The tools build your compliance program.
Our advisory hours make sure it's built right.
Every Globe-America engagement combines browser-based compliance tools — purpose-built for small defense contractors — with live advisory input from a CMMC Registered Practitioner. The tools handle the documentation work: SPRS scoring, policy generation, procedure writing, evidence tracking. The advisory hours handle the judgment work: interpreting your results, making the calls a tool cannot make, and ensuring your compliance program holds up under scrutiny.
Every engagement is structured around the GARD Framework — Govern the boundary, Align evidence, Reinforce implementation, Defend the assessment. This document outlines what advisory hours are included at each tier, what they cover, and how the retainer structure works for ongoing oversight clients.
Where the Program Stands Right Now
CMMC Phase 2 is suspended. On July 13, 2026, the Department suspended Phase 2, which would have required Third-Party Assessment for most CUI contracts. A CMMC Reform Task Force is reviewing the program. Phase 1 remains fully in force — Level 1 (Self) and Level 2 (Self) requirements still appear in applicable solicitations and contracts, and 32 CFR Part 170 is unchanged.
This changes timing, not obligations. Everything a contractor must implement under NIST SP 800-171 is unchanged. What moved is the date an external assessor arrives. Prime flow-down obligations did not change, and the Department retains the right to conduct a Medium or High DIBCAC / Government Assessment under DFARS 252.240-7997 at any time.
Engagement structure is unaffected. The work below is sequenced to build a defensible position regardless of who eventually verifies it. Readiness & Governance remains a three-year cycle; what shifts is which year carries the external assessment, and that is scoped during the consultation against your actual contract dates.
Required first step
Every engagement starts with a consultation. No exceptions.
Engagements are not available for direct purchase. Before any engagement is scoped or priced, we meet for an initial advisory consultation to review your contracts, confirm whether you are Level 1 or Level 2, and establish what your environment actually requires.
This protects you more than it protects us. A one-time foundation engagement and an ongoing oversight retainer solve different problems at different price points, and which one fits depends on facts we do not have yet — your information type, your boundary, your contract timeline, and what is already implemented. Recommending an engagement before that conversation would mean guessing with your budget.
Step 01
Consultation
We read your contract clauses together, confirm your level, and size the real scope of work.
Required
Step 02
Scoped proposal
You receive a written recommendation with a fixed price, based on what the consultation found.
Step 03
Engagement begins
Your tools unlock, advisory hours are scheduled, and your consultation fee is credited in full.
Step 04
Assessment ready
You reach a defensible position with the documentation and evidence an assessor will ask for.
G
Govern the Boundary
Contract review, CUI scope, asset inventory, and ownership. Scoping errors invalidate everything downstream, so this comes first.
A
Align Evidence
SSP, policies, procedures, and artifacts mapped to the requirements that call for them — documentation that matches reality.
R
Reinforce Implementation
Controls verified operational, gaps remediated, POA&M sequenced by point value and contract timeline.
D
Defend the Assessment
Evidence tested, personnel prepared to explain implementation, and a realistic go/no-go before anyone external arrives.
Engagement Structure
Advisory Hours by Engagement
Every engagement begins with a consultation. Advisory hours are then included in the engagement itself — not add-ons. Hours are scoped to deliver the guidance that moves your compliance program forward at each stage.
Prerequisite An initial advisory consultation is required before this engagement can be scoped or purchased.
Book it here →
Bronze
Compliance Foundation
One-time engagement · 12-month delivery window · Advisory hours annual (use or lose)
$15,000 – $32,000
One-time fee
Advisory Hours Included
- Kickoff and scope review session
- SPRS score review and gap prioritization
- SSP boundary and CUI scoping session
- Policy review and sign-off
- Compliance roadmap walkthrough
- POA&M review and sequencing
- Email support throughout engagement
Tools Included
SPRS Score Calculator
POA&M Builder
Compliance Roadmap Builder
Core Policy Set Generator
SSP Scope & Intake Tool
POA&M Closeout Tracker
Advisory hours are 8–12 per year, use or lose. Hours validate tool output and make the judgment calls your environment requires — whether a partial implementation counts as met, how to prioritize gaps given your contract timeline, and what an assessor is most likely to scrutinize.
