Federal readiness as a diligence artifact.
Security posture has an audit report. Financials have an auditor. Federal readiness has a pipeline spreadsheet and a paragraph of management narrative, which is why it is the section of the memo written last and believed least. The public record supports something better: the same twelve categories for every company, dated, and reproducible by whoever reads the memo after you.
A pipeline is a forecast, not a record.
None of these is deception. They are what a company has to hand when nobody has ever asked it for the other thing.
-
The pipeline slide cannot be falsified
An opportunity list is assembled from what a team intends to pursue. A reader cannot check any line of it, and nothing in its format distinguishes a lane the company has served before from a name somebody added after a conference.
-
Compliance claims arrive in the data room as facts
A questionnaire answer sits in the same typeface as the audited numbers. Some of those answers correspond to a government-published record and some correspond to an internal target date, and the document rarely says which is which.
-
Every company tells its federal story in a different unit
One portfolio company counts engagements, the next counts agencies, and the third quotes the ceiling of a multiple-award program it is merely eligible to compete under. Three formats, no comparison — and the last of them is not a figure about that company at all.
-
Nobody re-runs the read a year later
Registrations lapse, listings appear, engagement footprints go quiet. A one-off diligence read leaves no baseline to measure against, so drift is discovered at the next raise rather than at the next board meeting.
One page, the same twelve questions, every company.
A readiness score here is 100 points assembled from 62 lenses across 12 categories of public federal data. For diligence the useful property is not the number but the procedure: it is produced identically for every company you look at, from sources the company does not control and cannot quietly restate.
That makes three things possible which a management deck cannot do. Two companies become comparable on the same axes. The page can be handed to a partner who regenerates it without you. And the read carries a date, so the next one is a measurement rather than a fresh impression.
It is a diagnostic and not a view on the investment, and it is built only from what agencies and registries publish. Where the public record is silent the page says so instead of filling the space — which is precisely the property that makes it usable as evidence in a memo.
The full category list, what each one reads, and what the score never claims are on the methodology page.
- A first pass that costs nothing
- Read the company before the meeting. The whole vendor page — score, categories, engagement footprint and compliance overlay — is free and needs no account, so a name can be checked the moment it comes up.
- Which claims carry a source
- The overlay keeps a government-published record apart from the company’s own statement, so a questionnaire answer can be corroborated rather than accepted and footnoted.
- Engagement footprint, never a ceiling
- Public prime obligations by agency and industry code, with the reporting lag stated on the page. Multiple-award program ceilings are shown as access to compete and never summed into a total: a ceiling is permission, not money obligated.
- A baseline you can re-run
- Observation dates are on the page, so the same read twelve months from now is a comparison against this one — which is the part that turns a diligence exercise into monitoring.
Three badges, three different evidentiary weights.
This is the part of a vendor page a diligence reader should open first, because it is the part a data room most often flattens. The same three programs render three different ways here, and what differs is who is doing the asserting.
- FedRAMP
A government-published register says so, and we recorded the date we looked. Of the three, this is the only one you can cite back to a partner or an acquirer.
- SOC 2
The company says so. That belongs in the memo as a representation by management, carrying the weight you would give any other unaudited representation — which is not nothing, and is not a control either.
- CMMC
The public record is silent: not a negative finding and not a pass. Because mandatory certification was suspended on 13 July 2026, the supply of third-party records is no longer growing, so more of what you find on any vendor will be the middle badge.
A page that rendered all three the same way would read more cleanly and would be evidence of nothing. Keeping them apart is the reason this one survives being quoted.
Free for the first pass. Published for the rest.
Reading any single company’s page costs nothing and needs no account, so the first look at a new name never has to be justified to anyone.
Once a name becomes a position, monitoring it is the Team plan: $499 a month, or $4,990 taken annually. Watchlists across the companies you hold, and an export into whatever the diligence model already is. The vendor pages themselves stay open to everyone — what a subscription buys is the tracking, not the access.
The pricing page carries every tier and the contract terms restate the same numbers. No subscription here grants visibility into a government-only system; that is not a capability being held back for a larger plan.
Run one now, on a name you already hold.
The fastest way to judge whether this belongs in your process is to read the page for a company you already know well, and count how much of the federal section it could have written for you.
The compliance claim you will meet most often
Six pages on the assertion that turns up in every defense-adjacent data room: what the 13 July 2026 suspension paused, what DFARS 252.204-7012 obliges regardless, and how to tell a posture a company holds from one it intends to hold.
Or read the ungated version first — what the suspension changed →