Pricing

I offer two engagement types: an ongoing vCISO retainer, and one-time security assessments for organizations that need a focused review without the ongoing relationship.

Not sure which tier fits? Read the buyer’s guide →

Virtual CISO Retainer

#

The retainer covers ongoing executive security leadership: risk assessment, security roadmap, governance, policy, vendor risk, incident response, board reporting, and the day-to-day judgment calls that keep a security program moving forward.

For the full scope of what’s included, see Virtual CISO →.

Why a 12-Month Engagement

#

Two reasons.

The first three months are heavy. A real risk assessment takes weeks, and so does the security roadmap and baseline policy work that follow. Rather than billing that as a separate up-front engagement, the cost is spread across the year, so you get the assessment work and the program leadership for one flat number.

Decisions build on each other. The risk assessment shapes the roadmap. The roadmap shapes which policies get written and which controls get prioritized. Twelve months gives those decisions room to play out without restarting context every quarter.

How It Compares

#

Security Assessments

#

ISO 27001 readiness, SOC 2 readiness, risk assessments, cloud security reviews, and network security reviews are included as part of the vCISO retainer. There’s no separate fee for the assessment work.

If you only need a one-time assessment without the ongoing retainer, those are scoped per engagement based on environment size, complexity, and timeline.

See assessment services → and book a call for a scoped quote.