Level 2 evidence your team can explain.
Hyphen saves identity, access, offboarding, and device evidence from the systems you run. Your team finds gaps, assigns owners, and answers questions with the references.
Hyphen does not certify your organization.
Identity · Access · Offboarding · Devices
hyphen
Powered by Redapt.
See your evidence in saved reports.
Request a demo. Bring questions about scope and evidence. Do not send CUI, credentials, contracts, or assessment artifacts.
Start from saved evidence.
See administrative access, offboarding gaps, and device records in saved reports. Compare findings between runs.
Know who has access
Connect directory identities with observed accounts and permissions. Find account ownership that needs a closer look.
Make privileged access accountable
See who holds administrative access and what that access covers, with evidence your team can review.
Catch access left behind
Highlight accounts and assignments that inactive directory identities still hold, so your team can investigate offboarding gaps.
Bring device inventory into focus
Reconcile Intune inventory with Entra registrations. Identify stale check-ins, absent records, and reported security concerns.
Keep evidence current
Run reports again when you need new evidence. Compare findings between saved runs and inspect coverage gaps.
Keep access accountable
Route access reviews to the right owners. Record decisions and exceptions. Connect approved removals to follow-up evidence.
Ask Agent
Ask questions about saved evidence and follow the references behind each answer.
Three questions your team can answer
Who has administrative access, and does each person still need it?
A saved privileged access review lists each owner, the linked directory identity, the access scope, and the evidence references.
Did any account survive an offboarding?
Hyphen highlights accounts and assignments that inactive directory identities still hold, so your team can investigate and record a decision.
Which devices does the inventory not explain?
Hyphen reconciles Intune inventory with Entra registrations and shows stale check-ins and absent records.
A saved access review
This example uses the synthetic data from the Hyphen chat demo. Acme Aerospace is not a real company. The demo shows a saved report named “Privileged access review 09/23/2026 1:14 PM.”
- A user asks who has admin access to the GitHub organization. Agent answers from the saved report. It lists three organization owners for Acme Aerospace: Maya Patel (active), Trent Anderson (active), and Alex Morgan (inactive). Alex's Owner assignment is still present, but the linked Entra identity is inactive. The snapshot does not verify current sign-in access.
- The user asks for a PDF of the access review. Agent builds the review from the September 23, 1:14 PM snapshot. The review lists identities, email addresses, roles, and access scope. It also lists references to the saved GitHub and Entra evidence. Alex's retained access remains an open finding. The export supports review of AC.L2-3.1.1 and AC.L2-3.1.5. The assessor still needs to evaluate the evidence. The export is not a compliance determination.
- The user asks Agent to add business justification and reviewer decision columns, remove email addresses, and regenerate the PDF. Agent adds the recorded justifications for Maya and Trent. Alex's justification is “Not recorded.” Each reviewer decision is “Pending review.” Email addresses are removed. The source timestamp, the evidence references, and the open finding do not change.
What Hyphen covers, and what stays with you
Hyphen covers
- Evidence collection from connected systems, in report runs that your administrators start.
- Saved reports that keep the findings, the references, and the collection context.
- Access reviews with owners, decisions, exceptions, and follow-up evidence.
- Answers from Agent about saved evidence, with references.
You and your assessor keep
- The assessment scope, the policies, and the System Security Plan.
- The decision on each finding and each remediation.
- Validation that each control is implemented.
- The decision on whether the evidence is sufficient for each requirement.
Coverage depends on your connected systems, the collection results, and your assessment scope. The control references are alignment references. They do not mean that Hyphen satisfies a requirement.
Current CMMC status
Read Getting Started with CMMC and the CMMC First-Steps Checklist. See Hyphen CMMC capabilities and control alignment.
Frequently asked questions
Does Hyphen certify my organization for CMMC?
No. Hyphen organizes evidence from the systems you connect. It does not certify your organization and does not replace an assessment.
Which Level 2 path does Hyphen support?
Hyphen collects and organizes evidence. The evidence can support a Level 2 self-assessment or a C3PAO assessment. Your solicitation names the path. During the current suspension, a new solicitation may name only Level 2 (Self).
Does Hyphen fix findings for us?
You control remediation. Hyphen connects findings to owners and recorded decisions. Your team makes each change and checks the next saved report.
Can we use Hyphen reports in an assessment?
Reports can support your assessment conversations. Your organization and your assessor decide whether the evidence is sufficient for each requirement.
Which systems can Hyphen connect?
Current report sources are Microsoft Azure and Microsoft Office 365 (Microsoft Entra ID identities, access, and Intune devices), Okta, Google Workspace, GitHub, and Mosyle Business. Available data depends on each source's scope and permissions.
We are new to CMMC. Where do we start?
Start with the guide and the checklist linked on this page.
Who powers this offer?
Powered by Redapt. Hyphen supplies the platform. Neither company certifies your organization.