Writing
What we’re writing
Notes on NIST 800-171, evidence discipline, and running a compliance program in a small defense shop. Written by the people building Valontir.
Obligations · 2026-08-15
What the CMMC Pause Does and Doesn't Change About Your Obligations
CMMC Phase II is suspended. DFARS 7012, SPRS scores, self-assessments, the annual affirmation, and False Claims Act exposure are not. Here is what still binds you.
Read more →Affirmation · 2026-08-03
The Annual Affirmation: What You're Actually Signing, and What Stands Behind Your Signature
Who signs the annual affirmation, what 32 CFR 170.22 makes them attest to, and what False Claims Act enforcement means for the evidence behind it.
Read more →SPRS · 2026-08-03
Your SPRS Score, Explained: How the −203 to +110 Math Actually Works
How the SPRS score really works: the −203 to +110 range, DoD's 1/3/5-point weights, worked examples, who sees your score, and how to raise it.
Read more →SSP · 2026-08-03
Writing an SSP for a 40-Person Shop (Without Paying a Consultant Five Figures)
What a NIST 800-171 System Security Plan must contain, how to structure per-requirement statements, why templates fail, and what assessors check.
Read more →