Advisory Services Overview
Engagement Structure & Advisory Hours · Defense Industrial Base & Federal Contractors
Globe-America Consulting, Inc. · SDVOSB · Dallas-Fort Worth, TX · 2026
The tools build your compliance program.
Our advisory hours make sure it's built right.
Our advisory hours make sure it's built right.
Every Globe-America engagement combines purpose-built federal cybersecurity compliance tools with practitioner-led advisory support. The tools handle repeatable compliance work such as scoping, documentation, evidence tracking, control ownership, remediation planning, and readiness monitoring. Our advisory services provide the judgment technology cannot: interpreting contract requirements, validating implementation, resolving scope decisions, prioritizing risk, and determining whether your compliance position can withstand scrutiny.
For Defense Industrial Base contractors, we apply this model to DFARS, SPRS, NIST SP 800-171 and CMMC. For the broader federal contractor market, we apply it to CUI, NIST SP 800-171, FAR requirements, and agency-specific cybersecurity obligations.
Every engagement is structured around the Cyber G.A.R.D.™ Framework: Govern the boundary, Align evidence, Reinforce implementation, Defend the assessment. This document outlines what advisory hours are included at each tier, what they cover, and how the retainer structure works for ongoing oversight clients.
For Defense Industrial Base contractors, we apply this model to DFARS, SPRS, NIST SP 800-171 and CMMC. For the broader federal contractor market, we apply it to CUI, NIST SP 800-171, FAR requirements, and agency-specific cybersecurity obligations.
Every engagement is structured around the Cyber G.A.R.D.™ Framework: Govern the boundary, Align evidence, Reinforce implementation, Defend the assessment. This document outlines what advisory hours are included at each tier, what they cover, and how the retainer structure works for ongoing oversight clients.
Who This Applies To
Two markets. One model.
Defense Industrial Base
Department of War primes and subcontractors
You hold or pursue contracts carrying DFARS 252.204-7012, 252.204-7021, or 252.240-7997. Your requirements are CMMC Level 1 or Level 2, a SPRS score affirmed by a senior official, and a defensible System Security Plan and POA&M. The tools calculate your SPRS score using the Department's own assessment methodology, and the advisory hours prepare you for the self-assessment, the prime's due diligence, and any Third-Party or Government Assessment that follows.
Broader Federal Contractor Market
Contractors to civilian agencies and their primes
You handle Controlled Unclassified Information for a civilian agency, you carry FAR safeguarding or agency-specific cybersecurity clauses, or you are a supplier to a prime that flows NIST SP 800-171 down the chain. There is no SPRS score to post, but the same 110 requirements, the same boundary decisions, and the same evidence questions apply. The tools produce a readiness score and the same SSP, policy, and evidence package; the advisory hours map your obligations to the contract and agency that created them.
Not sure which market you are in, or whether you are in both? That is one of the first things the consultation settles, and it is why every engagement starts there.
For Defense Industrial Base Contractors: Where the CMMC Program Stands Right Now
CMMC Phase 2 is suspended. On July 13, 2026, the Department suspended Phase 2, which would have required Third-Party Assessment for most CUI contracts. A CMMC Reform Task Force is reviewing the program. Phase 1 remains fully in force — Level 1 (Self) and Level 2 (Self) requirements still appear in applicable solicitations and contracts, and 32 CFR Part 170 is unchanged.
This changes timing, not obligations. Everything a contractor must implement under NIST SP 800-171 is unchanged. What moved is the date an external assessor arrives. Prime flow-down obligations did not change, and the Department retains the right to conduct a Medium or High DIBCAC / Government Assessment under DFARS 252.240-7997 at any time.
Engagement structure is unaffected, and contractors outside the Defense Industrial Base are not affected at all. The work below is sequenced to build a defensible position regardless of who eventually verifies it: a DoW assessor, an agency reviewer, or a prime. Readiness & Governance remains a three-year cycle; what shifts is which year carries the external assessment, and that is scoped during the consultation against your actual contract dates.
Required first step
Every engagement starts with a consultation. No exceptions.
Engagements are not available for direct purchase. Before any engagement is scoped or priced, we meet for an initial advisory consultation to review your contracts, confirm which requirements actually apply to you (CMMC Level 1 or Level 2 for Defense Industrial Base work, or the FAR, agency, or prime requirement for the broader federal market), and establish what your environment actually requires.
This protects you more than it protects us. A one-time foundation engagement and an ongoing oversight retainer solve different problems at different price points, and which one fits depends on facts we do not have yet — your information type, who is imposing the requirement, your boundary, your contract timeline, and what is already implemented. Recommending an engagement before that conversation would mean guessing with your budget.
This protects you more than it protects us. A one-time foundation engagement and an ongoing oversight retainer solve different problems at different price points, and which one fits depends on facts we do not have yet — your information type, who is imposing the requirement, your boundary, your contract timeline, and what is already implemented. Recommending an engagement before that conversation would mean guessing with your budget.
