149
CMMC 2.0 requirements in the library
Seeded and linked to controls, ready to switch on.
Frameworks
Purplecop GRC · CMMC 2.0
CMMC 2.0, scoped from the systems you actually run
For a defence contractor, CMMC starts with a hard question: which systems touch controlled information? Purplecop answers it from discovered assets, then maps CMMC's requirements to controls and tracks every gap to closure.
The difference
From a scoping guess to an assessed boundary
How a contractor prepares for CMMC on Purplecop.
Why Purplecop
What only Purplecop brings to CMMC
Scope, requirements and fixes on one platform.
Scope from real assets
Asset discovery merges AWS, Microsoft Intune and Entra ID into one inventory, so the controls are scoped to systems that exist.
Asset discovery
One control, many frameworks
A control shared across frameworks is created once in the library, not rebuilt for each one. The work you do for CMMC counts toward everything else you hold.
Map once, satisfy many
Findings that cannot quietly age
Corrective actions run through a tracked workflow with 5-Whys and fishbone analysis, ageing buckets and three escalation tiers.
Corrective actions
A control score anyone can explain
Control effectiveness is six weighted factors, from the audit conclusion to assurance, so anyone can see why a control scored what it did.
Audit management
What you get
Built on one platform, with people who use it
Platform
Purplecop GRC
The whole GRC estate in one product: frameworks, controls, policies, evidence, risk and audit on one control library.
FrameworksAsset discoveryControlsCorrective actionsAudit management
Services
Practitioners beside the platform
The team that runs your engagement works inside the same system, so the work they do stays with you.
Also on the platform
TPRM
Onboard, assess, score and continuously monitor every vendor in one workflow.
Third-party risk
Asset Intelligence
Asset discovery, network monitoring and the audit log in one module, so every asset’s data lives in one place.
Asset Intelligence
Phishing Simulation
Live phishing campaigns with per-user risk scores, run entirely in-house.
Human layer
LMS
Role-based security awareness training for every employee, tracked to completion.
Human layer
People
A directory of the people in scope for training, policy sign-off and access reviews.
People
RBAC
Role-based access control with granular permissions, on a least-privilege model.
Access control
Questions
What teams ask us about CMMC
Which CMMC level do we need?
It depends on whether you handle Federal Contract Information or Controlled Unclassified Information, and on your contracts. We work it out with you.
Does Purplecop perform the assessment?
No. Third-party assessments are performed by authorised assessment organisations. Purplecop prepares you.
How do you find the systems in scope?
Asset discovery reads AWS, Microsoft Intune and Entra ID, once connected, and flags devices nobody owns.
How much faster is it?
It scales with how much you integrate: the more connectors you turn on, the more evidence is collected automatically, saving up to 70% of the time you used to spend preparing for each assessment.
See it against your own scope
We will walk the product against your scope and show you what runs on day one and what needs configuring.