Pricing
Every tier includes the Grade-1 cryptographic vault, hash-chained audit log, and continuous monitoring infrastructure. Tier selection determines the level of practitioner involvement.
Fractional vCISO, strategic advisory, and federal subcontracting are custom-scoped, not priced on this page. Engagements are sized to the program — start with a discovery call to confirm fit, scope, and the right commitment shape.
Aegis
PHI security under HIPAA Security Rule (§164.308–.312) and the Privacy Rule.
Your HIPAA starting block — full Security Rule + Privacy Rule policy library and evidence vault with hash-chained audit log. Same regulator-ready foundation that Audit Co-Pilot signs at the top of the ladder.
- ✓Full HIPAA policy library (Security Rule + Privacy Rule)
- ✓Risk assessment workbook (annual)
- ✓Evidence vault with hash-chained audit log
- ✓Accounting-of-Disclosures register (§164.528)
- ✓Up to 5 user seats
Aegis Self-Service + 2 monthly Consultant Review hours and Tammie AI advisor (HIPAA-tuned). Quarterly readiness reports with practitioner sign-off — Mission Brief's regulator-grade artifact, now on a recurring cadence.
- ✓Everything in Aegis Self-Service
- ✓2 Consultant Review hours per month
- ✓Tammie AI compliance advisor (HIPAA-tuned)
- ✓Quarterly readiness reports with practitioner sign-off
- ✓Global Review Queue (4-day SLA)
Concierge HIPAA. Quarterly risk assessments, BAA reviews, incident response retainer (§164.308(a)(6)), and direct OCR audit response support. Priority Global Review Queue with next-business-day SLA — your practitioner sits inside the engagement, not on a ticket queue.
- ✓Everything in Aegis Guided
- ✓Quarterly risk assessments and BAA reviews
- ✓Incident response retainer (§164.308(a)(6))
- ✓Direct OCR audit response support
- ✓Priority Global Review Queue (next-business-day SLA)
Built for the moment OCR shows up. Every HIPAA artifact signed by a named practitioner, hashed at server-side ingest, anchored to an RFC 3161 timestamp, and verifiable independently of Key 102.
- ✓Everything in Aegis Managed
- ✓Recipient-verifiable Master Audit Report (SHA-256 + Report ID)
- ✓Public verify endpoint independent of Key 102 clock/database
- ✓RFC 3161 TSA anchor on every report
- ✓Practitioner Sign & Seal embedded in tier
Vault
PCI-DSS v4.0.1 evidence collection, SAQ assistance, and AoC readiness.
PCI v4.0.1 task library + evidence vault, calibrated for all 51 future-dated requirements now mandatory under v4.0.1. SAQ-A through SAQ-D applicable. Foundation tier — upgrade path delivers QSA-grade recipient-verifiable AoC.
- ✓Full PCI v4.0.1 task library (Requirements 1–12, all future-dated controls in scope)
- ✓SAQ-A / SAQ-D guidance and templates
- ✓Evidence vault with hash-chained audit log
- ✓ASV scan tracking and reminders
- ✓Up to 5 user seats
Vault Self-Service + SAQ-D walkthrough, quarterly ASV scan review, annual penetration test scoping, and Cardholder Data Environment mapping. Your practitioner walks Req 1–12 with you before submission.
- ✓Everything in Vault Self-Service
- ✓SAQ-D walkthrough and submission assistance
- ✓Quarterly ASV scan review with consultant
- ✓Annual penetration test scoping
- ✓Cardholder Data Environment (CDE) mapping support
Year-round PCI v4.0.1 evidence collection with practitioner + customer two-party AoC attestation. QSA gets a redacted external-share variant with byte-level hash; auditor gets the full canonical bundle. Both verify themselves against the same source of truth.
- ✓Everything in Vault Guided
- ✓Year-round evidence auditing
- ✓Tier 2 PCI Deliverable — signed PDF bundle of SAQ-D + AoC with practitioner + customer two-party attestation
- ✓External-share redacted variant for QSA/acquirer handoff (evidence excerpts kept internal)
- ✓QSA-handoff-ready bundle and pre-audit dry-runs
- ✓Grade-1 server-mediated upload for in-scope evidence
Built for the moment your QSA reviews the submission. Tier 2 PCI Deliverable cover-stamped + byte-hashed, with an external-share redacted variant the QSA hits via independent verify endpoint. Acquirer sees the same canonical hash. No vendor-trust required.
- ✓Everything in Vault Managed
- ✓Tier 2 PCI Deliverable — cover-stamped + byte-hashed + external-share variant, each independently verifiable
- ✓Recipient-verifiable AoC + Master Audit Report (SHA-256 + Report ID)
- ✓Public verify endpoint independent of Key 102 clock/database
- ✓RFC 3161 TSA anchor on every report and AoC
- ✓QSA-direct verification page on every audit-facing PDF
Fortress
CMMC 2.0 Level 2 (Advanced) on NIST SP 800-171 Rev. 2.
