Services
The work, listed plainly.
Two of these have published prices and their own pages. The rest are scoped per client, because their shape depends on what you already have.
Everything below is something we do. Nothing below is something we promise will happen to you, and no figure appears on this page that is not published elsewhere on the site with its source.
Where to start
Three ways to start, by what you need.
I need to know where I stand
CMMC Level 2 gap assessment
$5,000, one time
All 110 requirements scored against your environment, your SPRS score calculated, and a broad POA&M of what closing each gap takes.
See the gap assessmentI need the documents written
System Security Plan, policy and POA&M
Scoped per client
The System Security Plan, the policy set behind it, and a detailed POA&M, written against your environment as it actually is.
See the documents serviceI need someone to run it
CMMC In A Container™
From $1,000 a month plus a $6,000 one-time build
A FedRAMP Moderate environment, the full policy set, and the ongoing work, run with you. Prefer to keep your own environment? A fractional CISO owns the program instead.
See CMMC In A Container™Which services have a published price?
TWO OFFERS, BOTH WITH A NUMBERTwo do: the CMMC Level 2 gap assessment and CMMC In A Container™.
CMMC Level 2 gap assessment
All 110 NIST SP 800-171 controls scored against your environment, with the documents you keep. $5,000, one time, for most small and mid-sized contractors.
CMMC In A Container™
The managed program: an environment, the paperwork that proves it, and someone who owns it with you. From $1,000 a month plus a $6,000 one-time build.
Which services are scoped per client?
SCOPED, NOT PRICEDThe five services below are scoped per client. They depend on how much is already in place, so quoting a number before scoping would be a guess. We publish what we can publish and scope the rest with you.
Fractional CISO
A part-time CISO working from inside the business rather than advising from outside it: owning the security and CMMC plan, chairing the reviews, and speaking to the program when a prime asks. Engagement shape and cadence are scoped per client.
CMMC Level 2 program leadership
Running the whole thing from first assessment through to your assessment: scoping the CUI boundary, sequencing remediation, preparing the evidence package, and supporting you through the assessment itself. We prepare you for whichever assessment your contract requires. We do not perform the certification assessment itself.
System Security Plan, policy and POA&M
Writing the documents an assessor reads: the SSP, the policy set behind it, and a POA&M that names every open control, what closing it requires, and who owns it. Written against your environment as it actually is, not against a template.
CUI enclave design
Advisory design for a Controlled Unclassified Information boundary on Microsoft GCC High and Azure Virtual Desktop: where CUI lives, who reaches it, and how that is evidenced. This is design and documentation only. We do not hold your CUI.
Supply Chain Risk Management
For primes: working out which subcontractors touch CUI and what level each must meet, getting the right clauses into your subcontracts, and supporting your subcontractors through their own self-assessments.
Should you buy a gap assessment, the documents, or the whole program?
WHAT EACH ONE BUYS| CMMC Level 2 gap assessment | SSP, policy and POA&M | CMMC In A Container™ | |
|---|---|---|---|
| Price | $5,000, one time | Scoped per client | From $1,000 a month plus a $6,000 one-time build |
| Scores all 110 controls | Yes | No | Yes |
| Calculates your SPRS score | Yes | No | Yes, and posts it |
| Writes your System Security Plan | No | Yes | Yes |
| Writes your policies | No, and does not review them | Yes | Yes, the full set |
| POA&M | A broad one, no tool or design choices | Yes, written | Yes, and closed with you |
| Collects evidence | No, reviews what you hold | No | Yes, reviewed quarterly |
| Runs your environment and security | No | No | Yes, as your MSSP |
Already know you want to talk?
BOOK A CALLSkip the form. Pick a time and talk to us directly.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Not sure which of these you need?
That is the first thing a gap assessment answers. Tell us what your contract requires and we will tell you where to start.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.