What is the CMMC AI Risk Assessment Report?

It is a one-time $499 engagement. HoundShield's proxy runs locally in your environment for 14 days, scoring every AI prompt event against NIST 800-171 Rev 2. You receive a SHA-256-signed PDF documenting what your team sent to AI tools, which controls it implicates, and the remediation sequence.

How long does the $499 assessment take?

Fourteen days of passive scanning plus a few days to compile the report. Setup is a one-URL change behind a Docker container you run yourself, so there is no disruption — your team keeps using ChatGPT, Copilot, and Claude normally while the proxy observes and scores the traffic.

Is my data safe during the assessment?

Yes. The proxy runs on your own infrastructure in Mode B, so prompt content never leaves your network — we never see it. The report is built from local scan results and control mappings only, and the audit trail is SHA-256 hash-chained so evidence cannot be silently altered.

Do I need a HoundShield subscription to buy the report?

No. The report is a standalone $499 purchase with no subscription, no signup, and no procurement cycle — checkout takes a card and an email address. Many teams later add a monthly plan for continuous monitoring, but the report stands on its own as assessor-ready evidence.

Will a C3PAO accept the report as evidence?

The report is designed as supporting evidence: findings are mapped to specific NIST 800-171 Rev 2 controls with SPRS impact, and every event carries a tamper-evident hash. Assessors make their own judgments, but control-mapped, hash-chained documentation of AI usage is exactly the artifact they ask contractors to produce.

The fastest CMMC / HIPAA AI evidence

CMMC AI Risk Assessment Report

Your staff are pasting sensitive data into ChatGPT and Copilot right now — with no audit trail. For $499, one time, we scan your AI usage locally and hand you the evidence an assessor asks for. No subscription, no procurement cycle, no data leaving your network.

$499one-time · per organization · delivered in days

Talk to us first

Most reports delivered within days of intake.

See a sample report (PDF) →Prove it on your own prompt — free instant snapshot →

What you get

Local scan of your AI prompt traffic across 16 detection engines (CUI / PHI / PII / IP / ITAR)
Findings mapped to NIST 800-171 Rev 2 controls with your SPRS impact
Tamper-evident, SHA-256 hash-chained audit trail
5-page PDF an assessor can drop into your evidence package
Mode B (Docker) deployment — prompt content never leaves your network
A 30-minute readout of the findings and recommended next steps

How it works

1. Order & intake

Pay the flat $499. We send a 5-minute intake: which AI tools, how many seats, your environment.

2. Local scan (Mode B)

Run the Docker proxy on your own infrastructure. It scans every prompt locally — nothing leaves your boundary.

3. Your evidence PDF

You receive the assessment report mapped to NIST 800-171, ready for your C3PAO or HIPAA auditor.

Why local-only matters

Every cloud-based AI DLP tool sends your sensitive data to its servers to scan it — itself a potential HIPAA or DFARS 7012 exposure. HoundShield scans on your own infrastructure (Mode B, Docker) in under 10ms. The data that matters never leaves your network. A cloud competitor structurally cannot match that boundary.

Read the full Security & Trust page, or our Data Processing Agreement.

FAQ

Assessment report questions, answered

Still have questions? Talk to a compliance engineer — we respond within 4 business hours.

Get your evidence in days, not months

Are you an RPO or MSP? See the partner program →