For Tier 2 & Tier 3 defense subcontractors · ITAR · CUI · CMMC

Defense compliance,
with receipts.

AI that turns scattered shop drives into evidence for all 110 NIST SP 800-171 requirements.

dominiq · workspace / evidence-prep

Illustrative example · sample data

Our prime just flowed DFARS 252.204-7012 down on PO 4471. Find every drawing with ITAR markings, tell me who opened them in the last 90 days, and draft evidence for 3.1.1 and 3.1.3.

@Classifier
Read 2,847 files across SharePoint and the shop file server. 38 carry ITAR export legends, 214 hold CUI, 19 sent to human review.
done
@AccessTrace
Pulled 90 days of access logs on the 38 files. 3 were emailed to a personal Gmail account — flagged against 3.1.3.
1 finding
@ControlMapper
3.1.1 (limit access to authorized users) is met. 3.1.3 (control the flow of CUI) is not met until the mail path is closed — POA&M-eligible.
done
@EvidenceWriter
Drafted SSP text for both requirements, one POA&M item with a 180-day closeout date, and a summary for your affirming official.
done

Evidence pack ready — 2 requirements documented, 1 finding awaiting human sign-off · 41 s

The problem

A forty-person machine shop answers to the same 110 security requirements as its prime² — and too often proves it with a shared drive, a spreadsheet and a signature nobody is fully sure they can stand behind.

Requirements to evidence
110²
NIST SP 800-171 Rev 2 — the CMMC Level 2 baseline. Level 1 covers 15 basic safeguards for FCI.
To report a cyber incident
72 hrs⁵
From discovery, under DFARS 252.204-7012 — which also requires NIST SP 800-171 and flows down to subcontracts.
One FCA settlement, Sep 2026
$2.04M⁶
Honeywell Aerospace, over alleged NIST SP 800-171 gaps on one of its networks.
ITAR civil penalty
$1.27M+⁷
Per violation, or twice the transaction value if greater — 2025 inflation adjustment to 22 CFR 127.10.

Status · 3 Nov 2026CMMC Phase 2 third-party certification has been suspended since 13 July 2026, with restart options under review. Phase 1 self-assessments and annual SPRS affirmations remain in force, as they have since 10 November 2025.^1,3,4,9

How it works

From scattered drives to a score you can sign.

Preparation can’t wait in a consultant’s queue: in March 2026 there were 103 authorized assessment organizations, and at least 80,000 companies are expected to need Level 2 certification.⁸ Dominiq connects to where your files already live and turns what it finds into evidence an assessor can follow.

Explore capabilities

Sourcesread-only

SharePoint · GCC Highconnected

\\FS01\Engineeringscanning 62%

Outlook · 14 mailboxesconnected

PDM vault exportqueued

Files indexed2,847

Copied out of tenant0

Illustrative

01 · Connect

Connect where the files already live

Read-only connectors for SharePoint, OneDrive, shop file servers and mailboxes. Nothing is moved, so your CUI boundary stays exactly where your assessor expects it.

Classifier loglive

10:42:07 DWG-4471-B_revC.pdf

→ ITAR legend + Dist. Statement D

10:42:08 Quote_FY27_bracket.xlsx

→ CUI? conf 0.71 → human review

10:42:09 egress · 3 files → personal Gmail FLAG

ITAR38

CUI214

REVIEW19

Illustrative

02 · Classify & trace

Classify every file, then follow it

Export legends, distribution statements, title blocks and CUI banners are read in context. Low-confidence calls go to a human review queue — never straight into your SSP.

800-171 · by familySPRS est. 74

POA&M items9

Not POA&M-eligible, open2

Illustrative

03 · Map & assemble

Map evidence to all 110 requirements

Every requirement links to the file, log or policy that proves it, scored with the DoD Assessment Methodology — so the number you affirm in SPRS comes with receipts.

Capabilities

Built for the person who signs the affirmation.

Most small defense manufacturers — machine shops, electronics builders, specialty suppliers — don’t have a compliance department. They have an operations manager or office lead who also owns the SPRS score. Dominiq gives that person three tools.

Book a Demo

Document copilotin tenant

You

Who outside engineering can open DWG-4471-B?

4 people. One is a non-U.S. person contractor — releasing ITAR technical data to them is an export unless you hold an authorization.

