Garrison rebuilds the same six-artifact deliverable set from your compliance state every 60 days. Standing refreshes it every 90 days. Sentinel and Standard refresh it every 30 days. Garrison is written for the contractor whose prime is asking questions about its compliance state, or whose environment changes too often for Standing’s 90-day cycle.
What your company represents to the government. Your NIST SP 800-171 assessment score is posted in SPRS under DFARS 252.204-7019 and 252.204-7020, and where a contract requires a CMMC status, your Affirming Official affirms in SPRS that your company “has implemented and will maintain implementation” of the applicable security requirements (32 CFR 170.22). Both are representations your company makes to the federal government. An offer needs a current assessment in SPRS (DFARS 252.204-7019(b)) and the affirmation recurs annually, so the need to know that the compliance state behind them is accurate does not start or end with an assessment. Garrison keeps that compliance state measured and evidenced on a stated schedule, so your Affirming Official decides from the latest measured record; where a C3PAO assessment is required, the same record is there for your assessor, on your grant.
What Garrison delivers each cycle
- The complete artifact set, every 60 days. SPRS readiness report, System Security Plan, POA&M, CUI scoping package, Customer Responsibility Matrix, and evidence index, generated from your connected clouds and intake, covering all 110 NIST 800-171 requirements and 320 assessment objectives. Your framework target is your choice: NIST SP 800-171 Rev. 2 (110 requirements, 320 assessment objectives; required and scored) by default, or NIST SP 800-171 Rev. 3 (97 requirements, 422 assessment objectives; emerging, no DoD score exists), selected at intake or from your workspace. CMMC Level 2 is bound to NIST SP 800-171 Rev. 2 today: 32 CFR 170.14(c)(3) states that the CMMC Level 2 security requirements are identical to the requirements in NIST SP 800-171 R2.
- Measured where you connect. Read-only connectors to AWS, Azure, Microsoft 365, Google Workspace, Okta and CrowdStrike pull configuration metadata under read-only access you grant. No file contents, no CUI ingestion. You can revoke each connector from your side at any time.
- Your SPRS estimate recomputed each cycle against the DoD Assessment Methodology point-deduction weights. A directional estimate computed by the agents, not a C3PAO assessment.
- Tamper-evident records. SHA-256 evidence hashing, an append-only audit trail enforced at the database, and Ed25519-signed evidence certificates a C3PAO can verify offline against our published public key.
- Token-gated Markdown exports of the posture, POA&M, scope, CRM and evidence artifacts alongside the PDFs, for your assessor’s tooling or your own agents.
Garrison, Standing, Sentinel or Standard?
- Standing, $8,340 a year: refreshed every 90 days. Right when nothing external is forcing the pace and you need the obligation covered at the lowest cost.
- Sentinel, $11,940 a year: refreshed every 30 days. Written for the contractor that has already affirmed or passed Level 2 and is keeping its evidence current.
- Garrison, $17,940 a year: 60-day refresh. Right when a prime’s questions or the pace of change in your environment mean your documentation cannot wait a quarter between rebuilds.
- Standard, $29,940 a year: refreshed every 30 days. Right when your environment changes month to month and you want the record behind your SPRS score and affirmation rebuilt monthly.
How it starts
- Day 0. Stripe processes the subscription and the welcome email arrives with your onboarding link.
- Intake. You answer the intake about your entity, your environment and your DFARS 252.204-7012 flow-down status, then connect whichever clouds you want measured. Connect none and you still get an intake-based gap analysis.
- After intake. Your first readiness package arrives as a PDF once the scan completes: control-gap analysis across the 110-control baseline, your SPRS estimate against your self-reported score, and a remediation plan ordered by readiness-recovery impact.
- Every 60 days after that. Each package is due 60 days after the previous one was delivered; the cycle re-runs and the documents rebuild from current data.
Start Garrison
$17,940 per year, or $1,495 per month month-to-month. If you received your $999 CMMC Level 2 Readiness Snapshot PDF within the last 30 days and subscribe with the same billing email, the $999 credits to your first Level 2 subscription invoice (Refund Policy).