Sagentix Cyber & AI
Level 1, by hand
and with the platform.
If your safeguards already run, CPCSC Level 1 takes about 65.4 hours of your staff’s time by hand and 17.4 in Sagentix Cyber & AI. If you are starting from nothing, it is 95.1 against 31.8. CMMC Level 1: 66.3 against 17.6, or 107.3 against 38.5 from nothing.
Both are estimates from our own effort model, recomputed from the platform’s live catalogue on October 22, 2026. They are not government figures. Below is every minute the model counts, the one government figure that exists, and why it measures something smaller.
The numbers
Staff hours to reach a self-assessed Level 1, for a small organization doing it for the first time. A company part-way sits between the two columns.
CPCSC Level 1
−73.4%
fewer staff hours with the platform, for a mature company
| Staff hours | Mature company | New company |
|---|---|---|
| By hand (Sagentix model) | 65.4 h | 95.1 h |
| With Sagentix Cyber & AI | 17.4 h | 31.8 h |
| Hours saved | 48 h | 63.3 h |
| Fewer hours | 73.4% | 66.5% |
Mature company
- Assessment statements
- 97
- Statements with evidence collected automatically
- 32%
- Statements the platform helps with
- 88.7%
- Statements only people can do
- 11.3%
An annual self-assessment against 13 controls (Public Services and Procurement Canada, 2026). The model counts 21 NIST controls behind them and 6 policies. Source: Sagentix effort model (sagentix-effort-2), computed October 22, 2026.
CMMC Level 1
−73.4%
fewer staff hours with the platform, for a mature company
| Staff hours | Mature company | New company |
|---|---|---|
| By hand (Sagentix model) | 66.3 h | 107.3 h |
| With Sagentix Cyber & AI | 17.6 h | 38.5 h |
| Hours saved | 48.7 h | 68.8 h |
| Fewer hours | 73.4% | 64.1% |
Mature company
- Assessment statements
- 95
- Statements with evidence collected automatically
- 30.5%
- Statements the platform helps with
- 88.4%
- Statements only people can do
- 11.6%
The 15 FAR 52.204-21 safeguards, which the DoD’s rule splits into 17 NIST SP 800-171 Rev. 2 requirements (U.S. Department of Defense, 2024). The model counts 19 NIST controls behind them and 6 policies. Source: Sagentix effort model (sagentix-effort-2), computed October 22, 2026.
The platform suggests a status for each requirement from the evidence; your people set every status, and the result is a self-assessment. Hours with the platform include 75 minutes of setup. A mature company has its safeguards running and only has to show them; the US Department of Defense prices its own Level 1 figure on that assumption. A new company puts every requirement in place first, costed from the provider steps the platform gives for its stack (100 steps for CPCSC Level 1 on Microsoft 365).
Your stack changes the answer
The platform reads more settings on some stacks than others. We publish the slower one.
| With the platform | CPCSC Level 1 | CMMC Level 1 |
|---|---|---|
| Microsoft 365 with Intune | 17.2 h 36.1% automatic new company 31.8 h | 17.4 h 34.7% automatic new company 38.5 h |
| Google Workspace with Mac computers | 17.4 h 32% automatic new company 30.9 h | 17.6 h 30.5% automatic new company 36.7 h |
How a number is made
The unit of work is the assessment statement, counted once per control however many requirements share it.
For each NIST control a level touches, we take the determination statements its SP 800-53A Rev. 5 assessment procedure lists (National Institute of Standards and Technology, 2022), and sort each into one of three kinds: an observation (a setting someone can see), a record (a log or register kept over time) or an attestation (a written account of how you do it). That sorting is ours. Each kind gets a time by hand and a time with the platform:
| Activity | By hand | With the platform |
|---|---|---|
| Observation statement By hand: find the setting, take a dated screenshot or export, file it against the statement. Automated: a collector check reads the setting every day; a person reads the result. | 20 min | 2 min when a collector check reads it |
| Records statement By hand: design the record, fill its rows, file it. With a template: the record comes as a CSV with the columns an assessor asks for; a person fills the blanks and uploads it, and the app checks it at once. Pre-filled (device inventory and account review, where the stack's tools report each device or account): the rows are already there; a person completes the cells marked [fill in]. | 30 min | 11 min with a record template |
| Attestation statement By hand: write the statement of how the organization does it. Assisted: the copilot asks three to five plain questions and drafts the statement from the answers; a person edits and accepts it. | 15 min | 5 min |
| Policy, per control family Per policy family the level touches. By hand: write a policy from NIST SP 800-53 and a template, fill every value, format it. Built: the policy builder drafts it complete and branded from the company profile; a person reviews the values it chose and approves it (30 minutes, as the command centre's own estimate in src/routes/command.ts). | 240 min | 30 min |
| Implementation statement, per requirement Per requirement: the implementation statement an assessor reads. Assisted: drafted by the copilot from the evidence and the person's answers, which come pre-filled from the Procedures screen; the person edits and accepts. | 20 min | 4 min |
| Status decision, per requirement Per requirement: decide the status from the evidence and record it. By hand: read the evidence, decide, write it down. With the platform: every requirement's suggestion and its reasons on one list; a person reads each row and accepts the ticked ones in one press. | 3 min | 0.5 min |
| New company only: put a requirement in place New company only: put each requirement in place before evidencing it, counted from the provider steps the app gives for the stack (src/data/requirement_steps.json; the steps with no software platform when the stack has none). By hand: find the setting in the provider's documentation (45 minutes), 10 minutes a step, 15 minutes to test it. With the platform: 8 minutes a step, since the exact menu and value are given, and 2 minutes to confirm when a collector check reads the setting (15 when a person must test it). Each person's own enrolment (a phone for MFA, a laptop for encryption) is not counted. | 45 min, then 10 a step, then 15 to test | 8 min a step, then 2 to confirm (15 without a check) |
| Setup, once Once, with the platform only: confirm the company profile (10 minutes) and connect the identity, device and website sources the stack needs (about 15 minutes each, as src/routes/command.ts estimates a source). | none | 75 min |
38
Observations
CPCSC Level 1 statements a collector check can read
36
Records
of which 32 have a record template today
23
Attestations
drafted from a short interview, edited by a person
What Lean Six Sigma changed
We mapped every step a person takes to a self-assessed CPCSC Level 1, removed the waste we found, and recomputed.
