Compliance Retainer
Continuous compliance control plane.
Who it’s for
Teams with an enterprise deal hinging on SOC 2, or an authorisation boundary they have to keep defensible. Teams with one or two developers who can merge PRs.
It works for commercial SOC 2 and for IL2–IL5 or air-gapped environments, because it is the same control plane either way. The framework changes; the mechanism does not.
We don’t touch business logic. We make platform and compliance boringly predictable.
Baseline
Keep the control plane green
Includes
- One active compliance track at a time
- Monthly async security audit, delivered as PRs
- Critical CVE triage in under 24 hours
- Evidence pipeline maintained
- Quarterly access reviews
- 24h response · Sev 1 in 4h
Does not include
- New infra builds or migrations
- Live auditor calls
- 24/7 on-call
$5,000 /mo
Standard
Baseline, plus an audit you are actively walking into
Everything in Baseline, plus
- Active audit preparation
- SOC 2 evidence pack
- Control mapping
- System security plan (SSP) support
Who moves up to this
- An audit window with a date on it
- An assessor already asking for the evidence pack
$7,500 /mo
Add-on — Compliant RAG
Don’t buy a chatbot — buy a corpus boundary an assessor will believe. Identity-scoped retrieval, separating corpora by construction, inside the impact-level boundary you already have. A retrieval boundary you cannot attest is not a boundary.
| as a project | $12,000 – $25,000 |
|---|---|
| as a retainer add-on | $3,000 /mo |
| requires | CI/CD Foundation |
It requires Foundation because a retrieval boundary you cannot attest is not a boundary — and attestation is what Foundation builds.
The boundary
Anything outside the scope above is quoted separately at $250/hr, four-hour minimum.
That rate exists to be avoided. It is deliberately not a discount on scope creep — if work keeps landing outside the boundary, the honest answer is a project, not an invoice.
What you are actually buying
NIST 800-53 and 800-171 CUI controls codified as infrastructure, not described in a document that drifts from it.
Least privilege as architecture rather than as a memo. Logs, metrics and traces in one queryable store, with evidence export as a first-class output.
How we start
| 1 | $1,500 fixed-fee infra review. One week. You keep the findings either way |
|---|---|
| 2 | The review says whether you need Foundation, the retainer, or neither |
| 3 | Retainer begins. Thirty days’ notice, both directions |