SeaPRwire – In June, an Alabama defense contractor called LOGZONE settled with the government after a review put its self-reported security score at minus 170. The company had posted a perfect 110 under NIST SP 800-171, the standard governing how contractors handle controlled unclassified information. In September, Honeywell Aerospace agreed to pay more than $2 million to resolve False Claims Act allegations that it failed to meet the same standard on one of its networks, according to the Justice Department. Neither company admitted liability.
A Maryland consulting firm founded by former NASA Chief Information Officer Linda Cureton is betting that both cases point at the same failure mode. Muse Technologies launched a readiness practice this week for mid-sized defense contractors, built on the argument that companies fail cybersecurity assessments because they cannot prove what they have already done. “I spent my career on one question: can you prove it?” Cureton said in the launch announcement. “Defense contractors are being asked that question now, and most of them have answered it with a number rather than a file. We help them build the file.”
The scoring system behind those numbers works in a specific, unforgiving way. NIST SP 800-171 contains 110 security requirements. Assessors expand them into 320 individual objectives and check each one against documents, interviews and tests, and they score only what a company can show. The self-assessed result gets posted to the Pentagon’s Supplier Performance Risk System (SPRS), and a senior official at the contractor has to sign the annual affirmation behind it. That signature is what gives the paperwork its teeth.
Third-party certification would normally sit on top of this, but not right now. The Defense Department suspended the second phase of its Cybersecurity Maturity Model Certification program in July while it reviews the program. Self-assessments, SPRS scores and the annual affirmation remain in place. For the moment, the government is trusting contractors to grade themselves and checking afterward through False Claims Act enforcement.
The failures Cureton describes are mundane, which is the point. A System Security Plan that still describes systems retired years ago. Controlled files sitting on drives the plan never mentions. A posted score that doesn’t reconcile with the plan. Evidence that exists in practice but can’t be produced on request. “Those aren’t technology failures. They’re records failures,” she said. “Your IT provider runs the controls. We make them provable. Those are two different jobs, and most companies have only paid for the first one.”
Her credentials for that argument come from federal records work rather than security tooling. Muse has spent more than a decade managing records and IT programs for federal agencies, including over a million federal case records handled under National Archives standards. Cureton ran NASA’s IT organization from 2009 to 2013 and founded the firm in the year she left. “Agencies learned long ago that if it isn’t documented, it didn’t happen,” she said. An assessor, in her framing, thinks the same way.
Muse’s offering starts with two free steps. An online SPRS self-check at sprs.muse-technologies.com lets contractors estimate their score in a few minutes. After that comes a free 60-minute SPRS Score Check over screen share, in which the Muse team reviews the contractor’s security plan, posted score and plan of action, names where an assessor is likely to find problems, and identifies the three things to fix first. Written findings arrive within 48 hours.
The paid engagement is a six-week CUI and AI Exposure Review, and it carries most of the weight in the model. Muse maps where controlled information actually lives, assigns each of the 320 assessment objectives a named owner and an evidence source, and produces the file the signing official relies on when the annual affirmation comes due. The client team’s total time commitment is under 10 hours, and Muse guarantees the outcome: every objective comes back with a named owner and evidence source, or the client isn’t invoiced.
The AI piece is the part with the least precedent. The review documents what AI tools such as Microsoft Copilot can reach inside the contractor’s environment. SP 800-171 was written before generative AI put a tool with broad file access on every employee’s desktop, and a controlled document that a security plan never mentions is a different problem once Copilot can index it. How Muse inventories that exposure in practice is not described in the announcement, and that detail will matter more than the framing.
The business model has one notable feature: Muse stays out of the assessment boundary. It doesn’t certify — only an authorized assessor can do that. It sells no software, licenses or managed services, installs nothing and hosts nothing. A firm that hosted the evidence it helps organize would itself appear in the audit trail; Muse’s positioning keeps it outside the scope an assessor examines, and the evidence it builds belongs to the client and can be exported. “We work alongside a company’s IT provider, not instead of them,” Cureton said. “At the end, the provider gets a clearer list, and the person who signs gets something solid to sign against.”
That positioning also defines the ceiling. Muse is selling consultant hours backed by a guarantee, not a product, and the announcement gives no pricing. Whether mid-sized contractors will pay separately for evidence-building — on top of what they already pay IT providers to run the controls — depends on how they weigh a consulting fee against the alternative outcomes now on the record: a settlement north of $2 million, or a perfect score that flips to minus 170.
The number worth watching in the offer is the ten hours. If the client team really commits under ten hours over six weeks, most of the evidence file is Muse’s reconstruction of material the company already has, and whether an assessor treats reconstructed evidence as convincing is a question the announcement doesn’t answer. The guarantee covers ownership and sourcing for every objective. It does not cover what the assessor thinks of the file.