SP 800-171 Posture & SPRS Defensibility — Kestrel Defense Systems
Continuous assessment against NIST SP 800-171 Rev 3 · 110 in-scope controls · Next SPRS affirmation: 2026-11-15 · CMMC Phase II: suspended (Task Force review)
SPRS ATTESTATION PACKAGE READY FOR REVIEW
Weekly bundle #14 signed · 3 findings closed · DoD Assessment Methodology worksheet regenerated · Point-in-time reconstruction ready · Verifier attached
Projected SPRS Score
74 / 110
Positive trajectory: +8 points in 4 weeks.
Filed score on record: 88 (2025-11-15) — 14-pt overstatement.
Close the gap before 2026-11-15 affirmation: 6 controls.
Filed score on record: 88 (2025-11-15) — 14-pt overstatement.
Close the gap before 2026-11-15 affirmation: 6 controls.
Control Families
8/ 14 covered
▲ +2 families since last bundle
Open Findings
7tracked
2 critical · 3 high · 2 medium
Evidence Freshness
4dsince sweep
Next sweep: Sun 02:00 UTC · in 3d 7h
SP 800-171 R3 Control Family Coverage
DRILL DOWN →3.1 · ACCESS CONTROL
Access Control
21 / 22 covered
3.3 · AU & ACCT
Audit & Accountability
9 / 9 covered
3.4 · CFG MGMT
Configuration Mgmt
6 / 9 · 2 partial
3.5 · ID & AUTH
Identification & Auth
11 / 11 covered
3.6 · INC RSP
Incident Response
3 / 3 covered
3.7 · MAINT
Maintenance
4 / 6 · v0.7 target
3.8 · MEDIA PROT
Media Protection
2 / 9 · v1.0 target
3.13 · SYS & COMMS
System & Comms Protection
15 / 16 covered
3.14 · SYS & INFO
System & Info Integrity
7 / 7 covered
3.11 · RISK ASSMT
Risk Assessment
2 / 3 partial
3.12 · SEC ASSMT
Security Assessment
2 / 4 partial
3.2·3.9·3.10
Awareness · Personnel · Phys
v1.0 target
Recent Weekly Evidence Bundles
FULL VAULT →2026-09-14 02:04Z
Bundle #14 · 82 evidence artifacts · 3 findings closed · SPRS 74 (▲ +2) SHA256:8f2a…6b1c
SIGNED
2026-09-07 02:03Z
Bundle #13 · 79 evidence artifacts · 5 findings closed · SPRS 72 SHA256:a413…f2d0
SIGNED
2026-08-31 02:06Z
Bundle #12 · 76 evidence artifacts · 2 findings closed · SPRS 67 SHA256:1c88…9e42
SIGNED
2026-08-24 02:07Z
Bundle #11 · 74 evidence artifacts · 4 findings closed · SPRS 66 SHA256:5d21…b7a9
SIGNED
Open Findings — Ranked by SPRS Impact
MANAGE ALL →| Sev | Control | Title | Asset | Owner | Age | SPRS Δ |
|---|---|---|---|---|---|---|
| CRIT | 3.8.9 | M365 mailbox litigation hold missing on CUI-mailboxes | M365 · 18 mbx | J. Ramírez | 4d | −5 |
| CRIT | 3.13.11 | CUI-tagged S3 bucket policy allows cross-account read | AWS · s3://kestrel-cui-eng | M. Ochoa | 2d | −5 |
| HIGH | 3.4.6 | 7 endpoints missing baseline CIS L1 hardening | CrowdStrike · 7 hosts | D. Nowak | 11d | −3 |
| HIGH | 3.5.10 | 3 service accounts without conditional access policy | Entra ID · 3 SPN | J. Ramírez | 6d | −3 |
| HIGH | 3.12.3 | ISCM assessment cadence gap for control 3.7.4 | VeraX · sched | Ndovu SE | 18d | −3 |
| MED | 3.4.2 | Chocolatey/winget package inventory incomplete | Endpoint · 22 hosts | D. Nowak | 9d | −1 |
| MED | 3.11.2 | Threat feed enrichment stale (> 72h) | Splunk · TI | M. Ochoa | 3d | −1 |
Integration Health
Microsoft 365 · Entra ID
Graph API · last scan 2h ago
GREEN
CrowdStrike Falcon
Query API · last scan 1h ago
GREEN
AWS GovCloud
Security Hub · last scan 4h ago
GREEN
Azure GovCloud
Resource Graph · last scan 3h ago
GREEN
Okta
Admin API · last scan 6h ago
RATE-LIMITED
Jira Cloud
Remediation loop · last event 12m
GREEN
Splunk Cloud
Threat feed · TI enrichment stale
STALE
Upcoming Deadlines
SPRS Attestation Package
External validator review
External validator review
2026-11-01
43d
43d
Prime Flow-Down Evidence
Northrop supply-chain request
Northrop supply-chain request
2026-10-15
26d
26d
Annual SPRS Affirmation
DFARS 252.204-7019
DFARS 252.204-7019
2026-11-15
57d
57d
CMMC Task Force Report
Phase II status decision
Phase II status decision
~2026-10-01
pending
pending
Activity Feed
12 min ago · SYSTEM
Continuous Testing Engine completed AC-family sweep · 22 objectives evaluated · 1 new finding · 3 closed
2 hr ago · J. RAMÍREZ
Closed finding F-2026-0091 (3.5.10 · SPN CAP policy) · attached PowerShell evidence
4 hr ago · SYSTEM
Attestation Engine generated DoD Assessment Methodology worksheet · projection 74 / 110 · variance vs. filed: −14
6 hr ago · M. OCHOA
Approved Agentic Remediation proposal for F-2026-0088 (3.13.11 · S3 CUI bucket policy)
yesterday · NDOVU
Ndovu Delivery shipped detection content update v0.5.4 · +7 controls · +12 findings enriched
yesterday · SYSTEM
Weekly bundle #14 signed by CustomerHSM/kestrel-01 · archived to Audit Vault
Prime Flow-Down
Northrop Grumman Space
Sub visibility opt-in · shares SPRS + freshness
Sub visibility opt-in · shares SPRS + freshness
Sierra Nevada Corporation
Sub visibility opt-in · shares SPRS + freshness
Sub visibility opt-in · shares SPRS + freshness
General Dynamics IT
Pending consent · not yet enabled
Pending consent · not yet enabled