Proof

We publish our own numbers first.

MacTech is a defense contractor that handles CUI. We run the same vault, monitoring and control plane we sell, and the figures below are that system's, with the date each was measured. No customer is named here until they agree to be.

Our CUI enclave, measured

  • 75 → 89
    SPRS, measured

    On evidence that flows weekly. 2026-08-18 → 2026-08-19.

  • 1,869
    Findings remediated

    Each with a recorded root cause. As of 2026-08-19.

  • 110 / 320
    Controls / objectives mapped

    Every objective bound to a named evidence source.

  • 84
    Controls machine-evidenced

    26 governance-only. From the evidence-library map.

  • 97
    Hardening checks per run

    Windows Server 2025 canonical validator.

  • Weekly
    Signed ISSO review

    Hash-chained; one-click send to Trust Codex since 2026-08-19.

Sources: Trust Codex objective-coverage export; EnclaveWatch evidence-library map (config/evidence-library-map.json); the weekly ISSO review chain. The 75 → 89 movement is the result of fixing measurement, not posture: the earlier 91 had been computed against checks that had not run. We would rather publish the lower honest number.

Problem, action, measurable result

The shape every MacTech case study takes. These three are ours.

Problem

A CMMC score of 91 that was computed against checks that had not run since May. Four Windows collectors were compile-time stubs; a 30-second ingest timeout had failed every OS evidence upload ever.

MacTech action

Rebuilt the evidence pipeline end to end: collectors made real, ingest timeout fixed, heartbeat restored, six checks re-pointed at what they claimed to measure. Re-scored on evidence that actually arrived.

Measurable result

SPRS fell to 75 (the first honest number in months), then rose to 89 within 36 hours as the weekly review, USB and media-protection controls closed on real evidence. 11 controls remained open, each with a named blocker.

MacTech CUI enclave · Aug 2026 · own system

Problem

A live Cloudflare tunnel service on the vault host, installed in May, providing an inbound path around Front Door, Bastion and the network security groups.

MacTech action

Detected by the new-service correlation rule during the pipeline rebuild, dispositioned as unauthorised, removed, and the host firewall trimmed from 103 to 26 inbound-allow rules.

Measurable result

Boundary restored to the documented design; the 237 unattributable May-June firewall changes were recorded as remediated with the collector limitation stated rather than hidden.

MacTech CUI enclave · Aug 2026 · own system

Problem

Compliance evidence that existed but could not be found: 46 catalogued checks read as "never observed" because three generations of check identifiers had drifted apart.

MacTech action

Built an identifier alias layer and an objective-evidence specification binding all 320 assessment objectives to 987 named sources.

Measurable result

Objectives with substantiating evidence rose from 12 to 237 of 320 with no new collection - the evidence had been there all along.

Trust Codex · Aug 2026 · own system

What is not on this page

Customer counts, logos and testimonials. Firms in this market advertise hundreds of customers and hundreds of assessments; some of those numbers are real. Ours will appear here when a customer agrees to be named, in the same problem-action-result shape, with the same dated figures. Until then, the credentials we hold and the ones we are pursuing are on the trust page, and what the managed vault carries for a customer is on the responsibility matrix.

Get your own number, freeHow the evidence is collected