START HERE
Find out where you actually stand, in two to four weeks.
What it is
The assessment is where nearly every engagement starts. You get a scored picture of your current posture against the framework that matters to you, a prioritised list of what is broken, and an honest answer on whether your deadline is reachable. No commitment to anything after it.
Who it is for. Anyone who has been asked for proof of compliance and does not yet know how far away they are.
What is included
- Scored gap assessment against the real control set, not a generic questionnaire
- Intelligence gathering across systems, configurations and deployment processes
- Vulnerability analysis with the findings ranked by what an assessor will actually flag
- A Plan of Action and Milestones you can execute with us or without us
- A fixed price agreed before we start
What you end up with
You leave knowing your score, your gap, your timeline and your cost. Most clients then move into remediation with us, but the assessment stands on its own and the deliverable is yours either way.
Most clients continue into a Virtual CISO engagement or managed compliance, but nothing about the assessment obliges you to.
How pricing works
Scope genuinely varies between a single site practice and a multi location group, so the entry figure is a floor rather than a headline. Your exact price is quoted on the call, before any work starts, and it does not move afterwards.
- Your price is quoted on the free scoping call, not after we have started.
- Once quoted, it is fixed. No hourly billing and no change orders.
- If you continue into a Virtual CISO or managed compliance engagement within 90 days, the assessment fee is credited toward it.
Common questions
Why "starting at" rather than one price?
Because a single site practice and a multi location group are not the same job, and quoting one number would mean overcharging one of them. The floor is real: no assessment costs less than $15,000. What varies above it is the number of systems, sites and frameworks in scope.
What if the assessment finds more than expected?
The price does not change. That is the point of quoting after scoping rather than during delivery. If the remediation work that follows is larger than anticipated, that is a separate decision you make with a separate number in front of you.
Do we have to continue with you afterwards?
No. The assessment, the findings and the Plan of Action and Milestones are yours. You can execute them with your own team or another firm. If you do continue with us within 90 days, the assessment fee is credited toward that engagement.
Also available
Virtual CISO
A security leader on your org chart, without the salary line.
Managed Security Compliance
Stay compliant between audits, without hiring a team to do it.
Book a scoping call
Thirty minutes. Bring the framework, the deadline, and who is asking for it.