Human Resources maintains the screening standard in Appendix A and reviews it annually.
4.2 Prior to authorizing access to any organizational system, Human Resources completes the background screening defined in Appendix A and records the result in the personnel file. Access is not provisioned until the screening result is recorded. Rescreening occurs every five years or on change of role.
Page 4 of 9The assessor opens PS.L2-3.9.1[a].
The same assessment, ASSESS-HPPM-2026-0001, moves from the client to the assessor, to the independent reviewer, to the approver. Each handoff is a visible event. Each decision is a person's. Choose a role to watch its part.
Establishes scope, uploads evidence and works through outstanding requests with assistance. Answers the CUI question for each file.
Handoff: 37 files sent to Northwind Assurance, each bound to revision 4 with its hash.
Examines the evidence, works through the controls, records ratings and rationale, and packages the work. Aegis reads and suggests; the assessor rates.
Handoff: revision 3 frozen and hashed, submitted for independent review.
Performs quality control: checks the evidence and the conclusions against the assessment plan, samples, and can return issues for correction. Never on the team.
Handoff: concurred with one note resolved, sent to the approver.
Approves the package for release. In a CMMC Level 2 assessment that is the firm's approver confirming the score, the status the results support and which Not Met items may carry a plan; in an RMF or FedRAMP workflow the same seat is the authorizing official. Reads the exact revision, down to the file behind any page.
Approved: score 104 of 110, Conditional Level 2 recommended, six 1-point items on a POA&M to close within 180 days. The MFA finding could not be deferred, so it was fixed and re-examined before the freeze. Released to the client.
| Request | Control | Status |
|---|---|---|
| REQ-…-019 · Personnel screening procedure | PS.L2-3.9.1 | Evidence attached |
| REQ-…-018 · MFA policy | IA.L2-3.5.3 | Evidence attached |
| REQ-…-021 · Admin group membership | AC.L2-3.1.1 | Evidence attached |
| REQ-…-017 · Boundary diagram | SC.L2-3.13.1 | Replaced with r2 |
| REQ-…-020 · Access control policy | AC.L2-3.1.1 | Answered this morning |
| PS.L2-3.9.1[a] | Met | examine, interview · EVD-NWA-0006 |
| PS.L2-3.9.1[b] | Not ratedMet | examine · EVD-NWA-0006 |
| IA.L2-3.5.3[a] | Not ratedNot Met | finding F-003 · not POA&M-eligible · must be Met before close-out |
| AC.L2-3.1.1[a] | Not ratedMet | examine, test · EVD-NWA-0021 |
| PS.L2-3.9.1[a] | r2 citation | Checking…Concur · r3 copy matches · note added |
| IA.L2-3.5.3[a] | Not Met 6 Nov · re-examined after enrollment · Met 17:50 | Concur |
Client · scope, upload, respond
1 of 4The Front Door is where an assessor works with Aegis. Ask for a control and its objectives, ratings and evidence come into the conversation. Open a file and the value that matters is marked. Where the evidence and the requirement disagree, Aegis shows the two side by side and proposes a result. Then do the same across a whole family: Aegis reads every unrated objective, you save the safe proposals in one press, and the adverse ones stay yours, one at a time.
Assessor on ASSESS-HPPM-2026-0001 · Harbor Point CUI Enclave
118 objectives not rated, 7 Not Met, 3 requests without files. As of 09:41.
AC.L2-3.1.10 has 3 objectives: 1 Met, 2 not rated. 2 files are linked. As of 09:41.
