Replace $150,000 of consulting with a monthly subscription.
Three plans for three audiences: Level 1 self-assessors, Level 2 CUI handlers, and MSPs running portfolios. No setup fees, no per-control charges, no surprise invoices.
Level 1 — FCI
Annual self-assessment for FCI-only contractors
- 17 FAR 52.204-21 safeguards
- Annual self-assessment workflow
- Affirmation export for SAM/SPRS
- Up to 5 users
- Email support
Level 2 — CUI
Full 110-control program for CUI handlers
- All 110 NIST 800-171 controls
- AI SSP + 14 policies
- Evidence locker + POA&M tracker
- C3PAO auditor handoff
- Up to 25 users
- Priority support
MSP Console
For service providers managing multiple clients
- Everything in L2, per client
- Multi-client dashboard, audit-logged
- White-label branding & sender
- Starter: 3 clients · Pro $449: 10 clients · Enterprise $1,299: 25 clients
- Annual billing saves 2 months
- Partner program eligibility
Prices in USD. Billed monthly unless otherwise stated. Stripe-backed checkout; cancel any time.
What's in each plan.
The free assessment is a lead magnet, not a free tier — it returns a score range and your top problem domains, then stops. The full platform is a 14-day trial, then a paid plan. We don't offer a permanent free tier; the artifacts the wizard produces replace five-figure consulting work.
| Capability | Free assessment | L1 — FCI ($149) | L2 — CUI ($499) | MSP ($799) |
|---|---|---|---|---|
| Account | No account | Up to 5 users | Up to 25 users | Operator + 3 client orgs |
| SPRS score | Range estimate (no exact figure) | Live exact score | Live exact score | Per-client live score |
| Active CMMC controls | 10-question subset | 17 (FAR 52.204-21) | 110 (NIST 800-171) | 110 per client |
| AI SSP generation | Preview only (blurred) | Full SSP, editable + DOCX export | Per-client, white-label | |
| Policy library | 3 core policies | 14 policies, editable + versioned | 14 per client, white-label | |
| Evidence locker | ✓ SHA-256, CUI marking | Per-client isolated | ||
| POA&M tracker | Basic gap list (no owners/dates) | Full POA&M + owners + digests | Per-client, consolidated view | |
| People / Process / Physical / Interview prep | Per-client | |||
| C3PAO auditor handoff | ✓ Time-boxed token + hash-chain | Per-client tokens | ||
| Export | SPRS gap PDF | Affirmation export only | Full audit package ZIP | Per-client, white-label |
| Data retention | None — no account | 1 year | 3 years (one triennial cycle) | 3 years per client |
| Support | Self-serve | Priority email + chat | Dedicated partner manager |
Two access modes that aren't sold as plans.
Cincra has four portals in total. The three plans above cover the two paying audiences — contractors and MSPs. The other two portals are access modes, not products you buy.
Free, by invitation only.
When a contractor or MSP is ready for assessment, they issue a time-boxed, read-only handoff token to their RP, RPO, CCP, CCA, or C3PAO. Auditors sign in at /auditor and see only what the contractor scoped — evidence, SSP, POA&M, hash-chained audit log. No subscription, no card. Auditors never pay Cincra.
Cincra staff only.
/admin is the internal console used by Cincra's own team to operate the platform — tenant health, GovCloud readiness, support escalations. Customers don't get access; it isn't a tier of any plan.
A traditional CMMC L2 consulting engagement is $80K–$250K.
That's before remediation, before the C3PAO fee, before annual maintenance. Cincra L2 is $499/mo — under $6,000/year — and the artifacts you produce belong to you, not the consultant.