Prerequisite An initial advisory consultation is required before this engagement can be scoped or purchased.
Book it here →
Silver
Readiness & Governance
3-year readiness cycle · Paid in annual thirds · Assessment preparation & maintenance
$52,000 – $72,000
3-year cycle · billed annually
Advisory Hours Included
- All Compliance Foundation sessions, plus:
- CUI scoping deep-dive workshop
- Contract clause review for your contracts
- RACI and control ownership workshop
- Evidence review and gap sessions
- Procedure review against your tool stack
- Staff interview prep and mock Q&A
- Assessment readiness go/no-go call
Tools Included
Contract Compliance Decoder
CUI Scoping Wizard
Policy Gap Checker
Evidence Tracker
RACI / Control Ownership Builder
Procedure Builder
CMMC Hot Seat
Advisory hours are 16–24 per year, use or lose across the three-year cycle. Year 1 focuses on readiness and evidence development. Year 2 covers annual affirmation and maintenance. Year 3 covers re-verification prep and mock assessment. Each year is invoiced separately at its phase rate, and the sequencing is set against your contract dates during the consultation.
Prerequisite An initial advisory consultation is required before this engagement can be scoped or purchased.
Book it here →
Gold
Continuous Compliance Oversight
Monthly retainer · 12-month minimum · Advisory hours quarterly (use or lose)
$5,000 – $12,000
Per month
Advisory Hours Included
8 – 20
hours per quarter
by plan
- Quarterly compliance posture review call
- POA&M status review and prioritization
- Policy and procedure update support
- Subcontractor compliance oversight
- On-call incident response advisory
- Annual SPRS affirmation support
- Re-verification prep ahead of any assessment window
- Ad hoc questions via email and phone
Tools Included
Executive Compliance Dashboard
Defense Mock Assessment
SSP Builder Assistant
Supply Chain Tracker
Compliance Calendar
CMMC Hot Seat
Oversight clients get a live compliance posture view at all times and a dedicated advisor who knows their environment. The tools keep the program current; the advisory hours keep it accurate and defensible as regulations, contracts, and environments change.
Continuous Compliance Oversight — Retainer Plans
Three Retainer Levels — Match Your Stage
Within Continuous Compliance Oversight, choose the plan that matches your current activity level. Plans can be adjusted quarterly as your situation evolves.
| Plan |
Monthly Fee |
Hours Included |
Best For |
Overage |
|
Standard
Steady-state maintenance
|
$5,000/mo |
8 hrs/qtr |
Clients in stable environments with controls implemented, documentation current, and a strong SPRS score. Eight advisory hours per quarter (use or lose) focused on maintaining posture, annual affirmation, and quarterly posture review calls. |
$350/hr |
|
Active
Remediation or assessment prep
|
$8,500/mo |
14 hrs/qtr |
Clients actively remediating POA&M gaps, approaching an assessment window, or managing supply chain compliance obligations. Fourteen advisory hours per quarter (use or lose) — higher cadence for active remediation and preparation phases. |
$325/hr |
|
Executive
Complex or multi-system environments
|
$12,000/mo |
20 hrs/qtr |
Prime contractors managing subcontractor compliance, complex multi-system CUI environments, or clients requiring priority access. Twenty advisory hours per quarter (use or lose) — includes priority scheduling and executive-level advisory availability. |
$300/hr |
What Advisory Actually Means
Tools vs. Advisory — Understanding the Difference
What Advisory Hours Do
- Determine whether a partial implementation counts as met given your specific environment
- Review your output and validate it against what assessors actually look for — not just what is on paper
- Answer the "what does this clause actually require from my company specifically" questions
- Coach your staff on how to respond when an assessor interviews them
- Give you a realistic go/no-go on readiness before you pay for an assessment
- Stay current on regulatory changes and tell you what they mean for your program
Not sure which one fits? That is what the consultation is for.
Come with your contract and your questions. You will leave knowing which level applies to you and what the work actually involves, whether or not you engage us afterward.