Book the consultation
60 minutes · With Eddie White, RP-63638
Fee credits toward your engagement
Fee credits toward your engagement
Step 01
Consultation
We read your contract clauses together, confirm what applies, and size the real scope of work.
RequiredStep 02
Scoped proposal
You receive a written recommendation with a fixed price, based on what the consultation found.
Step 03
Engagement begins
Your tools unlock, advisory hours are scheduled, and your consultation fee is credited in full.
Step 04
Assessment ready
You reach a defensible position with the documentation and evidence an assessor, agency reviewer, or prime will ask for.
G
Govern the Boundary
Contract clause review, scope of protected information, asset inventory, network boundary diagram, and ownership. Scoping errors invalidate everything downstream, so this comes first.
A
Align Evidence
SSP, policies, procedures, and artifacts mapped to the requirements that call for them — documentation that matches reality.
R
Reinforce Implementation
Controls verified operational, gaps remediated, POA&M sequenced by point value and contract timeline.
D
Defend the Assessment
Evidence tested, personnel prepared to explain implementation, and a realistic go/no-go before anyone external arrives, whichever agency they represent.
Engagement Structure
Advisory Hours by Engagement
Every engagement begins with a consultation. Advisory hours are then included in the engagement itself — not add-ons. Hours are scoped to deliver the guidance that moves your compliance program forward at each stage.
Prerequisite An initial advisory consultation is required before this engagement can be scoped or purchased. Book it here →
Bronze
Compliance Foundation
One-time engagement · 12-month delivery window · Advisory hours annual (use or lose)
$15,000 – $32,000
One-time fee
Advisory Hours Included
8 – 12
hours
per year
per year
- Kickoff and scope review session
- Readiness score review and gap prioritization (SPRS score for Defense Industrial Base contractors)
- SSP boundary and protected-information scoping session, which produces your network diagram
- Policy review and sign-off
- Compliance roadmap walkthrough
- POA&M review and sequencing
- Email support throughout engagement
Tools Included
SPRS Score Calculator
POA&M Builder
Compliance Roadmap Builder
Core Policy Set Generator
SSP Scope & Intake Tool
Boundary Mapper
POA&M Closeout Tracker
Advisory hours are 8–12 per year, use or lose. Hours validate tool output and make the judgment calls your environment requires — whether a partial implementation counts as met, how to prioritize gaps given your contract timeline, and what an assessor or agency reviewer is most likely to scrutinize.
Your network boundary diagram is built live in the scoping session, not drafted afterward from notes. Asset categories, data flows, and the asset inventory come out of one model, so the diagram and the inventory in your SSP cannot disagree. You keep the source file. Boundary changes after handoff — new cloud services, network expansion, acquisitions — require additional hours or a new engagement, because a diagram that no longer matches your environment is a finding rather than an artifact.
Your network boundary diagram is built live in the scoping session, not drafted afterward from notes. Asset categories, data flows, and the asset inventory come out of one model, so the diagram and the inventory in your SSP cannot disagree. You keep the source file. Boundary changes after handoff — new cloud services, network expansion, acquisitions — require additional hours or a new engagement, because a diagram that no longer matches your environment is a finding rather than an artifact.
Additional hours: $350/hr
One-Time Engagement
Prerequisite An initial advisory consultation is required before this engagement can be scoped or purchased. Book it here →
Silver
Readiness & Governance
3-year readiness cycle · Paid in annual thirds · Assessment preparation & maintenance
$52,000 – $72,000
3-year cycle · billed annually
Advisory Hours Included
16 – 24
hours
per year
per year
- All Compliance Foundation sessions, plus:
- Protected-information scoping workshop (CUI or FCI) with signed boundary gate
- Boundary re-baseline on architecture or scope change
- Clause review across your DFARS, FAR, and agency-specific contract requirements
- RACI and control ownership workshop
- Evidence review and gap sessions
- Procedure review against your tool stack
- Staff interview prep and mock Q&A
- Assessment readiness go/no-go call
Tools Included
Contract Compliance Decoder
CUI Scoping Wizard
Boundary Mapper + Gate Review
Policy Gap Checker
Evidence Tracker
RACI / Control Ownership Builder
Procedure Builder
CMMC Hot Seat
Advisory hours are 16–24 per year, use or lose across the three-year cycle. Year 1 focuses on readiness and evidence development. Year 2 covers annual affirmation (or agency re-attestation) and maintenance. Year 3 covers re-verification prep and mock assessment. Each year is invoiced separately at its phase rate, and the sequencing is set against your contract dates during the consultation.
The boundary is a gate, not a deliverable. Your network diagram is signed off before SSP, RACI, procedure, or evidence work begins, because every artifact downstream inherits the boundary — a scope change discovered in month four otherwise invalidates work already done. Each asset carries forward into control ownership and evidence tracking, so nothing in the inventory is left without an owner or an artifact. The boundary is re-baselined annually and on trigger, which is what 32 CFR 170.19 expects of Defense Industrial Base contractors and what any agency reviewer expects in practice when architecture or scope materially changes.
