Engagements · Published pricing

Priced in the open.

Most security firms hide pricing behind a discovery call. We publish it, because you cannot plan readiness around a number you are not allowed to see. Fixed price, fixed scope, no surprises at the end.

Engagements and prices

CMMC Gap Assessment

Cyber desk · 110 controls · Fixed price

$7,500

Up to 50 employees. 51 to 200: $12,500. Larger: scoped call.

  • Every finding ranked against the 110 controls of NIST 800-171, with a fix path and cost estimate for each
  • Starter System Security Plan and POA&M, the documents an assessor asks for first
  • Remediation sequence your budget can actually carry
  • Debrief with the operator who ran the assessment

Deposit reserves your slot; balance invoiced at kickoff. Prefer to talk first? Book a scoping call, no charge.

Quantum Exposure Assessment

Quantum desk · Inventory to roadmap · Fixed price

$9,500

Almost nobody at mid-market has run one. Being first in your supply chain is the point.

  • Cryptographic inventory: every place encryption lives in your business, documented
  • Risk ranking by data shelf life, the Mosca math run on your real data classes
  • Vendor exposure map with post-quantum status letters for your top ten vendors
  • Migration roadmap mapped to the federal deadlines, with a debrief

Deposit reserves your slot; balance invoiced at kickoff. Not sure yet? The free read takes ten minutes.

Best value · Save up to $2,500

The Readiness Bundle

Both assessments · One engagement · One debrief

$15,000

CMMC gap assessment plus quantum exposure assessment, run as one engagement. Up to 50 employees. 51 to 200: $19,500. Larger: scoped call.

  • Everything in both assessments above
  • One combined remediation sequence, so the same fix never gets paid for twice
  • Single executive debrief covering compliance and quantum posture together

Saves $2,000 up to 50 employees and $2,500 at 51 to 200. Over 200, get a scoped quote.

Steady State

Ongoing · Monitoring, training, annual re-reads

$2,950/mo

For companies past their first assessment: keep the posture you paid for.

  • Continuous monitoring review and quarterly check-ins
  • Employee security training cadence
  • Annual re-assessment and documentation upkeep
Talk to an operator

Retainers start with a conversation, not a checkout button.

Why the assessment is the cheap part.

The Department of Defense's own estimate puts a small business's Level 2 certification at $104,670 over three years, and that covers only the assessment and the paperwork. It assumes the security controls are already in place. For most shops they are not. The gap assessment is how you spend what comes next in the right order, once, instead of twice under deadline.

Source: CMMC Program final rule, 32 CFR Part 170, Federal Register, October 15, 2024, regulatory impact analysis. We cite what we can substantiate, here as everywhere.

Not ready to buy? Start with the free read

Straight answers.

  • AFTER YOU BUYKickoff scheduling within one business day. Most assessments run two to four weeks depending on size and access.
  • THE DEPOSIT$1,500 reserves your engagement and locks the price. The balance is invoiced at kickoff. If a scoping call shows an assessment is not the right move, the deposit comes back in full.
  • FIXED MEANS FIXEDThe price on this page is the price. If your environment is bigger than the tier you bought, we tell you before work starts, not after.
  • WHAT WE DO NOT SELLFear. If your read or your assessment says you are in good shape, that is what the report says.