Documents

Competitive Landscape

Tracepoint · A&R Strategic Solutions Version 1.0 · August 2026

Every price, authorization status, and deployment fact below was read from a primary public source on 25 August 2026, and each is cited. Where something could not be verified, it appears in the final section rather than being estimated.

The system of record is not the competition

This has to be said before anything else, because the alternative is a claim we would not be able to defend.

DoD already has a system of record for audit findings and corrective action plans. The DoD CIO memorandum Remediation of Information Technology-based Material Weaknesses Impacting Financial Auditability, dated 23 July 2025, directs system owners to:

"Review and update all CAPs in the Advana NFR database (https://advana.data.mil/) and POA&Ms in the Enterprise Mission Assurance Support Service (eMASS)..."

The Office of the Deputy Chief Financial Officer describes the NFR Database as "the single source for accurate, real-time, independent information on the progress of the DoD financial statement audits," where the reporting entity "develops and enters a corrective action plan into the database."

Tracepoint does not replace either system, and does not try to. It is the workspace where the evidence behind a corrective action gets assembled before it goes into those systems, and where the package a reviewer needs gets built. Its interoperability exports exist precisely so the result flows into the systems that already exist.

What actually happens between the finding and the database

The gap Tracepoint addresses is documented by GAO, repeatedly, over eight years.

Fragmentation. GAO found in 2020 that "the Army and the Air Force are using the NFR Database as their primary tool for tracking their financial statement audit findings, while the Navy has developed its own tracking tool." Five years later that was still true: GAO reported in September 2025 that "the Navy used its Deficiency Tracking Tool to track each material weakness reported in its AFR," and that the Marine Corps used it too.

Spreadsheets underneath. GAO documented in 2017 that "the Audit Readiness Directorate uses a spreadsheet called a CAP tracker to keep track of the hundreds of findings and recommendations," and that the Navy used "a detailed spreadsheet, called a Deficiency Universe Tracker."

Linkage and completeness problems. GAO found in 2020 that "NFRs were not always linked to the correct CAPs in the NFR Database," and noted that "uploading milestone information into the NFR Database is not currently an ODCFO requirement."

The most telling figure. GAO reported in September 2024 that for one field on validated corrective action plans, "the field was substantively populated for only 33 of around 3,700 records."

And the workarounds people build. DLA described its process publicly in 2021: the DoD Inspector General loads NFRs into the database, DLA has 60 days to load CAPs, and only a small team can load them. To collect progress from the people actually doing the work, DLA built a SharePoint tool "that standardized how DLA Acquisition employees communicate efforts." At the time DLA held 418 NFRs and 328 CAPs.

That SharePoint tool is the shape of the problem. The database holds the plan. The evidence, the working papers, and the record of who did what live somewhere else, in whatever each organization improvised.

Sources: DoD CIO memo, 23 Jul 2025 · GAO-17-85 · GAO-21-157 · GAO-24-106890 · GAO-25-107427 · DLA, 17 Aug 2021

The commercial alternatives

Four categories of product get considered for this work.

GRC and integrated risk platforms, Archer IRM, ServiceNow IRM, MetricStream, LogicGate. Broad enterprise platforms covering risk, compliance, policy, and audit.

Audit and controls suites, Workiva, Optro (formerly AuditBoard), Diligent One (the HighBond and Galvanize lineage). Built for audit and controls teams, generally SaaS.

Compliance and authorization automation, Telos Xacta 360, Paramify, Ignyte. Aimed at RMF authorization and continuous monitoring rather than financial statement remediation.

Spreadsheets and shared drives, the actual incumbent, per GAO above.

Published prices

These are catalog prices on GSA Advantage under a specific contractor's schedule contract, not vendor-wide list prices, and the same item can carry different prices under different contractors. Most are sold by a reseller rather than the software publisher, so none of them should be described as "the vendor's list price." All retrieved 25 August 2026. GSA Advantage product pages do not print a price-effective date; they show the contract and its expiration, which is why each row names one.

Four cautions on reading the table.

The Archer unit is ambiguous on its own page. The catalog shows $1,980.99 with a unit of issue of "EA," while the contractor's own description field reads "Archer - Use Cases ISSUE SUB $ /admin /mo." Those two statements are not reconciled anywhere on the listing, so we do not annualise the figure and neither should anyone else without confirming it with GSA or the contractor.

Archer's contract GS-35F-0119Y expires 19 December 2026, under four months from this writing. Any figure drawn from it is close to its end.

The same Telos item carries two published prices. The Telos-direct schedule price and the GSA 2GIT BPA price differ, which is normal and is why each row above names its contract. Telos publishes a dated price list PDF, current through Modification 0103, dated 23 February 2026, which is the only source in this comparison that carries a real document date. One line in it, the Xacta 360 Enterprise annual maintenance, is printed as "$ 243.129.60" with a period where a comma belongs. That is a typo in the vendor's document, and we note it rather than silently correcting it.

Workiva has a second, higher listing. A "Wdesk Government Audit Management Solution" appears at $39,496.22 through Carahsoft, but its own description marks it "a legacy product [that] requires Vendor approval for purchase." The current Vertosoft item is in the table above. Carahsoft also lists the current item at $43,445.84, so the same product carries two published prices depending on the reseller.

