Pricing
Each service below has a published starting price and a typical scoped range, so you can budget before you talk to anyone. Every engagement begins with a written scope and proposal.
Amounts are in U.S. dollars. Select a service name to see what the work covers. Policy, control, and evidence design and vendor-risk reviews don’t have published prices; ask for a scoped proposal.
| Service | Billing | Starting price | Typical scoped range |
|---|---|---|---|
| NIST CSF / CIS Controls Risk Assessment | One-time project | $7,500 | $7,500 to $18,000 |
| Cloud Security Review | One-time project | $7,500 | $7,500 to $18,000 |
| Service | Billing | Starting price | Typical scoped range |
|---|---|---|---|
| Web Application or API Penetration Test | One-time project | $12,000 | $12,000 to $30,000 |
| External Network Penetration Test | One-time project | $6,000 | $6,000 to $12,000 |
| Internal Network Penetration Test | One-time project | $9,000 | $9,000 to $20,000 |
Penetration-test prices rest on the assumptions set out in what a penetration test price assumes.
| Service | Billing | Starting price | Typical scoped range |
|---|---|---|---|
| vCISO Advisory | Monthly | $4,000/month | $4,000 to $6,000/month |
| vCISO Program Leadership | Monthly | $7,500/month | $7,500 to $12,000/month |
| Service | Billing | Starting price | Typical scoped range |
|---|---|---|---|
| SOC 2 Readiness | One-time project | $10,000 | $10,000 to $25,000 |
| ISO/IEC 27001 Readiness | One-time project | $15,000 | $15,000 to $35,000 |
| PCI DSS Readiness | One-time project | $8,000 | $8,000 to $22,000 |
| HIPAA Security Readiness | One-time project | $8,000 | $8,000 to $20,000 |
| CMMC Level 1 Readiness | One-time project | $6,000 | $6,000 to $12,000 |
| CMMC Level 2 Self-Assessment Readiness | One-time project | $15,000 | $15,000 to $40,000 |
What readiness pricing does and doesn’t cover is set out in what compliance readiness assumes.
| Service | Billing | Starting price | Typical scoped range |
|---|---|---|---|
| Incident Response Plan and Tabletop | One-time project | $6,500 | $6,500 to $15,000 |
| Priority Incident Advisory Retainer | Annual | $18,000/year | $18,000 to $60,000/year |
About the retainer: Priority advisory for retainer clients, with after-hours paging from 6:00 a.m. to 10:00 p.m. Central Time every day and an acknowledgement target of 60 minutes during the contracted paging window. Not a round-the-clock service. Terms are set by the signed retainer.
These qualifiers apply to the prices above, in full.
Pricing depends on environment size, complexity, testing depth, locations, applications, accounts, user roles, compliance objectives, and delivery timeline. Every engagement begins with a written scope and proposal. Taxes, travel, remediation, third-party audit or certification fees, licensing, and emergency work are separate. Readiness services do not include independent certification, attestation, legal advice, or a guarantee of passing.
Penetration-test pricing assumes authorized manual testing, an executive summary, a technical report, remediation guidance, and one retest within 60 days unless the proposal says otherwise.
All penetration testing requires written authorization, a signed scope, rules of engagement, approved targets, testing windows, emergency contacts, and stop conditions.
When a program requires a formal assessment, audit, or certification, it's performed by an independent, authorized assessor. We keep advisory work and formal assessment apart: a practitioner never assesses controls they designed, developed, or implemented.
These are the factors named in our pricing qualifier, with what each one means in practice.
We don't use limited-time discounts, countdown timers, or false scarcity, and we don't guarantee outcomes such as passing an audit or assessment.
Pick the services you’re weighing to see a combined typical range. One-time projects, monthly services, and the annual retainer are totaled separately because they’re billed differently.
Tell us what you’re trying to achieve and what’s driving the timing. We respond to new inquiries Monday to Friday, 8:00 a.m. to 6:00 p.m. Central Time, excluding U.S. federal holidays. Best-effort triage. No emergency service level.