Certification is a point in time. Your environment is not. Between your assessment and your reassessment, people change roles, a policy gets relaxed for a project, a bucket gets opened for a vendor, and the evidence binder that satisfied your C3PAO quietly stops describing the environment you are actually running. Sentinel is the tier for the already-certified contractor: keep measuring, keep the evidence fresh, and walk into reassessment from a known posture.
What Sentinel delivers each cycle
- Monthly read-only scans across every connected cloud. AWS, Azure, Microsoft 365, Okta and CrowdStrike, pulled under least-privilege audit scopes. Configuration metadata only. No file contents, no CUI ingestion. Each connector is revocable in about 30 seconds.
- Connected-cloud evidence refreshed every cycle, mapped to the NIST 800-171A assessment objectives, with a SHA-256 custody chain and an append-only audit trail enforced at the database.
- A quarterly readiness snapshot PDF for your board or your prime, showing where the certified environment stands now rather than where it stood on assessment day.
- A reassessment-ready package every cycle, with your evidence binder and System Security Plan building out toward C3PAO handback.
- Drift flagged between assessments. Each cycle is compared against the prior one, so posture degradation surfaces while it is still cheap to fix instead of during reassessment.
Sentinel or a readiness tier?
Sentinel assumes the work is already done. If you have not been assessed yet, the readiness tiers are the right starting point.
- Sentinel, $23,940 a year. You hold a Level 2 certification and need it to still be true at reassessment.
- Standing, $6,000 a year: quarterly refresh for a small contractor with no external clock forcing the pace.
- Garrison, $35,940 a year: the full deliverable set every 60 days when a prime is asking questions.
- Standard, $71,940 a year: monthly refresh on a roughly 90-day path to a C3PAO date.
Where the boundary sits
Sentinel is readiness software. It measures your environment, keeps your documentation current, and produces the evidence a C3PAO will ask to see. It does not assess you, and the SPRS figure it computes is a directional estimate against the DoD Assessment Methodology weights, not a score anyone else certifies. Reassessment runs exclusively through an independent Cyber AB-authorized C3PAO, and your firm submits its own score to SPRS.
Start Sentinel
$23,940 per year, or $1,995 per month month-to-month. If you ran the $799 CMMC Readiness Snapshot within the last 30 days, it credits in full toward your first invoice.