Transparent pricing for every path to FedRAMP 20x.
Per product offering, per year. Baseline pricing sits below tool-only providers — and includes what they sell as add-ons.
Prices are per product offering, per year. Class C — all KSIs, 14-day package refresh, two independent automated methods per KSI, quarterly review.
20x Governance + ConMon
Certification package and continuous monitoring deliverables
- Security Decision Record (SDR) with KSI metrics
- Certification Package Overview (CPO)
- Vulnerability Evaluation & Reporting (VER)
- Vulnerability Detection & Response (VDR)
- KSI dashboard — 46 indicators, evidence drill-down
- Ongoing Certification Report (OCR) every 3 months
- FedRAMP-compliant Trust Center
- FedRAMP JSON + OSCAL exports
Platform modules (optional)
Add automation depth for your chosen outcomes
+ Managed Security · the operations
Total
Complete certification package, continuous monitoring deliverables and the platform modules you selected.
Estimates are indicative and assume a US government-cloud or commercial cloud environment. Final pricing is scoped after the Readiness Assessment. Custom configurations are quoted individually.
What's included at every class
In every 20x Governance subscription
- Evidence & KSI Engine — 46 KSIs, two independent automated methods each (Class C), 15-minute cycle
- Security Decision Record with one year of daily metrics
- Certification Package Overview, VER and VDR deliverables
- Ongoing Certification Report every three months
- Trust Center — public and agency tiers, branded to you, hosted in your tenant
- FedRAMP JSON + OSCAL exports, validated against the published schemas
- Platform onboarding — tenant connection, collector identities, branding
Optional modules
- Scan & tool integration — ingest third-party scanners and tools alongside your cloud-native scanner
- Extended collectors — connectors beyond the out-of-the-box set, with their own validators
- Risk evaluation & VER automation — risk-based remediation deadlines, exploitability and reachability scoring
- Managed Security — Triad operates it all, $10,000–$25,000/mo by complexity
Pricing questions
Why does pricing rise with certification class?
Higher classes bring every KSI into scope, require more independent automated methods per indicator, and shorten the package refresh cadence to two weeks (Class C) or one week (Class D). More collectors run, more validators execute, and more evidence is retained.
What does "one product offering" mean?
One cloud service offering brought through certification and continuous monitoring. Portfolios with several offerings are quoted individually — the shared Secure Environment and collectors usually make the second offering substantially cheaper than the first.
Is the Readiness Assessment really credited?
Yes. The full $5,000 credits toward 20x Governance, Secure Environment or Managed Security that starts within 90 days of the report.
Why is Secure Environment a custom quote?
Building a Secure Environment depends on your workloads, regions, existing tooling and data categories. We scope it from the Readiness Assessment findings and return a fixed proposal within five business days.
Prefer to talk it through?
A Triad expert can walk you through the components in 30 minutes.