---
title: "Pricing for Cloud Evidence and Assurance"
description: "Request Access to the PolicyCortex evidence system. Discuss licensing, tenant scope, and optional fixed-scope CMMC delivery support with our team."
url: https://policycortex.com/pricing
sealed: 2026-09-02
amended: 2026-09-05
register: pricing
records: 5
digest: sha3:8b2b8cd131c18adce171dffc6c7162ba769fd4cb91d2dfbd9257fd12e6d0517f
---

# License the evidence system. Keep the proof in your tenant.

PRICING / COMMERCIAL RECORD

PolicyCortex is licensed software. The evidence core is an annual license, priced per organization, running inside your own tenant. Request Access to discuss your requirements with our team. We confirm scope and commercial terms before onboarding. Fixed-scope delivery engagements are optional. Procurement is available through Microsoft Marketplace.

[Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Request access for your organization

PolicyCortex stands on its own as verification infrastructure: append-only records of system state, change, and machine authority. Our team reviews each access request and agrees on the tenant boundary, required coverage, and commercial terms before onboarding.

Bring one environment and one skeptical reviewer. We will define the read-only boundary and the proof they should expect to reproduce. Submitting a request does not create an account or grant product access.

- **access.review**: Our team reviews your organization, requirements, and intended use.
- **access.mode**: Read-only scope is agreed before connecting your tenant. SHADOW mode watches only; nothing executes.
- **access.onboarding**: Access and onboarding are arranged after review and agreement on commercial terms.
- **access.scope**: The three proof layers, chained: state (what existed), change (what altered it), agency (what was allowed).
- **access.request**: [Request Access](https://app.policycortex.com/auth?mode=request-access) at app.policycortex.com.
- **access.procurement**: Agree on scope and terms with our team. Procurement is also available through the [Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/pcg.policycortex-platform?tab=overview).

## License the verification system

Our team confirms your scope and commercial terms before onboarding. Procurement is also available through the [Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/pcg.policycortex-platform?tab=overview).

- **Governance & Continuous ATO**: Annual license. Verifiable evidence, continuous authorization, and approval-gated remediation
- **Full Platform + AI Governance**: Annual or monthly terms. The assurance system plus security posture, AI governance, and FinOps

**Capability matrix**

| Verification capability | Governance & Continuous ATO | Full Platform + AI Governance |
|---|---|---|
| Proof of state, change, and agency (Append-only evidence, hash-chained history, declared gaps, and independently replayable records) | Included | Included |
| Continuous compliance & authorization (CMMC L2, NIST 800-171 / 800-53, FedRAMP baselines, control mapping, and continuous evidence) | Included | Included |
| Assessment packages (SSP, SAR, POA&M, eMASS XML, OSCAL JSON, CSV, and cryptographic manifests) | Included | Included |
| Bounded remediation (150+ approval-gated actions with validation, isolated execution, verification, and autonomy off by default) | Included | Included |
| Security posture (CSPM) (Exposure management, attack paths, threat triage, and MITRE ATT&CK coverage) | Not included | Included |
| AI governance (Model and agent inventory, runtime protection mapped to MITRE ATLAS, and shadow AI detection) | Not included | Included |
| Cost accountability (FinOps) (FOCUS 1.x visibility, budgets, anomalies, commitment recommendations, and chargeback) | Not included | Included |
| Enterprise integrations (Entra ID, Jira POA&M sync, and GitHub / GitLab scanning) | Included | Included |

### FinOps cost intelligence

- **module.scope**: FOCUS 1.x visibility, budgets, anomaly detection, commitment recommendations, and chargeback. It is included in Full Platform or available separately as a supporting module, not the core assurance system.
- **module.commercial**: Annual specialist license.
- **module.contact**: [Discuss the module](https://policycortex.com/contact?inquiry=finops)

Prices in USD per organization.

Commercial terms on request: they reflect the connected estate and required modules. Larger or unusually complex estates receive a scoped quote before purchase. [Contact us](https://policycortex.com/contact).

![The PolicyCortex value report: engineer hours returned, evidence artifacts, compliance posture, the action queue, and the ATO track across collections](https://policycortex.com/images/pcx-platform-value-dashboard-1600.webp)

Exhibit P-1 · what the license is measured against: hours returned, controls satisfied, posture held, every claim traceable to a record. Illustrative demo data; the interface is real.

## Add operators when you need them

The platform is the product. Delivery support is optional: use it to establish the first evidence record, operate the assurance cadence, or extend an internal team.

