Talk to our CMMC experts

Not right now. On 13 July 2026 the Department of War suspended CMMC Phase 2, which would have made third-party (C3PAO) certification a condition of award from 10 November 2026; Phases 3 and 4 are frozen pending a 60-day review. What did NOT change: DFARS 252.204-7012 still applies, you must still implement the 110 NIST SP 800-171 Rev 2 controls, and your annual SPRS self-assessment score is still mandatory. The certificate was paused. The obligation was not.

Because self-attestation is now the only gate, and it is the one the Justice Department prosecutes. Under its Civil Cyber-Fraud Initiative, DOJ has settled fifteen False Claims Act cases — MORSECORP paid $4.6M for an inflated SPRS score, LOGZONE $507,144 for certifying a perfect 110 with controls unimplemented. With no assessor in the loop, the score you submit is your own representation to the government. HoundShield produces the evidence behind it.

The $499 AI Risk Assessment Report is a 14-day run: deploy the gateway, let it observe real AI usage, and receive a signed PDF mapped to NIST 800-171. You can see the scan engine work in seconds — paste a prompt into our in-browser demo and it is analysed on your own device, with nothing transmitted.

One price: $499, one time, for the AI Risk Assessment Report. There is no subscription, no per-seat licence and no contract. At $499 it sits below most corporate-card and signature thresholds, so it does not need procurement approval. The in-browser prompt scan at /demo is free and needs no account.

Yes. The $499 AI Risk Assessment Report is delivered as an audit-ready PDF mapped to NIST 800-171, alongside your System Security Plan (SSP) and Plan of Action & Milestones (POA&M). Every artifact carries SHA-256-signed, hash-chained evidence so an assessor — or an investigator — can verify it was not altered after the fact.

Prompt content never leaves your network. HoundShield scans locally: in the self-hosted Docker mode (Mode B), the CUI-safe deployment, nothing you scan is transmitted to us. The hosted trial runs on Vercel, which is not FedRAMP-authorized, so it is for non-CUI evaluation only. Audit logs are immutable and SHA-256 hash-chained, and we never train AI models on your data.