Services / Readiness Retainer

Sustain · Past Clients Only

Your SPRS number, never stale

For past Lumos clients whose documentation is built — and who know that readiness decays the day maintenance stops.

Ask About Retainer Space Past clients only

The Retainer is sold only to past clients — it maintains documentation Lumos knows. New to Lumos? Start with the Snapshot or Sprint.

$1,500–$3,000/mo

Annual agreement · tier by environment

Quarterly

A fixed three-month rhythm

Capped list

Capped at six retainer clients

Annual affirmation with a stale number is exposure

Your SPRS affirmation is an annual legal statement, but your environment changes weekly — staff turn over, systems get replaced, evidence ages out. Annual SPRS affirmation is a False Claims Act exposure when the number is stale. The retainer exists so your number is never stale.

It's a fixed quarterly rhythm, not an on-call hourly arrangement: evidence refreshed, POA&M moved, changes reviewed — every quarter, on schedule — with your annual affirmation supported when it comes due.

The quarterly rhythm

Month 1 — Evidence refresh

The evidence index walked, aging artifacts re-collected, owners nudged — so "show me" always has a current answer.

Month 2 — POA&M working call

Open items reviewed with your team, milestones moved or closed, new gaps captured before they calcify.

Month 3 — Change review

Environment changes assessed for SSP impact and the score recalculated — so when your annual affirmation comes due, it's backed by current evidence, not last year's.

Always — Priority access

Contract questions, flow-down clauses, "does this change our scope?" — answered by the practitioner who maintains your documentation.

Pricing tiers — by environment and assessment year, fixed for the annual term

$1,500/mo Standard — single enclave, stable environment, Lumos-built documentation throughout

$2,500–$3,000/mo Multi-enclave or assessment-year — more environments to keep current each quarter

Assessment-year retainers add a mini mock review 60–90 days before your assessment date.

What’s included — and what isn’t

Included

Everything in the quarterly rhythm

Evidence refresh, POA&M management, change review, a quarterly status memo, annual SPRS re-affirmation support, and email access for quick questions.

Included

Annual affirmation support

SPRS re-affirmation support when your anniversary comes due — and on the assessment-year tier, a mini mock review 60–90 days before your assessment date.

Excluded

Technical implementation

Your IT staff or MSP performs system changes — the retainer defines and verifies the work, never executes it.

Excluded

Major rebuilds

An acquisition, a new enclave, or a scope change big enough to need Module-scale work is quoted separately — at retainer-client rates, stated before work starts.

Is the Retainer available to you?

The Retainer is for:

✓ Past Lumos clients with completed documentation engagements
✓ Contractors who affirm SPRS annually and want each affirmation current
✓ Teams without internal staff to own quarterly compliance upkeep
✓ Organizations holding readiness while waiting on a C3PAO slot

Not available for:

✗ New clients — the retainer maintains documentation Lumos knows; start with the Snapshot or Sprint
✗ Organizations wanting on-call hourly consulting — this is a fixed rhythm, not a meter
✗ Organizations wanting Lumos to perform the formal assessment — a C3PAO must do that
✗ Looking for hands-on technical implementation — your IT staff or MSP performs that work

Lumos is a solo practice led by a Cyber AB Registered Practitioner providing readiness advisory and documentation only — formal CMMC assessments are conducted by certified C3PAOs, and technical implementation is performed by your IT staff or MSP. CMMC readiness consulting is generally an allowable cost under FAR 31.205-33; confirm with your contracts team.

CISSP · ISSEP · CCSP · CSSLP · CISA · CISM · PMP Cyber AB Registered Practitioner 28 NIST engagements since 2017 Veteran & Native Hawaiian-Owned

Where this leads

The Retainer is the last stop on the pathway — it keeps everything before it current. The client list is capped so every quarter happens on schedule; if the list is full, you’ll be told plainly and offered the waitlist.

Sprint / Snapshot Gap Analysis Module A Module B Module C Readiness Review Retainer

← Previous step: C3PAO Readiness Review

Questions about this engagement

Why past clients only? +

Because maintaining documentation responsibly requires knowing it. Inheriting a stranger’s SSP at $1,500/month is how upkeep becomes rubber-stamping — and a rubber-stamped affirmation is the exposure this service exists to prevent.

Why is the client list capped? +

Each client gets a real quarterly cycle from one practitioner. The cap is six retainer clients — the number that keeps every cycle on schedule. When it's full, that's stated plainly and the waitlist is the honest answer.

What if we have an incident or an urgent contract question mid-quarter? +

Included email access covers quick questions and advisory direction. Work beyond advisory scope — a new enclave design, a major SSP revision — is quoted separately before anything starts.

Can we pause or cancel? +

The agreement is annual because readiness maintenance only works as a rhythm — skipping quarters defeats the purpose. At renewal, you decide with a year of quarterly memos to judge by.