CMMC AI Risk Assessment Report

It is a one-time $499 engagement. HoundShield's proxy runs locally in your environment for 14 days, scoring every AI prompt event against NIST 800-171 Rev 2. You receive a SHA-256-signed PDF documenting what your team sent to AI tools, which controls it implicates, and the remediation sequence.

Fourteen days of passive scanning plus a few days to compile the report. Setup is a one-URL change behind a Docker container you run yourself, so there is no disruption — your team keeps using ChatGPT, Copilot, and Claude normally while the proxy observes and scores the traffic.

Yes. The proxy runs on your own infrastructure in Mode B, so prompt content never leaves your network — we never see it. The report is built from local scan results and control mappings only, and the audit trail is SHA-256 hash-chained so evidence cannot be silently altered.

No. The report is a standalone $499 purchase with no subscription, no signup, and no procurement cycle — checkout takes a card and an email address. Many teams later add a monthly plan for continuous monitoring, but the report stands on its own as assessor-ready evidence.

The report is designed as supporting evidence: findings are mapped to specific NIST 800-171 Rev 2 controls with SPRS impact, and every event carries a tamper-evident hash. Assessors make their own judgments, but control-mapped, hash-chained documentation of AI usage is exactly the artifact they ask contractors to produce.