Self-hosted · Annual license
Simple, transparent pricing
One self-hosted tool that keeps your CUI in your enclave and your CMMC evidence assessor-ready. Start free — pay when you're ready.
All plans billed annually (USD). Free 14-day evaluation — no credit card.
Starter
For a single site getting assessment-ready.
billed annually
- 1 enclave (one deployment)
- Up to 50 endpoints/users
- Log ingestion + automatic mapping to NIST 800-171 / CMMC controls (AC, AU, IA)
- Detection rules with alerts (email/webhook)
- Cryptographically signed, verifiable evidence bundles
- Email support
Professional
For growing contractors — where most small and midsize DIB teams land.
billed annually
- Everything in Starter, plus:
- Up to 200 endpoints/users
- Higher log volume and retention
- Priority support
Enterprise
For larger or multi-site operations.
custom
- Everything in Professional, plus:
- 250+ endpoints/users
- Multi-enclave / multiple deployments
- Custom log retention
- Service-level agreement (SLA)
- Onboarding & validation included
Optional
Onboarding & validation call
A guided setup and configuration-review session to get you running and aligned to your assessment. From $500. Included with Enterprise.
Every plan is self-hosted — Attestor runs in your own environment and covers the audit logging, monitoring, and evidence side of CMMC. Pair it with your other controls (and your GRC tool, if you use one) for full coverage.
See how Attestor compares · Read the CMMC audit logging guide
Frequently asked questions
Try it on your own logs first.
Prices in USD, billed annually. Endpoint/user bands are guidelines — contact us if you're between tiers.