i2ACT: Imprimis Assessment & Compliance Tool
The i2ACT Software Platform, developed by Imprimis, is a comprehensive, on-premise solution designed to support structured cybersecurity assessments based on NIST 800-171, NIST 800-172, and CMMC Levels 1 through 3.- Built for organizations handling Controlled Unclassified Information (CUI), i2ACT enables users to evaluate, document, and manage compliance with federal cybersecurity requirements.
- It can also be used to assess and track cybersecurity program development within the commercial sector usings its customizable assessment baseline capability.
i2ACT History
Originally launched in 2010, and refined and improved over more than a decade, i2ACT continues to prioritize security through its on-premise deployment model. Unlike cloud-based tools, it avoids external vulnerabilities by using a secure split-database architecture within Microsoft Access. This allows data to be shared across multiple users via a local network while keeping assessment logic and user interfaces separate from the data itself.
i2ACT Today
The latest version, i2ACT 4.0 (2025), introduces enhanced functionality for end-to-end assessments. It supports the latest CMMC/NIST revisions and enables seamless switching between NIST and CMMC assessments.
The tool further provides expanded capabilities for identifying and tracking remediation actions, automatic SPRS scoring, POA&M development, extensive reporting of controls and objectives ‘met’ or ‘not met’, evidence and artifact collection and document management.
In addition, the i2ACT tool includes enhanced functionality which allows for multiple remediation tasks per practice to be defined in the assessment process thereby enhancing the detail in the POA&M produced directly from the tool. The tool also allows for multiple evidentiary artifacts for each practice/requirement and, in turn, each evidentiary artifact can be associated with multiple practices/requirements. -- all within a single environment!
i2ACT Tool Advanced Features
i2ACT is more than an assessment tool—it also functions as a document management system, training interface, and reference platform, offering a comprehensive and scalable solution for organizations seeking to meet evolving U.S. Department of Defense cybersecurity standards.
The i2ACT functions as an all-in-one solution – ideal for meeting final CMMC | NIST certification assessments head-on with confidence or for building a commercial cybersecurity program and is designed to enhance the productivity of the users by combining a FAR | NIST 800-171 | CMMC Assessment with the benefits of a Document and Evidence Management System and a comprehensive set of Reference Guides.
The i2ACT Software is designed to perform conformity assessments for the FAR | NIST 800-171 and CMMC standards and allows for "switching back and forth between these assessments" at will. The tool systematically moves through practices, requirements, and objectives in easy to read tabbed interfaces that "sync" in context to the users current workflow. Discussions, clarifications, and examples are provided in pop-up windows, while completing conformity assessments and statements.
A Features Data Sheet (below) displays all capabilities of the i2ACT Software Tool and provides more detailed information in the Notes. Full versions of the NIST 800-171/CMMC standards, the NIST 80053 catalogs, and Assessor Guides are searchable and retrievable on demand.
Basic and Expert-Level Assessment Capability
When the i2ACT tool is launched, it displays the NIST 800-171 | CMMC Main Menu. The menu is divided into eight specific categories or resource areas that provide the functionality to move from assessment to compliance, scoring to reporting and planning to deployment.
Both basic and expert-level user interfaces provide flexible access to the remediation actions, references, standards and auditor guides at any step in the process and deliver context-sensitive educational tips and techniques for the user along the way. A central, user-friendly dashboard provides intuitive access to requirements, objectives, artifacts, and standards or references.
The platform integrates guidance from official NIST and CMMC auditor manuals, FAR/DFARS clauses, and NFO control expectations, offering assessors dynamic context and embedded best practices during every step of the compliance process.
Advanced Reporting Tools at your Fingertips
The tool provides a number of report options to tailor the reports for specific needs to include Conformity Statements, Assessor/Auditor Notes, Remediation Actions, Objective Compliance and Evidence/Artifacts at the control level. For Detailed Reports Review HERE.
The i2ACT Architecture
In 2010 when Imprimis decided to develop a NIST 800-53 and NIST 800-171 Assessment and Compliance Tool, the environment in which the tool would operate was based on the need for a high level of security due to the sensitive nature of information to be maintained and stored in the i2ACT database. After the on-premise vs cloud-based analysis was complete, Imprimis felt that because of the types of security risks that can occur in cloud computing environments, the local on-premises solution was the most secure.
Even today, 15 years later, cloud computing service providers still are plagued by various technical vulnerabilities, human errors, and continuously changing attack vectors. Owing to the rapid increase in cloud adoption, Imprimis had considered making a switch to a cloud model, but due to the number of ongoing data breaches and insecure API's, account hijacking, insider threats, Denial of Service (DoS) Attacks, lack of end-to-end encryption, and the fact that many cloud services vendors are not willing to accept shared responsibility for security operations, we have continued to maintain that our original "on-premises" decision still holds true today to provide the most secure environment for the hosting of the i2ACT software solution.
Note: For an indepth summary open the i2ACT Architecture Overview PDF at right...
i2ACT CMMC Level 1 | FAR Software (Foundational)
This is the basic level of certification and consists of several practices that correspond directly to essential safety conditions outlined in the Federal Acquisition Regulation (FAR). The i2 ACT CMMC Level 1 Compliance Tool includes 17 CMMC Level 1 practices (NIST 800-171r2 requirements) which must be met to achieve compliance certification for protecting Federal Contract Information (FCI) and are mapped directly to the Federal Acquisition Regulation (FAR) 52.204.21. The goal is to create a basic “Foundational” level of cybersecurity for any organization with FCI needs.
i2ACT CMMC Level 2 | NIST 800-171 Software (Advanced)
The i2ACT NIST-171|CMMC Level 2 tool is designed to assist in assessing compliance with the NIST 800-171r2 requirements as specified in the DFARS Subparts 204.73 and 239.76 and contains all 110 requirements and the 125 referenced controls from NIST 800-53r4. The goal is to create an “Advanced” cybersecurity platform for any organization that has CUI, which requires a higher level of security than an organization with only FCI.
Contact Imprimis at 719-463-0333 or visit https://www.imprimis-inc.com/contact-us to take the first step toward cybersecurity resilience. 