VERIFICATION METHODOLOGY
How TeamingIndex Verifies Compliance Credentials
Self-attested facts start the conversation; verified facts survive a compliance review. Each credential on a profile is reviewed on its own, against its authoritative source, and every badge says who vouches for it and when it expires.
THE PROCESS
From self-attested to verified in five steps
Step 1: Claim your profile
Sign in with a work email on your company’s domain. Other addresses go to a quick manual review.
Step 2: Add your credentials
Enter CMMC, SPRS, clearance, export-control and quality details in your dashboard. They appear right away, marked self-attested.
Step 3: Request verification
On Verified Pro or Enterprise Capture, submit each credential for review. Enterprise Capture requests are reviewed first.
Step 4: We check the source
A reviewer confirms the credential against its authoritative source, usually on a short screen-share, and records what was checked, never the documents.
Step 5: Your badge goes live
The badge shows Verified with its review date and expiry, and your dashboard reminds you 60, 30 and 7 days before anything lapses.
BADGE STATES
What each badge state means
Verified
A TeamingIndex reviewer checked the credential at its source. The badge shows the review date and when it lapses.
Visible to everyone
Verification pending
Submitted for review. Until a reviewer finishes, it counts as self-attested in search filters.
Visible to everyone
Self-attested
Entered by the contractor and not independently checked. Never styled as verified.
Visible to everyone
Expired
The credential or our verification lapsed. The badge says when, and when it was last verified.
Visible to everyone
Not verified
Only your team and administrators see this. Everyone else sees the credential as self-attested: we never shame a contractor publicly.
Visible to your team and administrators only
Compact chips
Directory results use short chips: the CMMC level and assessor, and the blind SPRS bracket. The exact score never appears in search.
Examples are illustrations dated relative to today.
PER-CREDENTIAL REVIEW
What we check for each credential
CMMC status
Source: SPRS
- How we check
- We confirm your CMMC status, level and certificate unique ID in SPRS during a short screen-share with your affirming official.
- What we record
- Level, assessment type (self, C3PAO or DIBCAC), C3PAO name, status and expiry dates, and the certificate unique ID (shown only to your team, administrators and NDA counterparties).
- When it lapses
- No later than the status expiry date (3 years for Level 2 and 3; Level 1 self-assessments every year), or the 180-day POA&M closeout date while the status is Conditional.
NIST SP 800-171 SPRS score
Source: SPRS
- How we check
- We confirm the date, confidence level and summary score of your NIST SP 800-171 DoD Assessment in SPRS during a screen-share.
- What we record
- Assessment date and confidence level (public facts) and the score itself, which stays private: search sees only blind brackets.
- When it lapses
- On the date the reviewer sets: 12 months after review by default, never more than 3 years. Separately, DFARS 252.204-7019 requires an assessment no more than 3 years old, and every profile shows whether its assessment is current.
Facility clearance (FCL)
Source: DCSA NISS
- How we check
- Your Facility Security Officer confirms the facility clearance and safeguarding level with us against the DCSA NISS record.
- What we record
- Clearance level, safeguarding level and cognizant DCSA field office. No DD Form 254 is ever collected.
- When it lapses
- On the date the reviewer sets: 12 months after review by default, never more than 3 years.
ITAR / DDTC registration
Source: DDTC registration
- How we check
- We review your DDTC registration letter on a video call.
- What we record
- Registration status and expiry date.
- When it lapses
- No later than the DDTC registration expiry date.
ISO / AS quality certification
Source: Registrar / IAQG OASIS
- How we check
- We look up the certificate number and expiry in the issuing registrar’s database or, for AS9100-series certificates, the IAQG OASIS database.
- What we record
- Each standard held (for example AS9100D or ISO 9001:2015) and its certificate status.
- When it lapses
- On the date the reviewer sets: 12 months after review by default, never more than 3 years.
DCAA-adequate accounting system
Source: DCAA audit report
- How we check
- We review the DCAA audit report number and the adequacy determination letter on a call.
- What we record
- Whether an adequate accounting system determination is on file. The report itself is not retained.
- When it lapses
- On the date the reviewer sets: 12 months after review by default, never more than 3 years.
FedRAMP authorization
Source: FedRAMP Marketplace
- How we check
- We match your FedRAMP Marketplace listing and package ID to your profile.
- What we record
- The designation shown on the Marketplace (for example Ready, In Process or Authorized).
- When it lapses
- On the date the reviewer sets: 12 months after review by default, never more than 3 years.
CMMC 2.0
Final vs. Conditional CMMC status
Final status
All requirements were met at assessment. Level 2 and Level 3 statuses last 3 years (Level 1 self-assessments are renewed every year), and a senior official must affirm compliance every year.
Conditional status
A Level 2 or Level 3 assessment with open POA&M items. They must be closed within 180 days of the status date, or the status lapses. Conditional badges carry a “Cond.” marker and the closeout date, and verification lapses on that date unless Final status is confirmed.
CMMC phase-in under the DFARS rule
Requirements arrive in four phases. Earlier phases stay in effect as later ones begin. Today is November 9, 2026.
- Phase 1Current phase
Level 1 and Level 2 self-assessments required in applicable solicitations.
- Phase 2Upcoming · in 1 day
Level 2 C3PAO certification required where specified.
- Phase 3Upcoming
Level 3 (DIBCAC) certification required where specified.
- Phase 4Upcoming
Full implementation across applicable DoD contracts.
NIST SP 800-171 / SPRS
Blind SPRS brackets and assessment currency
Cumulative brackets
- SPRS ≥ 0
- SPRS ≥ 50
- SPRS ≥ 70
- SPRS ≥ 85
- SPRS ≥ 95
- SPRS ≥ 105
- SPRS = 110 (perfect)
A hypothetical score of 92 is indexed as SPRS ≥ 0, SPRS ≥ 50, SPRS ≥ 70, SPRS ≥ 85. It appears in a search for SPRS ≥ 85 but not for SPRS ≥ 95, and the score itself never leaves the protected compliance table.
Who can see an exact score
- Anyone, if the contractor chooses to make the score public.
- The contractor’s own team.
- Platform administrators, for verification.
- A counterparty after a mutual NDA is recorded between exactly those two organizations (an accepted teaming request, or an NDA-stage pitch on a Teaming Board post).
Wherever an exact score is shown, a note says which of these applies.
Assessment currency (DFARS 252.204-7019)
Before award, an offeror needs a current NIST SP 800-171 DoD Assessment posted in SPRS: not more than 3 years old unless the solicitation sets a shorter period. Profiles show the assessment date, its confidence level and whether it is current. These are public facts and contain no score.
- basic
- Basic Assessment (contractor self-assessment)
- medium
- Medium Assessment (Government document review)
- high
- High Assessment (Government verification and demonstration)
REGISTRATION & EXCLUSIONS
SAM.gov registration and exclusion screening
- SAM active
- SAM expiring
- SAM expired
- Active SAM exclusion (FAR 9.4)
PLANS
Verification and your plan
Requests need a paid plan
Downgrades keep your badges
Edits go back to review
Verification is a point-in-time check
A Verified badge is not a certification, an assessment or an endorsement, and TeamingIndex is not a C3PAO. Before award, confirm registration and exclusions in SAM.gov, CMMC status and SPRS assessment currency (DFARS 252.204-7019, -7020 and -7021), facility clearances through DCSA’s NISS, and certificates in the issuing registry.
Turn compliance investments into teaming invitations
Claim your company’s profile, add your credentials, and request verification so primes filtering for verified partners find you first.