Obilant A standard for real companies

SOC 2 · ISO 27001 · NIST 800-171 · CMMC

Whichever framework is blocking the deal.

Questionnaires answered in any format, a written policy set built on the systems you actually run, and the evidence assembled before the audit asks for it.

Book a call See prices
  • SOC 2
    Trust services criteria
  • ISO 27001
    Annex A · 93 controls
  • NIST 800-171
    110 requirements
  • CMMC
    Level 2

How it runs

Three steps, and a record at the end of them.

Compliance work goes wrong in the same place every time: answers get written to satisfy a form rather than to describe the company. This runs the other way round.

01 — INTAKE

No 75-minute discovery call.

Intake is a conversation with an agent instead of a meeting. You answer in your own words, at your own pace, and it asks a follow-up where an answer is thin. Your link arrives by email once we start.

02 — BUILD

Every answer starts on a blank sheet.

Policies are written against the cloud accounts, repositories and vendors you really run — never out of a library of stock responses. Where a control is not in place yet, it says so and gets a date.

03 — RECORD

What comes out is what you can defend.

Every claim traces back to a document or a screenshot. When an auditor asks where a line came from, there is somewhere to point.

Coverage

The controls overlap. The evidence is collected once.

Four frameworks ask many of the same questions in different words. The work is done against your systems, then mapped to whichever one the customer in front of you is asking for.

SOC 2 Trust services criteria — security, availability, confidentiality. Type I / Type II
ISO 27001 An information security management system, with the Annex A control set. 93 controls
NIST 800-171 Protecting controlled unclassified information on your own systems. 110 requirements
CMMC Defence supply chain maturity, built on the 800-171 requirement set. Level 2

About

Built so every answer can be traced.

Compliance documentation is usually written to satisfy a form. Obilant is built the other way round — every line traces back to a document, a screenshot, or a setting in a system you actually run.

Everything generates from one file.

The policy set, the questionnaire responses and the evidence index all come out of a single record of the systems you actually run — the cloud accounts, the repositories, the vendors. The documentation is generated, not billed by the hour, which is the whole reason the price sits where it does.

What that buys is not volume. It is that nothing gets claimed on your behalf that you could not defend in an assessment. Where a control is not in place, the document says so and gives it a date — and an answer that overstates what is there does not ship.

The short version

Focus
NIST 800-171 · CMMC
Also works in
SOC 2 · ISO 27001
Engagement
Flat monthly

Price

Three ways to work together.

Flat monthly, with no per-seat count and no charge per questionnaire. Move up a tier when the work moves up, not when the headcount does.

Baseline
$1,500
per month

Policy set, one framework, questionnaires answered as they arrive.

Start here
Operating
$3,000
per month

Evidence collection, vendor review, and the audit run end to end.

Start here
Department
$6,000
per month

Named security lead, customer calls attended, incident response on retainer.

Start here

Each tier sits below the threshold where most companies convene a committee, which means one person can decide.