Annual rhythm. Continuous evidence. Defensible affirmations.

Managed-services providers run your IT environment — patching, monitoring, ticketing. We don't. We run your CMMC compliance posture inside an environment you (or your MSP) operate.

We're the discipline layer, not the service desk. If you need both, we work alongside your existing MSP — and we watch them, including for the ownership-change or offshoring drift that often breaks compliance silently.

Senior consultants. Same principal year after year. Every quarterly review, every affirming-official brief, every annual tabletop is run by the same person.

No "account manager" handoff to someone you've never met. The team is small by design — we don't scale by adding juniors.

Yes for most contractors handling FCI or standard CUI — IT services, software, professional services, training, admin support, cyber, data services. We work inside your tenant under your access; nothing leaves your environment.

The exception is ITAR or EAR-controlled technical data. State Department rules treat foreign-national access to those systems as a "deemed export" — even if no data ever moves. The 2022 UK Open General License covers some categories without prior approval; others still need formal licensing.

We work through this on the Discovery Call. If your environment is genuinely incompatible with non-US delivery, we'll say so and refer you to a US-based RP we trust — rather than take a retainer that becomes useless to you at the next triennial.

Under the False Claims Act, the standard is "knew or should have known." If the affirming official signs a CMMC affirmation that turns out to be materially wrong, and a court finds they had reason to know — through documentation gaps, missing evidence, an unreviewed POA&M, an unflagged MSP change — that is personal civil exposure. Treble damages and per-claim penalties under 31 U.S.C. § 3729. The penalty per false claim resets every contract invoice, not once per affirmation.

The 2025 numbers: DOJ recovered $52M across seven cybersecurity-fraud settlements — five initiated by whistleblowers inside the contractor's own organisation. The MORSECORP settlement that year ($4.6M) involved a contractor whose real SPRS score had dropped to negative 142 against a self-reported positive number. The whistleblower was an employee. Under the FCA's qui tam provisions, that employee gets a share of the recovery — which is why these cases keep arising from inside the contractor.

Acquisition risk runs the same way. Acquirers inherit FCA exposure for predecessor affirmations — the diligence question 'were the affirmations defensible?' is now a deal-stage filter. Holland & Knight, WilmerHale, and Fluet have all published client alerts in the last twelve months coining the phrase "CMMC Affirmation Trap" to describe the gap between what most contractors think they're signing and what their personal exposure actually is. The continuous-compliance discipline isn't theatre — it's the documentation defence the affirming official needs before signing, every year, for as long as the certification holds.

Then they don't sign. We've designed the rhythm so that thirty days before the affirmation deadline, the official has a complete pre-affirmation pack — evidence summary, SSP currency confirmation, POA&M closure status — to review.

If they have questions, we answer them in writing. If something doesn't add up, we identify and close the gap before the deadline. The goal is informed consent, not deadline pressure. The False Claims Act exposure they take on personally deserves it.

Annual retainer, scoped on the Discovery Call, locked within one business day. Pricing depends on environment complexity, contractor headcount, number of locations, and whether you've come from our Implementation engagement (transition gets a price benefit). Paid quarterly, monthly, or annually.

No surprise invoices, no scope creep. The number on the SOW is the number you pay through to renewal review.

No. We work inside your environment using your authenticated access. Nothing gets copied to our systems. Same architecture as our Gap Assessment and Implementation engagements.

Customer Responsibility Matrix documents what we touch — and what stays untouched. If we get breached tomorrow, your CUI is unaffected.

Yes. We start with a brief audit of what's been done — what holds up, what's missing, what's been quietly skipped. Often we find that "continuous compliance" meant "a quarterly meeting plus a managed SIEM." Different thing.

We tell you what's salvageable and what needs rebuilding. Transition takes 30 to 60 days depending on the state of the existing program.

No. If your CMMC certification was achieved with another partner, we pick up from your current state. Q1 of the retainer becomes a baseline audit — what you have, what holds up, what needs work.

If your existing SSP, evidence pack, and POA&M are defensible, we work from them. If they're not, we'll tell you what needs rebuilding before the retainer makes financial sense. Sometimes the honest answer is to fix the foundation first.

Yes. Continuous Compliance includes full C3PAO assessment support at your triennial — same principal, no separate engagement to scope, no separate fee. Built into the retainer.

The whole point of the retainer is that you arrive at your next assessment with three years of continuous evidence already indexed and ready. The assessment itself becomes a sampling exercise, not a scramble.