Release notes

You can now sign in to Deep Fathom with email and password, in addition to Microsoft and Google SSO.
This makes it easier to:

• Onboard team members at organizations without M365 or Google Workspace

• Provision access for auditors, assessors, and consultants who need temporary access

• Use Deep Fathom with custom corporate identity providers

Multi-factor authentication is supported and encouraged for all authentication methods.

Deep Fathom Outpost is now available — a lightweight CMMC compliance tool designed specifically for small DIB companies who need to get compliant without enterprise overhead.
Outpost is built for:

• Small suppliers and subcontractors in the defense supply chain

• Companies with 1–50 employees tackling CMMC for the first time

• Organizations that need a faster, more affordable path to compliance than traditional GRC platforms

What Outpost includes:

• Guided CMMC self-assessment workflow

• Policy templates and control documentation

• Evidence upload and gap tracking

• SPRS score calculator

Outpost shares the same OSCAL controls engine and AI assistant as the core Deep Fathom platform, just packaged for smaller teams.

The Deep Fathom platform is now deployed on Microsoft Azure Government Cloud (GovCloud).
Why this matters:

• Data residency in US government-only Azure regions

• Meets the data sovereignty requirements for organizations handling Controlled Unclassified Information (CUI)

• FedRAMP-authorized infrastructure baseline

• Required for prime contractors and their supply chain managing export-controlled or sensitive defense information

This was a key milestone for our enterprise customers and an important step toward our own FedRAMP authorization roadmap.

The entire Deep Fathom interface has been rebuilt with a new design system — cleaner, more consistent, and built to scale with the platform.
What's new:

• 120+ new UI components with consistent visual language

• Improved information density — more data visible without overwhelming

• Better contrast and readability across all views

• Faster rendering for data-heavy screens like the controls dashboard

The design system is also the foundation for the Deep Fathom Outpost product, keeping both tools visually unified.

Deep Fathom now has a purpose-built CMMC Level 2 controls engine using the OSCAL (Open Security Controls Assessment Language) standard.
What this means for you:

• Full NIST SP 800-171 r2 control catalog with assessment objectives

• Traceable mapping from your evidence to specific control requirements

• Assessment-ready reporting that aligns with how C3PAOs evaluate compliance

• Foundation for automated SPRS score calculation

OSCAL is the data standard that CMMC assessors, the DoD, and tools like eMASS use. Building on it means your Deep Fathom data is portable and interoperable.