Garrison rebuilds the same six-artifact deliverable set from your compliance state every 60 days. Standing refreshes it every 90 days. Sentinel and Standard refresh it every 30 days. Garrison is written for the contractor whose prime is asking questions or whose assessment window is forming, and for whom Standing’s 90-day cycle is not fast enough.
What Garrison delivers each cycle
- The complete artifact set, every 60 days. SPRS readiness report, System Security Plan, POA&M, CUI scoping package, Customer Responsibility Matrix, and evidence index, generated from your connected clouds and intake, covering all 110 NIST 800-171 requirements and 320 assessment objectives. Your framework target is your choice: NIST SP 800-171 Rev. 2 (110 requirements, 320 assessment objectives; required and scored) by default, or NIST SP 800-171 Rev. 3 (97 requirements, 422 assessment objectives; emerging, no DoD score exists), selected at intake or from your workspace. CMMC Level 2 is bound to NIST SP 800-171 Rev. 2 today: 32 CFR 170.14(c)(3) states that the CMMC Level 2 security requirements are identical to the requirements in NIST SP 800-171 R2.
- Measured where you connect. Read-only connectors to AWS, Azure, Microsoft 365, Google Workspace, Okta and CrowdStrike pull configuration metadata under read-only access you grant. No file contents, no CUI ingestion. You can revoke each connector from your side at any time.
- Your SPRS estimate recomputed each cycle against the DoD Assessment Methodology point-deduction weights. A directional estimate computed by the agents, not a C3PAO assessment.
- Tamper-evident records. SHA-256 evidence hashing, an append-only audit trail enforced at the database, and Ed25519-signed evidence certificates a C3PAO can verify offline against our published public key.
- Token-gated Markdown exports of the posture, POA&M, scope, CRM and evidence artifacts alongside the PDFs, for your assessor’s tooling or your own agents.
Garrison, Standing, Sentinel or Standard?
- Standing, $8,340 a year: refreshed every 90 days. Right when nothing external is forcing the pace and you need the obligation covered at the lowest cost.
- Sentinel, $11,940 a year: refreshed every 30 days. Written for the contractor that has already affirmed or passed Level 2 and is keeping its evidence current.
- Garrison, $17,940 a year: 60-day refresh. Right when a prime or an approaching assessment window means your documentation cannot go stale for a quarter.
- Standard, $29,940 a year: refreshed every 30 days. Right when your assessment date is close.
How it starts
- Day 0. Stripe processes the subscription and the welcome email arrives with your onboarding link.
- Intake. You answer the intake about your entity, your environment and your DFARS 252.204-7012 flow-down status, then connect whichever clouds you want measured. Connect none and you still get an intake-based gap analysis.
- After intake. Your first readiness package arrives as a PDF once the scan completes: control-gap analysis across the 110-control baseline, your SPRS estimate against your self-reported score, and a remediation plan ordered by readiness-recovery impact.
- Every 60 days after that. Each package is due 60 days after the previous one was delivered; the cycle re-runs and the documents rebuild from current data.
Start Garrison
$17,940 per year, or $1,495 per month month-to-month. If you received your $999 CMMC Level 2 Readiness Snapshot PDF within the last 30 days and subscribe with the same billing email, the $999 credits to your first Level 2 subscription invoice (Refund Policy).