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
| Objective | Result | Rationale | Evidence |
|---|---|---|---|
| AC.L2-3.1.10[a] · the period of inactivity after which the system initiates a session lock is defined; | 1Met | Examined the access control policy v6; §4.3 sets the period at 15 minutes. | PDF 1 |
| AC.L2-3.1.10[b] · access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and | 0Not Assessed | Add rationale | XLSX 1 PDF 1 |
| AC.L2-3.1.10[c] · previously visible information is concealed via a pattern-hiding display after the defined period of inactivity. | 0Not Assessed | Add rationale | None · a gap, not a result |
Opened beside objective [b]. One value does not match the period your client defined: cell B5.
| Row | A | B |
|---|---|---|
| 1 | Setting | Configured value |
| 2 | Account lockout threshold | 5 attempts |
| 3 | Account lockout duration | 15 minutes |
| 4 | Minimum password length | 14 characters |
| 5 | Interactive logon: Machine inactivity limit | 3600 seconds |
| 6 | Password protect the screen saver | Enabled |
access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and
Requirement AC.L2-3.1.10[b] · a session lock after the defined period of inactivity.
Suggested rationale Examined the workstation settings export. The session lock engages after 3600 seconds (60 minutes); the access control policy defines 15 minutes (§4.3). The defined period is not implemented.
Advisory · You decide the rating and final wording.
It will read 65 objectives. It skips 5 already rated. It rates nothing and never changes a saved result.
What Aegis did Read 65 of 65 objectives. Proposed: 49 Met, 3 Not Met. 9 objectives have no files to read. 4 not read: no readable text. Advisory only: nothing is rated until you accept it.
| Objective | Result | Aegis | Evidence |
|---|---|---|---|
| AC.L2-3.1.1[a] · authorized users are identified; | 0Not Assessed1Met | Proposes Met · High confidenceSaved by you 09:49 · Aegis’s text | XLSX 1 |
| AC.L2-3.1.1[d] · system access is limited to authorized users; | 0Not Assessed1Met | Proposes Met · High confidenceSaved by you 09:49 · Aegis’s text | XLSX 1 PDF 1 |
| AC.L2-3.1.5[b] · access to privileged accounts is authorized in accordance with the principle of least privilege; | 0Not Assessed | Proposes Met · Moderate confidence | PDF 1 |
| AC.L2-3.1.8[b] · the defined means of limiting unsuccessful logon attempts is implemented. | 0Not Assessed1Met | Proposes Met · High confidenceSaved by you 09:49 · Aegis’s text | XLSX 1 |
| AC.L2-3.1.9[b] · privacy and security notices are displayed. | 0Not Assessed2Not Met | Proposes Not Met · High confidenceReviewed and saved by you 09:53 | PNG 2 |
| AC.L2-3.1.11[b] · a user session is automatically terminated after any of the defined conditions occur. | 0Not Assessed2Not Met | Proposes Not Met · High confidenceReviewed and saved by you 09:58 | PDF 1 |
| AC.L2-3.1.12[d] · remote access sessions are monitored. | 0Not Assessed2Not Met | Proposes Not Met · High confidenceReviewed and saved by you 10:04 | PDF 1 |
| AC.L2-3.1.10[c] · previously visible information is concealed via a pattern-hiding display after the defined period of inactivity. | 0Not Assessed | No proposal · no files to read | None |
8 of 65 shown · 57 more objectives in this family
44 High-confidence proposals on rows nobody has saved. Left for you: 3 with an adverse result; 5 below High confidence. Each is saved as your determination, marked as Aegis’s text.
44 saved as your determinations · Dana Whitfield · 09:49 · each marked as Aegis’s text
A accept X dismiss ⌘↵ save and nextAdverse results are yours, one at a time.
18 still need you: 5 below High confidence, 13 without a proposal.
4 Not Met results today. 3 are POA&M-eligible at 1 point each. AC.L2-3.1.12 is a 5-point requirement, so it gets no draft: it has to be Met before close-out.
| Requirement | Weakness | Plan | Owner | Planned completion |
|---|---|---|---|---|
| AC.L2-3.1.101 point · eligiblePOAM-HPPM-0007 · Open | Workstations lock after 60 minutes of inactivity; the policy defines 15 (§4.3). | Set the machine inactivity limit to 900 seconds; export the settings again. | —Elena Brooks | —9 Dec 2026 |
| AC.L2-3.1.91 point · eligiblePOAM-HPPM-0008 · Open | The logon notice is missing on 2 of 14 servers. | Apply the notice policy to both servers; capture their logon screens. | —Elena Brooks | —9 Dec 2026 |
| AC.L2-3.1.111 point · eligiblePOAM-HPPM-0009 · Open | VPN sessions have no idle timeout; the policy defines 30 minutes (§4.5). | Set the VPN idle timeout to 30 minutes; export the configuration. | —Elena Brooks | —9 Dec 2026 |
| AC.L2-3.1.125 points | Not POA&M-eligible. No draft: it has to be Met before close-out. | |||
Today in Access Control: 48 objectives rated under your name (44 Met, 4 Not Met) and 3 POA&M items created. 18 objectives still need you.
