Does ControlPoint GRC store our CUI?
No. ControlPoint is deployed in your own Azure subscription. Your CUI data is stored in your PostgreSQL database, on your infrastructure, in your tenant. Our servers never see, process, or store your CUI. We provide the application container and license validation only.
What does "customer-deployed" mean in practice?
You run a one-click ARM template that provisions an Azure App Service, PostgreSQL database, and Key Vault in your Azure subscription. The ControlPoint application runs as a Docker container on your App Service. You control network rules, access, backup policies, and data residency. We push application updates to our container registry — your App Service pulls them on restart.
How does the M365 integration work?
ControlPoint connects to your Microsoft Intune and Microsoft Defender environments via read-only API access (Azure AD app registration). Intune provides device and software inventory. Defender provides vulnerability scan results. Each vulnerability is automatically cross-referenced against the CISA Known Exploited Vulnerabilities (KEV) catalog. Findings are mapped to affected NIST 800-171 controls and pushed to your Operational POA&M.
What happens to our data if we cancel?
Everything stays in your Azure subscription. The application container stops running, but your PostgreSQL database, uploaded evidence files, and all compliance data remain in your tenant. You own the infrastructure. There is nothing to "export" — it is already yours.
How are secrets and credentials managed?
All application secrets (database credentials, JWT signing keys, license keys) are stored in Azure Key Vault. The application authenticates to Key Vault using Azure Managed Identity — no stored credentials anywhere. Database connections use SSL enforcement. Every user action is logged to a comprehensive audit trail.
Can assessors access the platform directly?
Yes. The Assessor Portal provides read-only access that C3PAO assessors can use directly. They see live compliance status, control evidence, SPRS scores, and POA&M status without requiring screenshots or exported documents. Assessor accounts are provisioned by your admin with the Assessor role.
Does this replace a C3PAO assessment?
No. ControlPoint prepares you for your C3PAO assessment by organizing your documentation, tracking your controls, calculating your SPRS score, and providing assessor access to your live compliance data. You still need a certified C3PAO to perform the official assessment. ControlPoint makes that assessment go smoother and faster.
How does multi-business-unit support work?
Enterprise tier supports up to 10 business units under a single deployment. Each BU maintains its own SSP, assessment, POA&M, and evidence — fully isolated. The corporate dashboard provides a unified view with roll-up SPRS scores and control status across all BUs. Users are assigned to specific BUs with appropriate role permissions.
Which Azure environment does this require?
ControlPoint runs on any Azure environment — commercial, GCC, or GCC High. The application manages your compliance documentation and connects to your M365 environment via read-only APIs for device inventory and vulnerability data. Deploy it wherever your organization's Azure policies require.
What does deployment cost on Azure?
Typical Azure infrastructure costs are approximately $40/month for a B1 App Service plan and a Basic-tier PostgreSQL database. This is your cost to Microsoft, separate from the ControlPoint license fee. The ARM template provisions the minimum required resources by default. Costs scale with your chosen Azure SKU.
How long does deployment take?
The ARM template deploys in under 20 minutes. You provide your license key, organization name, database password, and click deploy. The template provisions all Azure resources, creates the database, and starts the application. First login creates your admin account automatically.
Is annual billing required?
No. All plans are available month-to-month with no long-term commitment. Annual billing is optional and saves approximately one month (8% discount). We also accept government purchase orders for annual subscriptions.