CMMC 2.0 Level 2 starting block — NIST 800-171 Rev. 2 task library (110 controls, 14 families), SPRS calculator + submission, SSP template, POA&M tracker. Foundation tier — upgrade path delivers full RP-signed deliverables.
- ✓NIST 800-171 Rev. 2 task library (110 controls, 14 families)
- ✓SPRS score calculator and submission guidance
- ✓System Security Plan (SSP) template and drafting support
- ✓Plan of Action and Milestones (POA&M) tracker
- ✓Quarterly readiness reports
Full CMMC L2 SSP management with practitioner sign-off. C3PAO pre-audit readiness assessment, POA&M management, C3PAO-handoff-ready bundle. Your practitioner owns the SSP — not a template.
- ✓Everything in Fortress Guided
- ✓Full System Security Plan management (drafting, review, updates)
- ✓C3PAO pre-audit readiness assessment
- ✓Practitioner review and sign-off
- ✓C3PAO-handoff-ready bundle
DoD-assessor-grade CMMC deliverables. Practitioner sign-off, RFC 3161 TSA anchor on every SSP / POA&M / SPRS revision, public C3PAO verification page on every assessor-facing PDF. The assessor verifies you without asking us anything.
- ✓Everything in Fortress Managed
- ✓Recipient-verifiable SSP, POA&M, and Master Audit Report
- ✓SHA-256 + Report ID on every PDF; public verify endpoint
- ✓RFC 3161 TSA anchor on every report — DoD assessor-grade proof
- ✓Practitioner Sign & Seal embedded in tier
- ✓C3PAO-direct verification page on every assessor-facing PDF
Nexus
TSA Security Directive 1580/82, FMCSA, and Pipeline Safety cybersecurity.
TSA SD-1580/82 + FMCSA + PHMSA task libraries, Tammie AI advisor (Logistics-tuned), and 2 monthly Consultant Review hours. Mission Brief's TSA-aligned artifact on a recurring cadence — incident playbook stays current with the 72-hour clock.
- ✓TSA SD-1580/82 incident reporting templates
- ✓FMCSA cybersecurity baseline checklists
- ✓PHMSA Pipeline Safety control library
- ✓Tammie AI advisor (Logistics-tuned)
- ✓2 Consultant Review hours per month
Outsourced Cybersecurity Coordinator embedded in your TSA / FMCSA / PHMSA operations. Priority Global Review Queue (next-business-day SLA), TSA incident response coordination, quarterly regulator-ready summary reports. When the 72-hour clock starts, your coordinator's already on the line.
- ✓Everything in Nexus Guided
- ✓Outsourced Cybersecurity Coordinator
- ✓Priority Global Review Queue (next-business-day SLA)
- ✓TSA incident response coordination
- ✓Quarterly regulator-ready summary reports
TSA / FMCSA / PHMSA-grade regulator deliverables. Practitioner sign-off on every incident summary, RFC 3161 TSA anchor on every report, public verify endpoint on every regulator-facing PDF. When the 72-hour clock ends, your submission is already verified.
- ✓Everything in Nexus Managed
- ✓Recipient-verifiable incident summaries + Master Audit Report
- ✓SHA-256 + Report ID on every PDF; public verify endpoint
- ✓RFC 3161 TSA anchor on every report — regulator-grade proof
- ✓TSA-aware practitioner Sign & Seal embedded in tier
- ✓Direct verification page on every regulator-facing PDF
Start with a Mission Brief — $674
Diagnostic engagement with Tammie and a practitioner. We map your scope, identify control gaps, and deliver your regulator-ready artifact — HIPAA SRA, PCI SAQ-D, CMMC Level 1 SPRS affirmation, or Logistics SD-1580 alignment. Credit converts 1:1 into any annual subscription within 14 days.
Four levels of practitioner involvement.
Portal access, full task library, evidence vault, and audit log. Your team operates the framework end-to-end. Practitioner support is available via the Global Review Queue when needed.
2 Consultant Review hours per month, Tammie AI advisor tuned to your framework, and quarterly readiness reports with practitioner sign-off. Your team executes; we validate.
Concierge engagement with monthly assessments, direct regulator liaison, and priority Global Review Queue (24-hour SLA). We operate the framework on your behalf; you attest.
Managed-grade delivery plus recipient-verifiable PDFs. Every Master Audit Report, AoC, and SSP carries a SHA-256 and Report ID resolvable against Key 102's public verify endpoint — independent of any link, email, or trust in our clock or database. The auditor self-services attestation. See it on our own: portal.key102consulting.com/verify/sprs/SPRS-L1-2026-CXH6GR.