Fixed fee / 30 days / one primary cloud environment / through assessor review
Assessment as a documented confirmation.
The delivery engagement is 30 days at $15,000 flat for one primary cloud environment. Instead of handing you a tool and walking away, our cleared delivery team uses PolicyCortex to collect evidence, write the policies and assessment documents, coordinate technical remediation, prepare control owners, and defend the package when the assessor asks questions. We stay through review. No certification guarantee.
What the engagement is for
CMMC Phase II is suspended (announced 2026-07-13); Phase I self-assessments and DFARS safeguards remain active. The score you represent today rests on the system state and evidence behind it, and the same package has to stay useful for a future CMMC model. The engagement exists so that the assessment becomes a documented confirmation of a record that already exists, rather than a search for one.
- term.duration
- 30 days. Fixed.
- term.price
- $15,000 flat for the standard engagement scope. No hourly, no overages.
- term.scope
- One primary cloud environment. Multi-cloud (AWS + Azure) or multi-tenant scope adds engagement fees scoped to your environment.
- term.package
- SPRS + evidence: policies, procedures, SSP, POA&M, OSCAL, samples, and remediation records, linked.
- term.support
- Through review. In-scope evidence follow-up is included in the flat engagement price.
- term.guarantee
- None. Your C3PAO remains independent and makes the assessment decision.
- term.people
- Founder runs every engagement personally. DoD Secret and DoE Q clearances, both active. Four U.S. patent applications filed.
- term.source
- Department of War release, July 13, 2026 (official release); the site's explainer: what changed and what to do.
- term.handoff
- The eMASS and C3PAO handoff package: what the assessor receives and how they verify it by hash.
Outcomes that make review boring
What the package contains, and why the review goes quietly.
- A score you can defend
- All 110 Rev. 2 requirements map to technical, documentary, or interview evidence from your actual program.
- Fewer late surprises
- Technical gaps are found and closed before they become assessor findings.
- Documents that match reality
- Policies, procedures, SSP, POA&M, OSCAL, samples, and remediation records stay linked.
- A boundary you can explain
- Your CUI scope is explicit, documented, and ready to defend.
- Answers during review
- Cleared engineers work the package when the assessor requests more.
- No surprise review bill
- In-scope evidence follow-up is included in the flat engagement price.
How the package is checked
The assessor reads the OSCAL package and recomputes the chain behind it: every artifact in the package is content hashed with SHA3-256 and carries the digest of the record before it, so the package handed over can be shown to be the package that was assessed, and a correction is a new record rather than an edit.
Our part is to keep the package whole through review. When the assessor requests more detail, new samples, or clarification tied to the agreed engagement scope, we update the evidence package and remediation plan until the question is resolved, at no additional cost. Your C3PAO remains independent and makes the assessment decision; PolicyCortex does not.
How you evaluate the engagement
Start with a call. The engagement scope is agreed before work begins, and every term of it is on this page.
One primary cloud environment, 30 days, $15,000 flat for the standard engagement scope, an evidence package built and defended through assessor review, and no guarantee of certification. Custom development outside the agreed CMMC scope, added cloud accounts or tenants, FedRAMP work, and ongoing operations after the review cycle are scoped separately before work begins.
- eval.start
- A call, then the agreed engagement scope before work begins.
- eval.scope
- One primary cloud environment. 30 days.
- eval.price
- $15,000 flat for the standard engagement scope. No hourly, no overages.
- eval.review
- Through assessor review. In-scope evidence follow-up is included in the flat engagement price.
- eval.guarantee
- None. Your C3PAO remains independent and makes the assessment decision.
- eval.outside
- Custom development outside the agreed CMMC scope, added cloud accounts or tenants, FedRAMP work, and ongoing operations after the review cycle: scoped separately.
The path to a boring assessment
We stay with you through the audit. PolicyCortex performs the documentary work, builds the defensible evidence package, prepares your team, and keeps working when the reviewer asks for more. If your assessor requests more detail, new samples, or clarification tied to the agreed engagement scope, we update the evidence package and remediation plan until the question is resolved, at no additional cost.
- week.1 · Build
- Confirm scope, map each requirement, collect evidence, and start the documentary package.
- weeks.2-3 · Close
- Write the missing documents, coordinate approved technical fixes, and verify the result.
- week.4 · Defend
- Prepare control owners, deliver the package, and stay for in-scope assessor follow-up.
- review · Current proof
- Every control has an evidence story: the package connects technical state, policies, procedures, responsible people, and the evidence your assessor will examine.
- review · Assessor request
- More detail does not become a fire drill: clarifications, added samples, and follow-up questions become traceable review work.
- review · Supported response
- We keep working the package: evidence and the remediation plan are updated until the in-scope question is resolved.
Questions assessors and buyers ask
Why run the engagement while Phase II is suspended?
Because Phase I self-assessments, selected government assessments, and DFARS 252.204-7012 obligations remain. The engagement validates the system state and evidence behind the score you represent today, while keeping the same package useful for a future CMMC model.
What's not included for $15K?
Custom development outside the agreed CMMC scope, added cloud accounts or tenants, FedRAMP work, and ongoing operations after the review cycle. We scope those separately before work begins.
What if the assessor asks for more?
We stay with your team through assessor review. For requests tied to the agreed engagement scope, we provide added detail or samples and update the evidence package and remediation plan until the question is resolved, at no additional cost.
Does audit support guarantee certification?
No. Your C3PAO remains independent and makes the assessment decision. Our promise is that we do not hand you a package and disappear. We keep working the in-scope evidence and remediation response through review.
Can we choose our C3PAO?
Yes. The OSCAL package is C3PAO-agnostic. We don't lock you to an assessor.
Does pricing change for larger environments?
Single primary cloud account is $15K. Multi-cloud (AWS + Azure) or multi-tenant scope adds engagement fees scoped to your environment. Most defense contractors start with one cloud account and add scope after the first engagement.
Make the assessment boring. We stay through review.