Garrison sits between Standing and Standard. Standing keeps a small contractor current on a quarterly cycle. Standard runs the full engine monthly for the OSA on a 90-day C3PAO path. Garrison is for the contractor in between: a prime is asking questions, an assessment window is forming, and quarterly is not fast enough, but the budget review said no to Standard. You get the same seven-artifact deliverable set, refreshed every 60 days.
What Garrison delivers each cycle
- The complete artifact set, every 60 days. SPRS readiness report, System Security Plan, POA&M, CUI scoping package, Customer Responsibility Matrix, and evidence index, generated from your connected clouds and intake, covering all 110 NIST 800-171 requirements and 320 assessment objectives.
- Measured, not surveyed. Read-only connectors to AWS, Azure, Microsoft 365, Google Workspace, Okta and CrowdStrike pull configuration metadata under least-privilege audit scopes. No file contents, no CUI ingestion. Each connector is revocable in about 30 seconds.
- Your SPRS estimate recomputed each cycle against the DoD Assessment Methodology point-deduction weights, with the diff against last cycle on the first page. A directional software estimate, not a C3PAO assessment.
- Evidence that holds up. SHA-256 custody chain, append-only audit trail enforced at the database, and Ed25519-signed evidence certificates a C3PAO can verify offline against our published public key.
- Token-gated Markdown exports of every core artifact alongside the PDFs, for your assessor’s tooling or your own agents.
Garrison, Standing, or Standard?
- Standing, $6,000 a year: quarterly refresh. Right when nothing external is forcing the pace and you need the obligation covered at the lowest cost.
- Garrison, $35,940 a year: 60-day refresh. Right when a prime or an approaching assessment window means your documentation cannot go stale for a quarter.
- Standard, $71,940 a year: monthly refresh. Right on a ~90-day C3PAO path when every cycle counts.
The first hour
- Minute 0. Stripe processes the subscription and the welcome email lands with one link inside.
- Minutes 5 to 15. You answer the intake about your CUI scope and your prime, then connect whichever clouds you want measured. Connect none and you still get an intake-based gap analysis.
- Within the hour. Your first readiness package arrives as a PDF: control-gap analysis across the 110-control baseline, your SPRS estimate against your self-reported score, and a remediation list ordered by point recovery.
- Every 60 days after that. The cycle re-runs, the documents rebuild from current data, and the first page shows what changed.
Start Garrison
$35,940 per year, or $2,995 per month month-to-month. If you ran the $799 CMMC Readiness Snapshot, it credits in full toward your first cycle.