**Delivery engagements**

| Engagement | Operating model | Next step |
|---|---|---|
| delivery.acceleration: 30-Day Evidence Acceleration. Establish the CUI boundary, build the evidence baseline, work priority gaps, and assemble the assessment record. | Fixed scope, one primary cloud environment | [Scope this engagement](https://policycortex.com/book?engagement=acceleration) |
| delivery.managed: Managed Assurance Delivery. PolicyCortex runs the evidence rhythm, documentary maintenance, remediation follow-through, and assessor response cycle. | Ongoing operation, custom scope | [Scope this engagement](https://policycortex.com/book?engagement=managed) |
| delivery.team-assisted: Team-Assisted Assurance. Your security or GRC team remains in control while our specialists support evidence operations and package quality. | Shared operation, custom scope | [Scope this engagement](https://policycortex.com/book?engagement=team-assisted) |

- **delivery.partner**: MSPs, advisors, and primes can retain the customer relationship while PolicyCortex supplies the evidence system and specialist delivery capacity. [Discuss partner delivery](https://policycortex.com/contact?inquiry=partner-delivery).

## What is not included

**Stated limit.** No numeric prices are published here. Commercial terms reflect the connected estate and required modules, and larger or unusually complex estates receive a scoped quote before purchase.

Delivery support does not guarantee certification. The independent assessor makes the certification decision. The fixed 30-day engagement covers one agreed primary cloud environment; additional cloud accounts, tenants, endpoints, locations, or frameworks are priced from the actual boundary and documentary workload before added work starts.

PolicyCortex is not currently available through GSA or SEWP. GSA MAS offer preparation is complete, final review is pending, and no GSA contract has been awarded. [The Federal Procurement page carries the verified status.](https://policycortex.com/procurement)

## Buyer questions

**Q: What does the 30-day acceleration engagement include?**
A: The fixed 30-day scope covers one agreed primary cloud environment. It includes boundary and readiness work, technical and documentary gap assessment, evidence collection and control mapping, policies and procedures, SSP and POA&M work, approved remediation coordination, interview preparation, package assembly, and in-scope assessor support. Added environments, tenants, or frameworks are scoped separately before work begins.

**Q: What is the difference between managed and team-assisted delivery?**
A: Managed delivery adds a PolicyCortex-operated assurance cadence: our team maintains the record, documentary work, and remediation follow-through. Team-assisted delivery keeps your security or GRC team in day-to-day control while our specialists support evidence operations and package quality. Both are optional operating models around the same product.

**Q: Is software access included in delivery support?**
A: Yes, for the agreed scope and duration. PolicyCortex remains the system of record: it collects and chains evidence, maps controls, tracks authorized remediation, and preserves package history. Ongoing use outside a delivery engagement is licensed through a platform subscription.

**Q: Can I license the system without services?**
A: Yes. Request Access and our team will confirm scope and licensing terms before onboarding. Governance & Continuous ATO and Full Platform + AI Governance are available without delivery services. A focused FinOps subscription remains available as a supporting cost-intelligence module. Procurement is also available through Microsoft Marketplace.

**Q: Do you perform the documentary work?**
A: When delivery support is in scope, yes. Our team writes and updates policies, procedures, the SSP, POA&M, control narratives, evidence indexes, and related assessment materials. We also help prepare control owners for interviews and sample requests.

**Q: Does assessment support guarantee certification?**
A: No. The independent assessor makes the certification decision. Our commitment is to stay engaged on in-scope evidence, clarifications, added samples, and remediation-plan updates through assessor review, at no additional cost for that agreed review support.

**Q: How are additional environments priced?**
A: The fixed 30-day engagement covers one agreed primary cloud environment. Additional cloud accounts, tenants, endpoints, locations, or frameworks are priced from the actual boundary and documentary workload before added work starts.

**Q: How can a federal buyer procure PolicyCortex?**
A: PolicyCortex, Inc. is active in SAM.gov for All Awards with CAGE 19CQ3. Direct quotes and purchase-order support are available subject to the buyer's contracting rules. GSA MAS offer preparation is complete, final review is pending, and no GSA contract has been awarded. PolicyCortex is not currently available through GSA or SEWP. The Federal Procurement page carries the verified status.

Bring one environment and one skeptical reviewer. [Request Access](https://app.policycortex.com/auth?mode=request-access)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | ACCESS AND ONBOARDING | c3e9ad650e52 | 957024b7dcb4 |
| REC 0001 | THE LICENSE | 0bc65fd7f49d | c3e9ad650e52 |
| REC 0002 | DELIVERY ENGAGEMENTS | a3c4bbeb4b27 | 0bc65fd7f49d |
| REC 0003 | NOT INCLUDED | 02d85a812482 | a3c4bbeb4b27 |
| REC 0004 | BUYER QUESTIONS | 8b2b8cd131c1 | 02d85a812482 |

Head sha3:8b2b8cd131c18adce171dffc6c7162ba769fd4cb91d2dfbd9257fd12e6d0517f. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.