ServiceNow IRM Foundation at $164.58 per operator per month annualises to about $1,975 per operator, and that unit is stated unambiguously on the listing.

Paramify is the only vendor in this set that publishes list prices on its own website, at paramify.com/pricing: DoD ATO IL2 at $55,000 a year for package and continuous monitoring, IL4 at $95,000, IL5 and IL6 at $125,000, each footnoted "includes one product offering."

Real federal transactions, from USAspending:

The EEOC award is the most directly comparable: $40,000 for up to three users for one year, which is $13,333 per user.

Structural comparison

FedRAMP detail, from the official Marketplace dataset (last change 25 August 2026): ServiceNow Government Community Cloud, High, authorized 2019-08-12, JAB path, with 99 authorizations and 271 reuses including DISA, the Navy, and the Air Force. Telos Xacta SaaS, High, 2025-07-14. Workiva Platform, Moderate, 2019-10-09. Diligent One Platform, Moderate, 2019-11-20, with authorizing agencies including DFAS. Paramify Cloud, Moderate, 2026-03-06. Archer, Optro/AuditBoard, MetricStream, and LogicGate do not appear in the 704-product dataset in any status. Ignyte appears only as an accredited third-party assessment organization, not as an authorized cloud service offering.

FedRAMP is listed here because a buyer will ask. It is a cloud authorization program, and Tracepoint is not a cloud service, it has nothing to authorize, because there is nothing hosted. That removes a barrier rather than clearing one, and we would rather state the distinction than let a checkbox imply an equivalence that does not exist.

Where each kind of tool fits

• Enterprise platforms such as ServiceNow, Archer, and Workiva are built for hundreds of concurrent users on shared data, with risk registers, policy management, vendor risk, and enterprise-wide dashboards. They are the system an enterprise standardizes on for breadth.
• Tracepoint is built for the work between the finding and the database: assembling the evidence behind a corrective action, attesting it, and packaging it for a reviewer. It runs on the workstation where that work happens, one holder per workspace, and rolls up by package. It sits beside the enterprise platform and the systems of record rather than replacing either.
• On authorization. Hosted platforms carry FedRAMP authorizations because they are cloud services. Tracepoint has no cloud service, so it runs under an organization's own software approval, applied to a file set with a published integrity manifest.

Where Tracepoint is genuinely different

• It runs with the network off, as its normal mode. Not a degraded fallback and not a sovereign-cloud arrangement. There is no server to reach.
• The output stands alone. A reviewer opens one file and reads the whole case with nothing installed and no account. Every product above delivers its evidence through its own platform or a generic export.
• The lineage survives. Every imported finding keeps its original source row and every conversion applied to it, inside the package. This is what GAO's "populated for only 33 of around 3,700 records" describes the absence of.
• The limits are printed on the artifact. Attestation is not called a signature. Append-only is not called immutable. An unexplained difference stays unexplained. A defaulted value says it was defaulted.
• The price is published, and the entry tier is buyable on a purchase card. Nobody else in this comparison is both.
• The integrity manifest can be re-derived without us. The canonicalization rules are printed inside the artifact, so a reviewer with any SHA-256 implementation can check it in ten years whether or not this company still exists.

Verification notes

Where a fact could not be read from a primary source, it is listed here rather than estimated.

• No public list price exists on the vendor's own website for Archer, ServiceNow, Workiva, Optro/AuditBoard, Telos, MetricStream, LogicGate, or Diligent. Only Paramify publishes one. Archer, MetricStream, Telos, and ServiceNow return HTTP 404 on their pricing URLs outright; the rest are lead-capture forms. GSA Advantage catalog prices are not the same as list prices.
• Two GSA contractors have names that collide with vendors in this comparison and are different companies: "LOGIC GATE LLC" of Chantilly, Virginia is not LogicGate Inc., and "IGNYTE GROUP INC" of McLean, Virginia is not Ignyte Assurance Platform of Centerville, Ohio. Their contract numbers must never be attributed to the software vendors.
• MetricStream, Optro/AuditBoard, LogicGate, Paramify, and Ignyte returned no GSA Advantage catalog listing. That confirms absence from that catalog on the date checked. It does not prove the absence of a GSA schedule contract, because not every schedule holder posts a catalog.
• Air-gapped or fully offline support could not be confirmed or ruled out for Archer, Workiva, Optro, Ignyte, MetricStream, LogicGate, or Diligent. No vendor page addresses it. Telos references Microsoft's air-gapped and sovereign clouds, which is Xacta operating inside an air-gapped environment rather than a general air-gapped product option.
• Ignyte's deployment model is a gap in the record, not evidence of SaaS-only. Its "Flexible Deployment Options" heading has no detail behind it.
• Whether HighBond specifically falls inside the Diligent One Platform FedRAMP boundary is unconfirmed, which is why the listing is cited by its actual name.
• No implementation timeline is published by any vendor for this category except Workiva, and Workiva's published 10–12 week blueprint is scoped to asset management and fund reporting rather than audit remediation. Telos sells a "Quick Start" installation described as up to one week; Archer sells fixed-price SmartStart installation packages with a 45-day delivery window but no stated duration.
• No GAO or DoD OIG report ties eMASS to financial-statement NFR or CAP tracking. That linkage comes from the DoD CIO memorandum, which is a directive rather than an audit finding, and is attributed that way above.