Draft access changeNotify export officer

Illustrative

Document control

Document control that knows export rules

Ask about any file, folder or person in plain English. Dominiq answers with who can open it, how it’s marked and what that access means under ITAR — then drafts the fix for a human to approve.

Flow-down ledger1 at risk

Supplier	SPRS	7012	Status
Anodizer A · T3	102	✓	ok
Fasteners B · T3	—	✗	risk
Heat-treat C · T3	61	✓	watch
PCB house D · T3	110	✓	ok

Illustrative · fictional suppliers

Supplier vetting

Supplier vetting down the tiers

Send flow-down questionnaires, collect SPRS scores and affirmations, and see which sub-tier vendor touches your CUI without DFARS 252.204-7012 in its paperwork.

Incident · possible CUI exposureopen

71:46:12

Left to report · DFARS 252.204-7012

✓Contain — forwarding rule removed
○Preserve images ≥ 90 days
○Medium assurance certificate
○Report via DIBNet

Illustrative

Monitoring

A clock for the 72-hour moments

When CUI leaves its boundary, Dominiq starts the DFARS 252.204-7012 reporting clock and lays out the steps: contain, preserve images for at least 90 days, and report through DIBNet.

Founder

Built by someone who has done the paperwork by hand.

Shriman Maheshwari grew up inside his family’s B2B electrical distribution business and took on its operational side at 17 — working through documents, cleaning data and building spreadsheet cases for decisions, by hand. The ceiling on that manual work is what pulled him toward AI systems.

He studies Computer Science at BITS Pilani, Goa, on a dual-degree track with CentraleSupélec (Université Paris-Saclay), specializing in AI. Dominiq is his bet that the smallest suppliers in the defense chain deserve evidence tooling as good as the primes they build for.

“A supplier shouldn’t lose a program because the proof was scattered across three drives and someone’s inbox.”
Shriman Maheshwari, Founder & CEO

Connect on LinkedIn team@dominiq.site

FAQ

Questions suppliers ask first.

Short answers, using only what’s on this page. Anything else — team@dominiq.site.

What is Dominiq?

Dominiq is AI compliance software for Tier 2 and Tier 3 defense subcontractors. It classifies ITAR and CUI files, maps evidence to the 110 NIST SP 800-171 requirements, and vets suppliers against the clauses you flow down to them.

Who is Dominiq built for?

The operations manager or office lead at a small defense manufacturer — a machine shop, electronics builder or specialty supplier — who owns the SPRS score without a dedicated compliance department.

CMMC Phase 2 is paused. Do we still need this?

Only Phase 2 third-party certification was suspended, on 13 July 2026. Phase 1 self-assessments and annual SPRS affirmations remain in force, and DFARS 252.204-7012 still requires NIST SP 800-171 and 72-hour incident reporting.

How does Dominiq handle ITAR technical data?

Dominiq is designed to run inside your own Microsoft 365 GCC High or Azure Government tenant through read-only connectors, so files are not copied out and the Dominiq team does not need access to them.

What does Dominiq produce for an assessment?

An SPRS estimate scored line by line and tied to evidence, a System Security Plan and POA&M with every open item tracked against the 180-day closeout window, an inventory of every ITAR and CUI file, and a flow-down ledger of your suppliers.

What happens when Dominiq spots a possible CUI incident?

It starts the DFARS 252.204-7012 reporting clock and lays out the steps: contain, preserve images for at least 90 days, and report through DIBNet.

Is Dominiq a C3PAO or legal counsel?

No. Dominiq is software that organizes compliance evidence; it does not issue CMMC certifications and it is not legal or export-control advice.

Is Dominiq available today?

Dominiq is pre-launch. Demos and early access are by email at team@dominiq.site.

Defense compliance,with receipts.

A forty-person machine shop answers to the same 110 security requirements as its prime2 — and too often proves it with a shared drive, a spreadsheet and a signature nobody is fully sure they can stand behind.

From scattered drives to a score you can sign.

Connect where the files already live

Classify every file, then follow it

Map evidence to all 110 requirements

Built for the person who signs the affirmation.

Document control that knows export rules

Supplier vetting down the tiers

A clock for the 72-hour moments

Built by someone who has done the paperwork by hand.

Questions suppliers ask first.

Defense compliance,
with receipts.

A forty-person machine shop answers to the same 110 security requirements as its prime² — and too often proves it with a shared drive, a spreadsheet and a signature nobody is fully sure they can stand behind.