Verified evidence, or the claim earns nothing.
One vendor-risk score you can defend — scored across eight compliance frameworks, backed by AI-checked evidence instead of vendor self-attestation, and a person on your team confirms every CMMC, HIPAA, NERC CIP, PCI DSS and FedRAMP pass.
risk_score = impact × likelihood
A claim on its own earns nothing. Only verified evidence moves the score — here, enough to cross a full risk band.
WHAT IT IS
MajorCompliance turns a vendor's software bill of materials into a single, defensible risk score.
It matches every software component against known vulnerabilities, checks each compliance claim against the evidence a vendor uploads, and writes every result to a tamper-evident log.
Vendors do their own data entry through a secure, time-limited invite link — no account to create on their end. You review one score, and every score traces back to the evidence behind it.
WHO IT'S FOR
Built for the frameworks your customers actually audit.
Eight frameworks run off one registry. Five are sector-gated — they only apply, and only affect scoring, when the vendor is in scope.
CMMC
Near Fort Cavazos or anywhere in the DoD supply chain, CMMC is a hard requirement. A missing or unverified control actively raises a vendor's risk. A self-assessment earns credit only when your contract accepts one and your staff switch it on, and only while it stays current.
Discount or penaltyHIPAA
When a vendor handles PHI, verified HIPAA evidence can move it a full risk band. Business-associate risk, scored on proof rather than a checkbox.
Discount or penaltyFISMA / FedRAMP
Running or supporting a federal system takes an agency ATO or FedRAMP authorization at the baseline its FIPS 199 category requires — a Low authorization doesn't cover a Moderate system.
Discount or penaltySOC 2 · ISO 27001 · NIST CSF
Selling to enterprise buyers? A verified alignment discounts a vendor's risk, while an unverified claim is never scored worse than partial — you're never penalized for honesty.
Discount onlyOne registry drives all eight. Add a rule to one framework and it propagates through scoring, next steps, and review cadence — PCI DSS and FISMA / FedRAMP slotted in without touching any of that logic.
HOW SCORING WORKS
A number you can put in front of an auditor.
impact (1–5) × likelihood (1–5) = risk score (1–25)
Impact comes from a FIPS 199 security categorization — the highest of the confidentiality, integrity and availability ratings. Likelihood adjusts for verified framework status, any vulnerabilities found in the vendor's SBOM, and how deep its network access goes. Every scan writes one append-only row — history is never overwritten.
STAYS CURRENT
Verified evidence expires. You find out before it does.
A SOC 2 report, a HIPAA BAA, a CMMC affirmation — every one has a shelf life. MajorCompliance computes each framework's real review cadence from the day evidence is verified, then warns you as it approaches. At 30 days out, it asks the vendor to re-upload on its own.
Cadences are real, not round numbers — NERC CIP follows CIP-013's actual 15-month periodic-review requirement; the rest track each framework's true annual cycle. Staff can override any date for a contractual reason.
TRUST DOSSIER
Prove your whole risk program in one link.
Enterprise buyers and cyber insurers hit SMB vendors with a 150-question security questionnaire before they'll sign. The Trust Dossier is a one-click, shareable summary of your entire vendor-risk program — proof it's rigorous, ready before the questionnaire even lands.
One link, revocable
Share a link with a 90-day expiry, revoke it the moment you want and it stops resolving — or export to PDF when a buyer wants a file to keep.
Aggregate by design
Portfolio health, eight-framework coverage, and live active-threat posture — never a single vendor named, not even in your own preview.
Verifiable, not decorative
It carries the same evidence-integrity assertion and real hashes that sit behind your scores — a claim a buyer can actually check, not a logo wall.
THE HONEST EDGE
We'll tell you what we haven't built.
Most compliance tools overclaim. We'd rather you hear the limits from us than discover them in an audit. This is the whole reason the product exists.
Tamper-evident, not court-admissible
Every artifact is SHA-256 hashed and chained, so altering a past entry breaks the chain, and once a day an independent timestamp authority (FreeTSA, RFC 3161) signs the chain's latest entry. But there's no backfill of anything uploaded before the log shipped, and FreeTSA isn't a legally qualified timestamp provider — we don't claim it holds up in court.
Live payments aren't switched on yet
Our prices are public, and self-service checkout through Stripe is built and tested — but it isn't taking live payments yet, so onboarding today is hands-on and personal. While we're early, that's a feature, not a bug.
- Mandatory TOTP MFA
- Per-org isolation
- Malware-scanned uploads
- Insert-only audit log
- Hash-chained evidence
- Restart-durable scans
PRICING
Published prices. No sales-call wall.
Most vendor-risk platforms hide pricing behind a demo request and start around $7,500–$15,000 a year. We publish ours — and NIST CSF, SOC 2, and ISO 27001 are in every plan.
Every plan includes NIST CSF, SOC 2, and ISO 27001. The hard-requirement frameworks — CMMC, HIPAA, NERC CIP, PCI DSS, FISMA / FedRAMP — are $79/mo each, or $299/mo for all five, so you only pay for the ones you're actually held to. Self-service billing is on the way; today onboarding is hands-on — book a demo below and we'll get you running.
See it score one of your own vendors.
Fifteen minutes. Bring a real vendor and a framework you're audited on — we'll run it live.
Book a 15-minute demo