Waypoint Platform

The GRC Platform that drives readiness to 110.

Waypoint is the platform we use with Security Nomads clients to run CMMC and NIST 800-171 readiness from intake through final deliverables. It is live in production at waypoint.securitynomads.com, with multi-tenant SaaS as the stated direction.

Book a demo → Back to services

Live in productionBuilt for the firm’s clients

01 — The 110 story

Readiness becomes a score you can move.

Waypoint evaluates the work where it happens: at each assessment objective. As objectives are met, the live SPRS score climbs toward 110/110, giving our team and our clients one current view of progress.

The score is tied to the tracker beneath it—objective status, evidence, assessor cues, and remediation work—not a disconnected summary.

02 — Inside Waypoint

The work, visible at objective level.

A connected view of assessment status, remediation, evidence, and the statements that document implementation.

/assessments/objectivesLIVE

NIST 800-171 REV 2Objective tracker

SPRS SCORE104 / 110

C3PAO readiness · review

Objective	Assessment objective	Status	Evidence
3.1.1[a]	Authorized users are identified.	Met	6
3.1.1[b]	Processes acting on behalf of users are identified.	Met	4
3.1.2[a]	Permitted system functions are defined.	Not Met	2
3.5.3[b]	Multifactor authentication is implemented.	Not Met	1
3.13.11[a]	FIPS-validated cryptography is employed.	Not Met	0
3.1.1[c]	Authorized devices are identified.	In Progress	2
3.1.1[d]	System access is limited to authorized devices.	Not Assessed	0
3.1.2[b]	Authorized transactions are enforced.	N/A	0

320 objectives · 110 controls · 14 domainsOnly Not Met deducts points

/remediation/poamLIVE

AUTO-GENERATED REMEDIATIONPOA&M

3 active

Source	Remediation	Status	SPRS impact
3.5.3[b]	Enforce MFA for privileged access	Open	−5
3.13.11[a]	Validate cryptographic modules	In Progress	−3
3.1.2[a]	Document permitted functions	Open	−3

↳ Generated automatically from Not-Met objectives. Stale items are flagged, never deleted.

/evidence/libraryLIVE

UPLOAD ONCE · ATTACH TO MANYEvidence library

3 files

PDF

mfa-policy.pdfPolicy document

attached to 6 objectives

PNG

backup-config.pngConfiguration evidence

attached to 4 objectives

XLSX

training-log.xlsxTraining record

attached to 8 objectives

/ssp/statementsLIVE

3.5.3 · IDENTIFICATION & AUTHENTICATIONImplementation statement

Generated from policy

“

The organization requires multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

SOURCE · mfa-policy.pdf

03 — Capabilities

The whole readiness lifecycle, in one trail map.

From objective-level work to assessor-ready deliverables, Waypoint keeps the program connected.

01 / TRACK

Objective-level tracking

Status per assessment objective, not just per control. 800-171 Rev 2 covers 14 domains, 110 controls, and 320 objectives; Rev 3 is supported.

02 / SCORE

Live SPRS scoring

A real-time score out of 110 that climbs as objectives are met.

03 / REMEDIATE

Auto POA&M

Not-Met objectives generate POA&M items automatically; stale items are flagged, never silently deleted.

04 / EVIDENCE

Evidence, once

Upload evidence once and attach it to many objectives, with per-objective counts and download.

05 / ASSESS

Assessor hints

Evidence-type chips and C3PAO readiness cues appear on the tracker.

06 / GENERATE

SSP & policy generation

Implementation statements pull live from policy documents, with per-domain plus custom policies.

07 / INTAKE

Client intake to statements

A discovery questionnaire feeds the draft-statement engine.

08 / EXPORT

Branded exports

DOCX SSP, Excel tracker, executive-summary PDF, and artifacts ZIP—white-labeled to each client.

04 — The workflow

How readiness works in Waypoint.

01IntakeDiscovery questionnaire
02Objectives & evidenceTrack, attach, assess
03Live SPRSScore progress in real time
04Auto POA&MSurface remediation work
05SSP & policiesGenerate live statements
06Branded exportsDeliver the complete package

05 — Frameworks

Built around the standards that define the climb.

NIST SP 800-171

Revision 2

14Domains110Controls320Objectives

NIST SP 800-171

Revision 3

17Domains97Controls508Objectives

CMMC

Levels 1 & 2

Level 1 covers 17 controls. Waypoint also supports Level 2 readiness.

06 — White-label delivery

Their program. Their identity.

Client-branded deliverables are a Waypoint product feature. Each client’s own logo and colors carry through the package—from the SSP to the executive summary—so the final work belongs unmistakably to their program.

DOCX SSPExcel trackerExecutive PDFArtifacts ZIP

Let’s talk

See the whole route inside Waypoint.

Book a discovery call →Back to services

Response

Within 24 hours

Hours

Mon–Fri · CT

Coverage

Remote-first · on-site on request