CMMC Level 2
NIST SP 800-171 Rev 2 · 110 controls
Control matrix, auto-drafted SSP, POA&M, and a continuously computed SPRS score for defense contractors handling CUI.
$4,000 – $12,000Details
Read the guide → The Assessment Factory
Your compliance package, generated from live evidence
One monitored environment feeds every framework. We turn your live telemetry into a readiness package—control matrix, gap-and-remediation report, and framework-specific artifacts—with evidenced controls marked as proven and the rest flagged for attestation. What you hand an auditor is honest and defensible.
Seven frameworks, one engine
Readiness packages & indicative pricing
Fixed-fee engagements sized to small and mid-sized businesses. Final scope is set after a short discovery call; a second framework for the same client is roughly half the base fee.
HIPAA Security Rule
45 CFR Part 164 · 60 safeguards
Administrative, physical, and technical safeguards mapped from live telemetry—evidence for your risk analysis and audit controls.
$3,500 – $9,000Details
Read the guide →Legal / OCG
ACC Model Controls · ABA 1.6(c)
The outside-counsel security baseline: answer client questionnaires and insurance attestations with an evidenced control record.
$3,000 – $7,500Details
Read the guide →NYDFS 500
23 NYCRR 500 (Second Amendment)
The prescriptive New York cybersecurity requirements for financial-services and insurance firms, section by section.
$4,000 – $10,000Details
Read the guide →NAIC #668
Insurance Data Security Model Law
Logging-persistence and program evidence for insurers, with an underwriting-tier signal you can hand to a carrier.
$2,500 – $6,000Details
Read the guide →SOC 2
AICPA Trust Services Criteria
Readiness against the Trust Services Criteria—know exactly which controls are evidenced before your CPA-firm examination.
$4,000 – $12,000Details
Read the guide →ISO 27001
ISO/IEC 27001:2022 Annex A
Annex A readiness across all 93 controls, so you enter your accredited-body certification audit prepared.
$4,500 – $12,000Details
Read the guide →Ongoing monitoring retainers run $500–$2,500/month depending on size and framework count, and keep your evidence current between assessment cycles. Add-on evidence packages (audit-integrity attestation, continuous-monitoring proof, incident timelines) are available from $500.
What every package includes
- Control-by-control assessment matrix
- Evidenced vs. attestation-required, clearly marked
- Gap & remediation report, prioritized
- Framework-specific artifacts (SSP / POA&M where applicable)
- Named, timestamped evidence artifacts
- Hash-chained audit trail an assessor can verify
Readiness, not certification. MDRwatchdog provides security monitoring and evidence to support your compliance program. It does not issue certifications and is not legal advice. Certification and formal audits are performed by the appropriate authorized bodies—a C3PAO for CMMC, a licensed CPA firm for SOC 2, an accredited body for ISO 27001. We get you ready and keep you ready.
Common questions
What is the Assessment Factory?+
It is the capability that turns your live monitoring into a compliance readiness package. One monitored environment feeds every framework, so the same evidence supports CMMC, HIPAA, NYDFS, NAIC, SOC 2, ISO 27001, and the legal / OCG baseline. You get a control matrix, a gap-and-remediation report, and framework-specific artifacts.
Is a readiness package the same as certification?+
No, and we are careful about this. A readiness package prepares you and evidences your controls. It is not certification. CMMC Level 2 is certified only by an authorized C3PAO; a SOC 2 report is issued only by a licensed CPA firm; an ISO 27001 certificate only by an accredited body. HIPAA and NYDFS compliance is determined by your organization, its assessor, and counsel.
How is the evidence different from a consultant's spreadsheet?+
Controls the platform can prove from live telemetry are marked as evidenced and backed by named, timestamped artifacts; the rest are flagged for attestation. The underlying audit trail is hash-chained and independently verifiable. You are handing an assessor a record you can defend, not a self-graded checklist.
Why is this priced below the market?+
The broader market charges $250–$400 per hour for consultants and tens of thousands for a full readiness engagement. Because our packages are generated from monitoring you are already running, we deliver readiness and evidence at a fixed fee well below that—then keep it current with ongoing monitoring.
Can one client run more than one framework?+
Yes, and it is efficient. Because one monitored estate feeds every framework, a second framework for the same client is roughly half the base fee—for example a firm serving healthcare clients running Legal plus HIPAA, or an insurer running NYDFS plus NAIC.
Find out which framework you're closest to passing.
Book a 15-minute review and we'll map your environment to the frameworks that matter for your business.
Schedule your 15-minute review