Onyx helps 1–25-person businesses prepare for CMMC Level 1 self-assessment work within an agreed scope. We organize the review, gaps and evidence. Your technical provider owns agreed system changes, and your designated senior official reviews and makes the SPRS affirmation.
Service information updated October 29, 2026. Onyx is a trade name of ETaye LLC. Contact: Ezra Taye, Arlington, Virginia. This page describes the offer; a signed agreement controls each engagement.
$495
Review the agreed scope and available information. Receive a written gap summary, evidence requests and recommended next steps. Unknowns stay identified as unknowns.
Credited toward setup if you proceed under the agreed terms. This is not an official assessment or certification.
$3,500 / $4,500
$3,500 total for 1–10 employees; $4,500 total for 11–25. Includes the agreed readiness documents, evidence organization, gap tracking and guided handoff.
After a credited $495 review, the remaining balance is $3,005 or $4,005. The review is not an extra fee on top.
$750 / year
One scheduled readiness review, updated gap summary and guidance for the client's annual self-assessment and affirmation.
Separately authorized. Not unlimited support, continuous monitoring or implementation of new controls.
How payment works: each step is invoiced to your business under a signed agreement. Pay by ACH bank transfer, Zelle or check; no card is required. The review is paid before it starts; setup is 50% to start and 50% on delivery of the policies and evidence binder.
21-day setup target: starts after the agreed payment, access and inputs are ready. The clock pauses after two business days without a response to a required request. Unresolved technical work or out-of-scope systems can change the plan. We do not promise a completed compliance outcome by a fixed date.
| Party | Owns |
|---|---|
| Onyx | Preparation, a gap summary, tailored documentation within scope, an evidence index, guidance and a handoff identifying completed work and unresolved items. |
| Client and technical provider | Accurate inputs, approval of scope, technical remediation, implementation and ongoing operation of safeguards. Technical changes require an agreed owner. |
| Client's designated senior official | Review of the assessment information and the SPRS affirmation. Onyx does not sign as that official, request their password or mark unsupported requirements as met. |
The setup ends with delivery and review of the agreed readiness materials and handoff. An unresolved gap remains a gap; delivery of a binder is not proof of compliance. Additional work needs a separately agreed scope.
Excluded: hardware, software licenses, Level 2/CUI work, ongoing IT administration, monitoring, incident response and legal advice. No guarantee of compliance outcomes, government or prime-contractor acceptance, or contract awards.
Official background: FAR 52.204-21 and 32 CFR 170.22, affirmation. Applicability depends on the relevant information, systems and contract requirements—not headcount alone.
Fictional example · Not a client result
Example company: Sample Workshop. These rows illustrate the format only. No real systems were assessed. This is not a complete checklist, assessment result or claim that any requirement has been satisfied.
| Area | What is known | Next evidence / action | Owner / status |
|---|---|---|---|
| Account access | The owner describes an offboarding process; no current access list has been reviewed. | Obtain a dated account inventory and compare it with authorized users. | Client IT provider · Not verified |
| Visitor records | The described visitor process has not been supported by a sample record. | Review the implemented procedure and an appropriate redacted record. | Client office manager · Evidence requested |
| Device disposal | No disposal information has been evaluated in this illustration. | Identify the responsible person and evidence of the actual disposal process. | Client owner · Not evaluated |
Evidence index fields: reference, relevant requirement, evidence description, system/location, date reviewed, responsible person, reviewer finding and outstanding action.
Download the fictional sample (PDF)Download the 1-page overview (PDF)
The full engagement adapts the evidence to the actual environment. A policy template or screenshot on its own is not a universal pass.
Onyx is run by Ezra Taye in Arlington, Virginia. You deal with Ezra directly, from the Fit Call to the final handoff. Onyx is a new firm: there are no client case studies to show yet, so the scope, prices, contract terms and a fictional sample are published here instead. Onyx is not a C3PAO, does not certify anyone and does not give legal advice.
Onyx is intended for owners who want defined coordination and documentation help while keeping their existing technical provider. If your team can do the work itself or its existing provider already covers the same scope, buying a duplicate service may not be useful.
A Fit Call discusses the business and proposed work. It is not a complete technical assessment. No CUI, contract attachments or login credentials are needed to request that call.
Book directly using the calendar above, or prepare an email below. The email option lets you tell us how you found Onyx. It does not make a booking or purchase.
Direct contact: ezra@onyxcmmc.com · 703-300-2469.