Aegis suggests; you decide. Check its sources.
The assessor types what they need: a control, with its objectives and evidence.
One control, in depth. Ask for a control and its objectives, results and evidence arrive in the conversation. The file opens beside the objective with the value Aegis cites marked, and what was defined sits beside what is configured.
Then the whole family. Run Aegis reads every unrated objective against its mapped evidence and proposes. It rates nothing, skips what a person already rated, and offers no proposal where there is no evidence to read.
Safe in bulk, careful where it counts. Accept safe proposals saves only High-confidence proposals with no adverse result, on rows nobody has saved, in one press, under your name. Adverse and less certain proposals are left for you, counted by reason.
POA&M items, together. Aegis drafts one per eligible requirement and says which are not eligible. You set the owner and the date and create them; the record shows who and when.
The two slowest parts of any assessment are defining the boundary and answering evidence requests. Pathfinder is Aegis's scoping and collection capability. Vector proposes the scope from an interview and your documents; Beacon turns the confirmed scope into collection tasks. You keep, reject, capture or skip.
Scope, with Vector. A guided interview and the documents you already have (an SSP, an asset export, a vulnerability scan, your provider's responsibility matrix) become a proposed boundary. Every item carries its source and the rule that placed it. A person with full permission keeps or rejects each one.
Frozen and bound. The confirmed scope is hashed and bound to the assessment that uses it. A later change opens a new version with a "what changed since v1" diff; a significant change reopens only what moved.
Collect, with Beacon. From the confirmed scope, Beacon lays out what each control's request needs, item by item, with capture help. Signed in as an administrator of your own environment, you press Capture or Skip. What you capture is named, routed and given an evidence ID before you send.
Facts once, every framework. CMMC Level 2 first, HIPAA next. Cloud and managed-service inheritance is first class: inherited, shared or yours, with the provider's evidence reference.
Aegis is the assessor's companion inside AegisForge. It reads the evidence on your assessment, finds the passage, drafts the finding and proposes the rating, inside your permissions. The parts below show what the platform does; the band after them shows how the agent is kept inside the lines.
Aegis proposes. You decide with one press. The record shows both.
In the product today · six parts, each shown working
Link a SharePoint folder, read only. AegisForge reads a file where it lives and records its fingerprint and version each time. Nothing is copied unless you send it.
Or send files in, or record a file by its hash alone. Whichever home you choose, Aegis works from the passages it needs and the counts, never the files, and marked content is refused at the door.
Upload supported files in a ZIP or select them together. Review the proposed matches to open evidence requests, change any match, then submit.
Every file is screened and fingerprinted on arrival: PDF, Word, PowerPoint, Excel, images, text, CSV, JSON, XML, email and HTML. A match is a proposal until you submit it, and the record keeps each file's name, size, hash and arrival time.
CMMC Level 2 / NIST SP 800-171 Rev. 2, NIST SP 800-53 Rev. 5, and FedRAMP Rev. 5 Low, Moderate and High, chosen when the assessment is created.
When an assessment is created from a published catalog, its selected catalog version and baseline are pinned to that assessment, so every role rates the same version of the same controls.
Draft and export SSP content, assessment reports and POA&M records from the assessment workflow. Supported report PDF and Word exports use configured organization branding and defined report outlines.
People review and accept drafted content before release. The export is built from the record, so the figures in it are the figures on the record at the time it was generated.
Each weakness gets a plan, an owner, a date and the evidence that closes it. Aegis watches the recorded dates and flags what is due. Closing is your press.
