ComplyUp
ComplyUp is a SaaS compliance assessment platform that helps Department of Defense contractors and MSPs achieve NIST 800-171 and CMMC certification through guided assessment, SSP/POA&M generation, and SPRS scoring, now part of Exostar's CMMC Ready Suite following a December 2024 acquisition.
- Company typePrivate
- Founded2017
- HeadquartersTampa, United States
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What ComplyUp does
ComplyUp, legally Compliance Management Solutions Inc., is a SaaS compliance assessment platform that helps U.S. Department of Defense contractors and managed service providers (MSPs/RPOs) achieve and maintain compliance with NIST 800-171 and the Cybersecurity Maturity Model Certification (CMMC). The platform guides users through a structured journey — assessment (gap analysis), documentation (System Security Plan and Plans of Action & Milestones), SPRS scoring, remediation, and ongoing monitoring — with NIST 800-171 and CMMC Level 1-2 workflows, plus a multi-tenant architecture that lets MSPs manage isolated client tenants. Differentiated technical components include a Zero Trust SaaS model with client-side AES-256 encryption using user-generated keys that the vendor cannot decrypt, auto-generated formal Microsoft Word documentation (SSP and POA&M), a free NIST 800-171 SPRS scoring tool, and bundled CMMC and NIST 800-171 policy templates.
The business is a tiered annual subscription SaaS: $200/year for CMMC Level 1 (17 practices), $1,800/year for NIST 800-171 ("CMMC Lite," 110 controls), and $3,500/year for CMMC Level 2 + SPRS (110 practices plus full SSP, policy templates, and multi-user MSP features). Billing is annual with automatic renewal, with a 30-day trial offered for PLG-style self-service. Go-to-market combines direct digital self-serve for small contractors, an inside-sales motion (phone + scheduled demos via complyup.as.me) for mid-market/enterprise buyers, and a partner/MSP channel for client engagements. Post-acquisition by Exostar on December 17, 2024, enterprise inquiries route through Exostar's sales team and the platform is positioned within Exostar's CMMC Ready Suite for aerospace & defense and life sciences. Reported employees remain in the 1-10 range and no external funding rounds are disclosed, suggesting a bootstrapped operating profile prior to the exit.
ComplyUp firmographics
Firmographics- Name
- ComplyUp
- Legal name
- Compliance Management Solutions Inc.
- Website
- https://complyup.com
- Company type
- Private
- Founded year
- 2017
- Operating status
- Acquired
- Headcount range
- 1–10 employees
- Short description
- ComplyUp is a SaaS compliance assessment platform that helps Department of Defense contractors and MSPs achieve NIST 800-171 and CMMC certification through guided assessment, SSP/POA&M generation, and SPRS scoring, now part of Exostar's CMMC Ready Suite following a December 2024 acquisition.
- Ownership category
- akta.pro rank
ComplyUp industry classification
Industry- Product category
- Governance, Risk, and Compliance (GRC) Software
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK)
- akta.pro secondary industry
- Compliance Technology, GRC Platforms & Controls Automation Advisory (BPAHAFAO)
Keywords
Where ComplyUp is headquartered
LocationHeadquarters
- HQ city
- Tampa
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
ComplyUp business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- SaaS Subscription - Assessment Platform: ComplyUp charges annual subscription fees for access to their compliance assessment platform. Subscriptions include different feature tiers (NIST 800-171 only, CMMC Level 1, CMMC Level 2 + SPRS). Billing cycles are annual with automatic renewal.
- MSP/Partner Engagements: MSPs can purchase discounted assessments for client engagements, enabling multi-tenant client management with flexible billing.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | CMMC Level 1 Practices |
| Subscription | Annual | CMMC Level 2 + SPRS |
| Subscription | Annual | NIST 800-171 (CMMC Lite) |
Go-to-market motion2 records
Distribution channels3 records
Marketing channels5 records
ComplyUp product offering
Product offeringCore offering
ComplyUp provides a SaaS compliance assessment platform that guides U.S. Department of Defense contractors and Managed Service Providers (MSPs) through NIST 800-171 and CMMC certification workflows. The platform performs gap analyses, auto-generates System Security Plans and POA&Ms as Word documents, calculates SPRS scores for DoD submission, and supports multi-tenant client management for service providers. It is sold as tiered annual subscriptions with a freemium SPRS scoring tool.
Product overview
ComplyUp offers a unified Compliance Assessment Platform that helps DoD contractors and Managed Service Providers (MSPs) achieve and maintain compliance with NIST 800-171 and CMMC (Cybersecurity Maturity Model Certification). The platform is sold as tiered subscriptions: a free NIST 800-171 Scoring Tool, a $1,800/year NIST 800-171 Assessment subscription, a $200/year CMMC Level 1 subscription, and a $3,500/year CMMC Level 2 + SPRS subscription. All paid tiers include the Assessment Platform core, auto-generated documentation, evidence storage, and POA&Ms. The Level 2+ tiers add 14 CMMC/NIST policy templates, multi-tenant design for MSP use, and a Zero Trust encryption model where user data is encrypted client-side. In December 2024, ComplyUp was acquired by Exostar to integrate into Exostar's CMMC Ready Suite for aerospace and defense customers.
