Pricing
Software or full service.
You choose.
Self-manage your compliance program with the platform, or let our team run it for you. No per-control fees. No surprise invoices. Early access members lock in these rates permanently.
Included at every plan level — no exceptions
✓Platform updates & new features
✓Security patches
✓Bug fixes
✓NIST & framework catalog auto-refresh (nightly)
✓AES-256 encryption at rest
✓Full data export — your data, always yours
Solo
$199
per month, billed monthly
For individual security officers, consultants, or small teams managing 1–3 systems. You run the platform; we keep it sharp.
- ✓ 1 user seat
- ✓ Up to 3 systems
- ✓ All 54+ frameworks & crosswalk
- ✓ Daily workload assignments
- ✓ AI narrative generator (50 credits/mo)
- ✓ POA&M management
- ✓ ATO document export
- ✓ Community support (docs + forum)
- ✗ Continuous monitoring scheduler
- ✗ Team collaboration
- ✗ Email / priority support
Most Popular
Team
$299
per month, billed monthly
For small contractor shops and security teams managing multiple systems and assessments.
- ✓ Up to 5 users
- ✓ Up to 20 systems
- ✓ All 54+ frameworks & crosswalk
- ✓ Continuous monitoring scheduler
- ✓ AI narrative generator (unlimited)
- ✓ POA&M management
- ✓ ATO document export
- ✓ Assessment workflow
- ✓ Evidence management
- ✓ Email support (next business day)
- ✗ Priority / SLA support
Agency
$999
per month, billed monthly
For MSSPs, consulting firms, and organizations managing compliance across multiple clients.
- ✓ Unlimited users
- ✓ Unlimited systems
- ✓ All Team features
- ✓ Multi-client workspaces
- ✓ Continuous monitoring scheduler
- ✓ Custom branding / white-label
- ✓ Priority support + defined SLA
- ✓ Onboarding call included
- ✓ Self-hosted deployment support
- ✓ API access
Managed Service — Contract Engagement
Virtual ISSO Services
Year 1 — ATO Build
$3,500
/system/mo
12-month minimum · 1-system minimum
Year 2 Option — Continuous Monitoring
$2,500
/system/mo
ATO delivered — we keep it clean. Exercised at your option at end of Year 1.
Your team doesn't manage the compliance program — we do. A Blacksite-certified
security officer handles your monthly control reviews, finding tracking, evidence
collection, and program coordination. Platform access is included at no additional charge.
At the end of Year 1, your authorization or compliance package is delivered. You can continue under the Year 2 continuous monitoring option, transition to a self-managed plan, or walk away — with your full data export in hand.
At the end of Year 1, your authorization or compliance package is delivered. You can continue under the Year 2 continuous monitoring option, transition to a self-managed plan, or walk away — with your full data export in hand.
Year 1 — ATO Build includes
- ✓ Platform access (all users & systems in scope)
- ✓ System Security Plan (SSP) build-out
- ✓ Monthly control review & gap analysis
- ✓ POA&M management & remediation tracking
- ✓ Evidence collection & artifact management
- ✓ Quarterly status briefing for AO / stakeholders
- ✓ Full ATO package (SSP, SAR, SAP, POA&M)
- ✓ eMASS / SWIFT upload support
- ✓ Dedicated prime security officer point of contact
Year 2 Option adds
- ✓ Continuous authorization monitoring
- ✓ Annual control re-review & evidence refresh
- ✓ POA&M milestone tracking & closure
- ✓ Ongoing AO liaison & status reporting
- ✓ Framework update notifications & gap re-assessment
Common questions
What exactly do I get with my subscription?
Every plan — Solo through Agency — includes platform updates, security patches, bug fixes,
and nightly NIST / framework catalog refreshes. If we push a new feature or fix a bug,
it's in your instance automatically. No upgrade fees, no separate maintenance contracts.
Your subscription price is the total price.
Can I self-host Blacksite?
Yes. Agency plan includes self-hosted deployment support and documentation. Solo and Team
plans run on our managed infrastructure, or you can deploy yourself — step-by-step
instructions are provided. Self-hosted customers receive the same updates and patches;
you control when to apply them.
Is my compliance data stored securely?
All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Self-hosted customers
never transmit data to us — your data stays entirely in your environment.
You can export everything at any time in open formats; there is no lock-in.
What frameworks are included?
NIST 800-53 (Rev 4 & Rev 5), FedRAMP Low/Moderate/High, CMMC 2.0 Levels 1–3,
SOC 2, CIS Controls, HIPAA, PCI-DSS, ISO 27001, and 40+ more.
All plans get all frameworks with full crosswalk support. The catalog refreshes nightly
from authoritative sources — you are always current.
How does the managed service contract work?
Managed engagements start with a 12-month base contract. Year 1 covers the full
compliance program build: control reviews, evidence collection, and delivery of your
authorization or compliance package — whether that's an ATO for RMF/FedRAMP, a SOC 2
evidence package, a HIPAA Security Risk Assessment, or an ISO 27001 Statement of
Applicability. At the end of Year 1, exercise the Year 2 option ($2,500/system/mo)
for continuous monitoring — or take your full data export and move on. Everything
built in Year 1 is yours. Pricing is per system or program in scope; a typical
5-system engagement runs $210,000 for Year 1.
When does billing start?
We're in early access — no billing yet. Join the waitlist to get notified
when we open and to lock in founding-member pricing.