Pricing
License the evidence system. Keep the proof in your tenant.
PolicyCortex is licensed software. The evidence core is an annual license, priced per organization, running inside your own tenant. Request Access to discuss your requirements with our team. We confirm scope and commercial terms before onboarding. Fixed-scope delivery engagements are optional. Procurement is available through Microsoft Marketplace.
Request access for your organization
PolicyCortex stands on its own as verification infrastructure: append-only records of system state, change, and machine authority. Our team reviews each access request and agrees on the tenant boundary, required coverage, and commercial terms before onboarding.
Bring one environment and one skeptical reviewer. We will define the read-only boundary and the proof they should expect to reproduce. Submitting a request does not create an account or grant product access.
- access.review
- Our team reviews your organization, requirements, and intended use.
- access.mode
- Read-only scope is agreed before connecting your tenant. SHADOW mode watches only; nothing executes.
- access.onboarding
- Access and onboarding are arranged after review and agreement on commercial terms.
- access.scope
- The three proof layers, chained: state (what existed), change (what altered it), agency (what was allowed).
- access.request
- Request Access at app.policycortex.com.
- access.procurement
- Agree on scope and terms with our team. Procurement is also available through the Microsoft Marketplace.
License the verification system
Our team confirms your scope and commercial terms before onboarding. Procurement is also available through the Microsoft Marketplace.
- Governance & Continuous ATO
- Annual license
- Verifiable evidence, continuous authorization, and approval-gated remediation
- Full Platform + AI Governance
- Annual or monthly terms
- The assurance system plus security posture, AI governance, and FinOps
| Verification capability | Governance & Continuous ATOAnnual licenseVerifiable evidence, continuous authorization, and approval-gated remediation | Full Platform + AI GovernanceAnnual or monthly termsThe assurance system plus security posture, AI governance, and FinOps |
|---|---|---|
| Proof of state, change, and agencyAppend-only evidence, hash-chained history, declared gaps, and independently replayable records | Included | Included |
| Continuous compliance & authorizationCMMC L2, NIST 800-171 / 800-53, FedRAMP baselines, control mapping, and continuous evidence | Included | Included |
| Assessment packagesSSP, SAR, POA&M, eMASS XML, OSCAL JSON, CSV, and cryptographic manifests | Included | Included |
| Bounded remediation150+ approval-gated actions with validation, isolated execution, verification, and autonomy off by default | Included | Included |
| Security posture (CSPM)Exposure management, attack paths, threat triage, and MITRE ATT&CK coverage | Not included | Included |
| AI governanceModel and agent inventory, runtime protection mapped to MITRE ATLAS, and shadow AI detection | Not included | Included |
| Cost accountability (FinOps)FOCUS 1.x visibility, budgets, anomalies, commitment recommendations, and chargeback | Not included | Included |
| Enterprise integrationsEntra ID, Jira POA&M sync, and GitHub / GitLab scanning | Included | Included |
FinOps cost intelligence
- module.scope
- FOCUS 1.x visibility, budgets, anomaly detection, commitment recommendations, and chargeback. It is included in Full Platform or available separately as a supporting module, not the core assurance system.
- module.commercial
- Annual specialist license.
- module.contact
- Discuss the module
Prices in USD per organization.
Commercial terms on request: they reflect the connected estate and required modules. Larger or unusually complex estates receive a scoped quote before purchase. Contact us.
Add operators when you need them
The platform is the product. Delivery support is optional: use it to establish the first evidence record, operate the assurance cadence, or extend an internal team.
| Engagement | Operating model | Next step |
|---|---|---|
| delivery.acceleration30-Day Evidence AccelerationEstablish the CUI boundary, build the evidence baseline, work priority gaps, and assemble the assessment record. | Fixed scope, one primary cloud environment | Scope this engagement |
| delivery.managedManaged Assurance DeliveryPolicyCortex runs the evidence rhythm, documentary maintenance, remediation follow-through, and assessor response cycle. | Ongoing operation, custom scope | Scope this engagement |
| delivery.team-assistedTeam-Assisted AssuranceYour security or GRC team remains in control while our specialists support evidence operations and package quality. | Shared operation, custom scope | Scope this engagement |
- delivery.partner
- MSPs, advisors, and primes can retain the customer relationship while PolicyCortex supplies the evidence system and specialist delivery capacity. Discuss partner delivery.
What is not included
Buyer questions
- What does the 30-day acceleration engagement include?
- The fixed 30-day scope covers one agreed primary cloud environment. It includes boundary and readiness work, technical and documentary gap assessment, evidence collection and control mapping, policies and procedures, SSP and POA&M work, approved remediation coordination, interview preparation, package assembly, and in-scope assessor support. Added environments, tenants, or frameworks are scoped separately before work begins.
- What is the difference between managed and team-assisted delivery?
- Managed delivery adds a PolicyCortex-operated assurance cadence: our team maintains the record, documentary work, and remediation follow-through. Team-assisted delivery keeps your security or GRC team in day-to-day control while our specialists support evidence operations and package quality. Both are optional operating models around the same product.
- Is software access included in delivery support?
- Yes, for the agreed scope and duration. PolicyCortex remains the system of record: it collects and chains evidence, maps controls, tracks authorized remediation, and preserves package history. Ongoing use outside a delivery engagement is licensed through a platform subscription.
- Can I license the system without services?
- Yes. Request Access and our team will confirm scope and licensing terms before onboarding. Governance & Continuous ATO and Full Platform + AI Governance are available without delivery services. A focused FinOps subscription remains available as a supporting cost-intelligence module. Procurement is also available through Microsoft Marketplace.
- Do you perform the documentary work?
- When delivery support is in scope, yes. Our team writes and updates policies, procedures, the SSP, POA&M, control narratives, evidence indexes, and related assessment materials. We also help prepare control owners for interviews and sample requests.
- Does assessment support guarantee certification?
- No. The independent assessor makes the certification decision. Our commitment is to stay engaged on in-scope evidence, clarifications, added samples, and remediation-plan updates through assessor review, at no additional cost for that agreed review support.
- How are additional environments priced?
- The fixed 30-day engagement covers one agreed primary cloud environment. Additional cloud accounts, tenants, endpoints, locations, or frameworks are priced from the actual boundary and documentary workload before added work starts.
- How can a federal buyer procure PolicyCortex?
- PolicyCortex, Inc. is active in SAM.gov for All Awards with CAGE 19CQ3. Direct quotes and purchase-order support are available subject to the buyer's contracting rules. GSA MAS offer preparation is complete, final review is pending, and no GSA contract has been awarded. PolicyCortex is not currently available through GSA or SEWP. The Federal Procurement page carries the verified status.
Bring one environment and one skeptical reviewer.
Request Access