CMMC L2 — Grand Slam offer
CMMC L2 ready in 90 days for $35,000 — or you don’t pay.
Fixed-fee, founder-delivered, max 3 concurrent engagements per quarter. We sit in your environment with you for 90 days and walk out with a Prime-ready evidence binder.
$35,000 fixed
Single all-in price. No retainer. No hourly. No surprise line items at week 8.
Pass-or-Free guarantee
Three guardrails. Plain language. Same scroll as the price.
If you fail your C3PAO assessment within 12 months of engagement close, we refund 100% of the $35,000 and work with you free until you pass — provided the conditions below.
- G1
POA&M adherence
Client completes every POA&M item by its documented target date, with evidence logged in the Xpoose Portal. Failure to do so voids the guarantee, with refund prorated to hours delivered.
- G2
C3PAO pre-approval
Assessment must be performed by a C3PAO from Xpoose's published approved list, or pre-approved by Xpoose in writing at least 30 days before the assessment. We commit to a 5-business-day review of any non-list C3PAO request.
- G3
Sign-off milestones
Client provides written acceptance of SSP, policy pack, and enclave deployment at milestones 30 / 60 / 90. Acceptances not returned within 15 business days — after a second notification by email and Portal — are deemed accepted.
Value stack
What’s in the $35,000.
The Grand Slam is the engagement plus everything below. Every line is delivered — not “available for an additional fee.”
- $35,000
CMMC L2 readiness engagement
90-day fixed-fee delivery, founder-led
- $1,500
Prime-Facing Evidence Binder
- $2,000
Quarterly POAM Refresh (year 1)
- $1,200
Xpoose Method Playbook Library (12 mo)
- $3,000
Emergency CUI Incident Hotline (12 mo)
- $5,000
Referral-Earn Credit ($5k per qualified referral)
- Total stacked value$52,200
The 90-day process
Days 1 to 90.
Days 1-30
Discovery + SSP
On-site (or virtual) kickoff. Asset inventory, identity audit, current-state controls map. SSP draft 1 by day 30 — signed off by you, not us.
Days 31-60
Hardening + enclave
Policies, technical controls, CUI enclave stand-up via PreVeil. Evidence-collection automation lands so day-90 audit isn't a fire drill.
Days 61-90
POA&M + assessment-ready
Tabletop drills, control validation, prime-facing evidence binder. Day-90 deliverable: a C3PAO can walk in and assess. We sit with you through the assessment.
Pass or Free
What “Pass-or-Free” actually means.
Full refund + free work until passing C3PAO within 12 months, conditional on POAM compliance and Xpoose-vetted C3PAO selection
Why we publish the conditions
Every Pass-or-Free claim in the wild is a marketing line with hedges in microprint. Ours has three plainly-named guardrails (G1 / G2 / G3 above) on the same scroll as the price. If you read them and they don’t match how you’d run the engagement, this isn’t a fit — and the Exposure Call is where we figure that out.
Ready when you are.
Slot capacity is hard-capped at 3 concurrent engagements per quarter. We start by mapping your actual gap before either of us commits to a date.