Milestones, risk and the remediation evidence live on the item, between assessments as well. Reminders come only from recorded dates, never estimates, and the close-out is recorded with who and when.
Import supported Nessus or Tenable scan exports, review the results and confirm candidate findings.
The import is previewed before anything is created, and a confirmed finding carries the scan as its source. Every number on the dashboard is computed from the records, with the time it was read.
How we run the AI
Aegis reads, finds, drafts and proposes. It cannot rate, accept, approve, submit or send. Each of those is a press by a named person, and the record keeps the press, the proposal it answered and the evidence both pointed to.
AegisForge is built to protect the client's record and to keep the agent inside the lines. The frame beside this is one rating, as the back end sees it.
One rating, as the record sees it.
Every rating, acceptance, approval and submission is a human press, recorded with who and when. Nothing fires on its own.
Role, tenant and assessment are checked on each read. Aegis has no database access and no free-form queries, and an instruction found inside a document is text, never a command.
SHA-256 when a file arrives and when it is read for the record, with its version. A changed file is a new fact, and a proposal that cited the old one is withdrawn.
Every item carries a data label. Marked controlled content is refused before any model sees it. A hosted model receives client content only on an approved path, never silently.
Every number on screen is computed from the records, with its numerator, denominator, scope and the time it was read. The model names a view. It never does the arithmetic.
Which engine, which model, what it read, what it proposed, what it cost. Audit entries are hash-chained, so a change to the past shows.
Missing or unreadable evidence is reported as missing, never turned into a rating. There is no confidence percentage and no score. A prior opinion is a claim to check, never a source.
No model and no vendor is written into the code. A model is tested against a blind set before it is activated, and it can be swapped without touching the record.
Aegis is on for everyone during an assessment. After close-out, the record stays; what you add is how much Aegis keeps doing between assessments.
For the assessment, from invitation to close-out. A firm and its client, every role.
After close-out. The client keeps the record and its read-only history.
Always on, between assessments as well. For the client who wants the agent working the record all year.
Self-assessment, bring your own assessor, enterprise. Firms with their own teams and organizations assessing themselves.
Under a minute, six chapters: the client drops a ZIP, Aegis reads the evidence, the assessor works through the controls, the reviewer checks the work, the approval lands on the record, and the assessment is delivered. A staged example with synthetic data, scripted from the product as it will ship.
| Dropped as | Proposed name | Proposed match |
|---|---|---|
| scan_0427.pdf | Personnel screening procedure v3.2 | PS.L2-3.9.1 |
| IMG_2231.png | MFA policy, privileged accounts | IA.L2-3.5.3 |
| export (3).xlsx | Local administrators, PMC-APP-01 | AC.L2-3.1.1 |
| diagram-final-v2.pdf | Boundary diagram r2 | SC.L2-3.13.1 |
| … 33 more · 37 proposed · reviewed by Elena Brooks | ||
4.2 Prior to authorizing access to any organizational system, Human Resources completes the background screening defined in Appendix A and records the result in the personnel file. Access is not provisioned until the screening result is recorded. Rescreening occurs every five years or on change of role.
Page 4 of 9| PS.L2-3.9.1[a] | Not ratedMet |
| PS.L2-3.9.1[b] | Not ratedMet |
| PS.L2-3.9.2[a] | Not ratedNot Met |
| PS.L2-3.9.2[b] | Not rated |
| Sampled | Why | Decision |
|---|---|---|
| PS.L2-3.9.1[a] | Rationale cites r2 evidence | Concur · note added |
| IA.L2-3.5.3[a] | Not Met 6 Nov · re-examined after enrollment · Met 17:50 | Concur |
| AC.L2-3.1.1[a] | Random | Concur |
Harbor Point Property Management · CMMC Level 2 · released by Northwind Assurance · 7 Nov 17:05
Press play. Captions appear here.
Request a demo
Explore how your team can review evidence, work through controls, and turn findings into clear next steps, with Aegis assisting throughout.
A person from OGMi Solutions reads it and replies to your email to set up a working session on your kind of assessment.