The boundary is a gate, not a deliverable. Your network diagram is signed off before SSP, RACI, procedure, or evidence work begins, because every artifact downstream inherits the boundary — a scope change discovered in month four otherwise invalidates work already done. Each asset carries forward into control ownership and evidence tracking, so nothing in the inventory is left without an owner or an artifact. The boundary is re-baselined annually and on trigger, which is what 32 CFR 170.19 expects of Defense Industrial Base contractors and what any agency reviewer expects in practice when architecture or scope materially changes.
Additional hours: $325/hr · Year 1: $20–28K | Year 2: $14–20K | Year 3: $18–24K
36-Month Commitment
Prerequisite An initial advisory consultation is required before this engagement can be scoped or purchased. Book it here →
Gold
Continuous Compliance Oversight
Monthly retainer · 12-month minimum · Advisory hours quarterly (use or lose)
$5,000 – $12,000
Per month
Advisory Hours Included
8 – 20
hours per quarter
by plan
by plan
- Quarterly compliance posture review call
- POA&M status review and prioritization
- Policy and procedure update support
- Boundary review on environment or vendor change
- Subcontractor compliance oversight
- On-call incident response advisory
- Annual SPRS affirmation or agency attestation support
- Re-verification prep ahead of any assessment window
- Ad hoc questions via email and phone
Tools Included
Executive Compliance Dashboard
Defense Mock Assessment
SSP Builder Assistant
Boundary Mapper + Change Monitoring
Supply Chain Tracker
Compliance Calendar
CMMC Hot Seat
Oversight clients get a live compliance posture view at all times and a dedicated advisor who knows their environment. The tools keep the program current; the advisory hours keep it accurate and defensible as regulations, contracts, agency obligations, and environments change.
Your boundary diagram stays current. New cloud services, network changes, and vendor additions trigger a boundary review inside the retainer rather than an after-the-fact scramble, so the diagram an assessor sees still describes the network you actually run.
Your boundary diagram stays current. New cloud services, network changes, and vendor additions trigger a boundary review inside the retainer rather than an after-the-fact scramble, so the diagram an assessor sees still describes the network you actually run.
Additional hours: $300–$350/hr, by retainer plan (see below)
Monthly Retainer
Continuous Compliance Oversight — Retainer Plans
Three Retainer Levels — Match Your Stage
Within Continuous Compliance Oversight, choose the plan that matches your current activity level. Plans can be adjusted quarterly as your situation evolves.
| Plan | Monthly Fee | Hours Included | Best For | Overage |
|---|---|---|---|---|
|
Standard
Steady-state maintenance
|
$5,000/mo |
8 hrs/qtr |
Clients in stable environments with controls implemented, documentation current, and a strong readiness or SPRS score. Eight advisory hours per quarter (use or lose) focused on maintaining posture, annual affirmation, and quarterly posture review calls. |
$350/hr |
|
Active
Remediation or assessment prep
|
$8,500/mo |
14 hrs/qtr |
Clients actively remediating POA&M gaps, approaching an assessment window, or managing supply chain compliance obligations. Fourteen advisory hours per quarter (use or lose) — higher cadence for active remediation and preparation phases. |
$325/hr |
|
Executive
Complex or multi-system environments
|
$12,000/mo |
20 hrs/qtr |
Prime contractors managing subcontractor compliance, complex multi-system environments handling protected information, or clients requiring priority access. Twenty advisory hours per quarter (use or lose) — includes priority scheduling and executive-level advisory availability. |
$300/hr |
What Advisory Actually Means
Tools vs. Advisory — Understanding the Difference
What the Tools Do
- Score all 110 NIST SP 800-171 requirements using the Department of War assessment methodology, producing a SPRS score for Defense Industrial Base contractors and a comparable readiness score for the broader federal market
- Generate NIST-aligned policies and procedures customized to your organization
- Track evidence artifacts and show what is ready versus missing
- Build your compliance roadmap with phased milestones and domain priorities
- Run a full mock assessment before anyone external arrives
- Track your supply chain — every sub's score, affirmation, and contact
What Advisory Hours Do
- Determine whether a partial implementation counts as met given your specific environment
- Review your output and validate it against what assessors and agency reviewers actually look for, not just what is on paper
- Answer the "what does this clause actually require from my company specifically" questions
- Coach your staff on how to respond when an assessor or agency reviewer interviews them
- Give you a realistic go/no-go on readiness before you pay for an assessment
- Stay current on regulatory changes and tell you what they mean for your program
Not sure which one fits? That is what the consultation is for.
Come with your contract and your questions. You will leave knowing which requirements apply to you and what the work actually involves, whether or not you engage us afterward.