Six changes shipped on 20 October 2026. Together they take CPCSC Level 1 for a mature company from 19.5 to 17.4 staff hours on the platform, and CMMC Level 1 from 19.9 to 17.6. The by-hand side does not move: only work the platform removed counts.
| Waste | What changed | Effect |
|---|---|---|
| Motion | Every suggested status on one list, accepted in one press (src/routes/suggestions.ts). Before: each of 13 requirements opened through two nested panels to read one suggestion and press one button. | Status decision with the platform: 2 → 0.5 minutes per requirement. |
| Motion | A saved row stays open (public/app/frameworks.js). Before: every save re-drew the table and closed the row being worked on. | Part of K1's and K4's minutes. |
| Re-entry (extra processing) | Device inventory and account review start with the devices and accounts the collector reported (src/guides/record-prefill.ts). Before: blank sheets. | Those records: 12 → 8 minutes per statement, on stacks whose tools report them. |
| Re-entry (extra processing) | The statement interview starts from the Procedures screen's answers; tailoring a policy and the policy form read the company profile (src/ai/copilot/statements.ts, src/routes/evidence.ts). Before: the same facts typed two or three times. | Implementation statement with the platform: 5 → 4 minutes per requirement. |
| Defects (hidden rework) | An uploaded record's check result (rows filled, missing columns, cells still to fill) shows at upload (public/app/frameworks.js). Before: found only on re-opening the requirement, then fixed and uploaded again. | Records with a template: 12 → 11 minutes per statement. |
| Not a waste: DMAIC's Measure step | The platform measures lead times from its own records for Sagentix's own organization (src/effort/measured.ts), so measured times can replace these assumptions. | No minute changes; the measured lead times are published beside the model. |
The one government figure, and what it leaves out
It prices the assessment. Our by-hand figure also counts the work being assessed.
The US Department of Defense prices a small entity’s CMMC Level 1 self-assessment and affirmation at US$5,977 a year (U.S. Department of Defense, 2024, p. 83181). Its line items add up to 28.16 hours: 14 for a director, 12 for an outside service provider and 2.16 for an IT specialist (our sum).
It counts no work to put the safeguards in place, because “it is assumed the contractor or subcontractor has implemented the applicable security requirements” (U.S. Department of Defense, 2024, p. 83181). Our model counts that work: the policies, the records and the evidence for every statement. So the two numbers answer different questions, and we never show the DoD’s as the by-hand side.
For a company starting from nothing, the nearest public figure is a proposed US rule. It puts the labour of implementing NIST SP 800-171 Rev. 2 at an average of 1,560 hours in a small business’s first year (U.S. Department of Defense et al., 2025, p. 4284). That covers far more than Level 1, and it was never made final: the Federal Register held no final rule on 20 October 2026.
For CPCSC Level 1 we found no Government of Canada estimate of supplier effort when we searched on 20 October 2026. If one is published, it goes here.
What would change these numbers
The minutes are ours. No client has been timed yet. The first timed run is Sagentix’s own CPCSC Level 1 self-assessment, now under way on the platform; when it ends, its audit trail replaces these guesses with measured times, and this page will say so.
A statement with a collector check counts as automated even when the check covers it only in part; a person still reads the result. The attestation and policy times assume AI drafting is switched on. With it off, those statements count at the by-hand rate.
Measured, not modelled, next. The platform now times the work it records on Sagentix’s own organization: lead time from first to last event, waiting included, so it bounds the model from above. No activity has the 5 observations a published median needs yet (0 so far).
The platform figure falls as automation ships. The feed is recomputed every day from the catalogue (frameworks built 2026-10-18; 2049 collector checks; 9 record templates; 98 requirements with provider steps), and each night a dated row is kept whenever a level’s numbers move.
How the numbers have moved
- October 21, 2026, CPCSC Level 1: 17.4 h with the platform against 65.4 h by hand (−73.4%)
- October 21, 2026, CMMC Level 1: 17.6 h with the platform against 66.3 h by hand (−73.4%)
Want the hours for your own stack?
We look at which sources you run and tell you what the platform can read from them today.
References
- U.S. Department of Defense, General Services Administration, & National Aeronautics and Space Administration. (2025, January 15). Federal Acquisition Regulation: Controlled unclassified information (Proposed rule). Federal Register, 90, 4278–4317. https://www.federalregister.gov/documents/2025/01/15/2024-30437/federal-acquisition-regulation-controlled-unclassified-information
- National Institute of Standards and Technology. (2022). Assessing security and privacy controls in information systems and organizations (NIST Special Publication 800-53A, Rev. 5). https://doi.org/10.6028/NIST.SP.800-53Ar5
- Public Services and Procurement Canada. (2026, September 29). Program overview: Canadian Program for Cyber Security Certification. Government of Canada. https://www.canada.ca/en/public-services-procurement/services/industrial-security/security-requirements-contracting/cyber-security-certification-defence-suppliers-canada/program-overview.html
- U.S. Department of Defense. (2024, October 15). Cybersecurity Maturity Model Certification (CMMC) program (Final rule). Federal Register, 89, 83092–83237. https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program