Differentiator
Problem solved
Functional benefit
Products and services
- ComplyUp Assessment Platform
Quantifiable outcome
- Automates generation of System Security Plan and POA&M documentation that would otherwise require extensive manual effort
- +1 more outcomes
Companies that use ComplyUp
Customer profileSegments4 records
Ideal customer profiles4 records
ComplyUp technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature8 records
ComplyUp partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- ExostarflagshipExostar announced the acquisition of ComplyUp alongside Robot Morning on December 17, 2024. The acquisition enhances Exostar's supply chain and GRC (Governance, Risk, and Compliance) management capabilities for regulated industries including aerospace and defense and life sciences. ComplyUp now operates as part of the Exostar family, with its platform strengthening ComplyUp's ability to help customers meet evolving compliance requirements like CMMC as part of Exostar's CMMC Ready Suite.
Scale indicators2 records
Recent moves5 records
Expansion highlights5 records
ComplyUp competitors and assessment
Company assessmentOthers
- Exostar: Exostar is ComplyUp's parent company and a secure business collaboration platform for aerospace & defense; it is the most directly comparable regulated-industry compliance ecosystem that ComplyUp is now embedded within.
Broad incumbents
- Drata: Drata is an automated GRC and compliance monitoring platform with broad framework coverage and a large customer base, providing an indirect competitive benchmark for compliance SaaS scale.
- Vanta: Vanta is a leading automated compliance platform covering SOC 2, ISO 27001, HIPAA, and FedRAMP; while not CMMC-native, it represents the broader GRC automation category ComplyUp operates in and could expand into the DIB.
- Archer (Regnology/RSA): RSA Archer/Regnology Archer is an established enterprise GRC platform used by large defense primes and federal agencies, representing the incumbents ComplyUp must differentiate against in larger accounts.
Emerging players
- Tugboat Logic (OneTrust): Tugboat Logic, now part of OneTrust, offers a SaaS GRC platform for security audits and compliance; it overlaps with ComplyUp in automated evidence collection and policy generation workflows.
- RegScale: RegScale is a compliance automation platform that covers CMMC alongside FedRAMP, NIST, and ISO, offering a broader GRC footprint that competes with ComplyUp for compliance-led buyers.
- Netwrix: Netwrix provides data security and compliance solutions for frameworks including NIST and CMMC, overlapping with ComplyUp's defense contractor audience and assessment-driven use cases.
Direct peers
- Pivot Point Security: Pivot Point Security is a C3PAO and CMMC advisory firm that helps DoD contractors prepare for assessments, often recommending assessment platforms and competing for the same MSP/RPO budget.
- PreVeil: PreVeil offers encrypted email and file sharing built specifically for CMMC and NIST 800-171 compliance, competing for the same DoD contractor wallet and frequently bundled with assessment tooling.
- CyberSheath Services International: CyberSheath is a managed security and CMMC compliance services provider to the defense industrial base, overlapping with ComplyUp's MSP/RPO customer segment and CMMC assessment workflows.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks5 records
Key highlights6 records
Customer concentration
ComplyUp social profiles
Digital presenceComplyUp compliance and trust
Trust signalCompliance3 records
ComplyUp financial estimates
Financial estimateRevenue estimate
Valuation estimate
ComplyUp leadership team
Management profileNumber of profiles
Profiles1 record
ComplyUp funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
ComplyUp M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about ComplyUp
What does ComplyUp do?
ComplyUp provides a SaaS compliance assessment platform that guides U.S. Department of Defense contractors and Managed Service Providers (MSPs) through NIST 800-171 and CMMC certification workflows. The platform performs gap analyses, auto-generates System Security Plans and POA&Ms as Word documents, calculates SPRS scores for DoD submission, and supports multi-tenant client management for service providers. It is sold as tiered annual subscriptions with a freemium SPRS scoring tool.
Is ComplyUp a public or private company?
ComplyUp is a private company. It is classified as corporate owned and is currently acquired.
When was ComplyUp founded?
ComplyUp was founded in 2017. It employs 1 to 10 people.
Where is ComplyUp based?
ComplyUp is headquartered in Tampa, United States, in the North America region.
How does ComplyUp make money?
Two revenue lines are on record. SaaS Subscription - Assessment Platform is the primary driver. The others are MSP/Partner Engagements.
Who are ComplyUp's main competitors?
Exostar is listed as an others. Broad incumbents are Drata, Vanta and Archer (Regnology/RSA). Emerging players are Tugboat Logic (OneTrust), RegScale and Netwrix. Direct peers are Pivot Point Security, PreVeil and CyberSheath Services International.
Does ComplyUp have an API?
No public API is recorded for ComplyUp.
What industry is ComplyUp in?
ComplyUp's product category is Governance, Risk, and Compliance (GRC) Software. Its primary akta.pro industry code is HDAEALAK, IT Governance, Risk & Compliance (IT GRC) Platforms, with a secondary code of BPAHAFAO, Compliance Technology, GRC Platforms & Controls Automation Advisory. Its SIC code is 7372.