# CISO Marketplace Services: full catalog > Offensive security and AI security, delivered by practitioners. The services arm of CISO Marketplace (QSai LLC). 182 services. ## Pricing rules - Prices are published starting prices (the lowest published tier). A written proposal fixes scope, tier and price before anything is signed. - Timelines and staffing are set per engagement in the SOW; none are published here. - There is no percentage member discount on services. Members get engagement coupons from the coupon book (setup-fee waivers, travel stipends, booking-rate codes), applied by code and capped per year. - An AI agent may quote indicatively through the MCP servers or the hub agent API; guardrails are enforced server-side, every agent quote is indicative, and agents never set or change a price. --- # Practice: Offensive Security Penetration testing, red teaming and adversary emulation run by operators, not scanners. We prove what an attacker can reach, show you how, and help you verify the fix. ## Red Team Subscription > From $15K / mo · Offensive Security · https://cisomarketplace.services/services/red-team-subscription A standing offensive testing program in place of a once-a-year engagement. Each month our team runs a targeted assessment against an agreed part of your environment; each quarter a scenario-based attack tests how well your people and tooling detect and respond. The Premium tier adds two full red team engagements a year. Findings from every cycle feed one running improvement plan, so each round also checks whether the last round's fixes held. Targets, rules of engagement and testing windows are agreed at kickoff. ### In scope - Kickoff: targets, rules of engagement and testing windows - Monthly targeted assessment of an agreed area - Quarterly scenario-based attack with a detection and response review - Two full red team engagements a year (Premium tier) - Running improvement plan updated after every cycle ### Deliverables - Monthly assessment reports - Quarterly attack scenario findings - Bi-annual red team reports ### Tiers #### Standard: $15K / month Monthly targeted assessments and quarterly scenario-based attacks, each with a report and an updated improvement plan. Limits: scenarios 4 Includes: - Monthly targeted assessments - Quarterly scenario-based attacks - Monthly assessment reports and quarterly scenario findings - Running improvement plan Excludes: - Full-scope engagements — included only in Premium #### Premium: $25K / month Everything in Standard, plus two full red team engagements a year, each with its own report. Limits: scenarios 6 Includes: - Everything in Standard - Two full red team engagements a year - Bi-annual red team reports Excludes: - More than two full-scope engagements a year ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=red-team-subscription ## Active Directory Security Assessment > From $40K · Offensive Security · https://cisomarketplace.services/services/active-directory-assessment Comprehensive security assessment of Active Directory infrastructure, focusing on privilege escalation, lateral movement, and domain compromise scenarios. ### In scope - Domain security assessment - Trust relationship analysis - Privilege escalation testing - Password policy evaluation - Group policy security review ### Deliverables - Domain security report - Attack path analysis - Privilege escalation findings - Security policy recommendations - Hardening guidelines ### Tiers #### Core AD Security Assessment: $40K Assessment of 1 AD forest with 1 domain, up to 2,500 users: password and group policy review, privileged group analysis, and privilege-escalation testing from 1 standard-user starting point. Limits: domains 1, users 2500 Includes: - 1 forest, 1 domain, up to 2,500 users - Password policy and GPO security review - Privileged group and delegation analysis - Privilege-escalation testing from 1 standard account - Hardening guidelines Excludes: - Trust relationship analysis - Full attack-path mapping to domain compromise - Cloud identity (hybrid) review - Hardening implementation and retest #### Advanced AD Security Program: $70K Assessment of up to 5 domains in up to 2 forests, up to 10,000 users: full attack-path mapping to domain compromise, trust relationship analysis, lateral movement testing and review of every GPO. Limits: domains 5, users 10000 Includes: - Up to 5 domains, up to 2 forests, up to 10,000 users - Attack-path mapping to domain compromise - Trust relationship analysis - Lateral movement testing - Review of all group policies Excludes: - Hardening implementation - Retest after remediation - Custom attack tooling - Tiered administration redesign #### Enterprise AD Security Solution: $110K Multi-forest AD program; no fixed domain or user cap - scoped at kickoff. Adds custom attack tooling for your environment, tiered-administration design, hands-on hardening support and a full retest after remediation. Includes: - All forests and domains, scoped at kickoff - Custom attack tooling and scenarios - Tiered administration and hardening design - Hands-on hardening support - Full retest after remediation Excludes: - Ongoing AD monitoring - Identity product licences - Migration or domain consolidation work ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=active-directory-assessment ## Industrial Control System (ICS) Security Assessment > From $35K · Offensive Security · https://cisomarketplace.services/services/industrial-control-system-ics-security-assessment Specialized security assessment for industrial control systems, SCADA networks, and operational technology environments, focusing on both cyber and physical security aspects. ### In scope - ICS network architecture review - SCADA system security testing - PLC/RTU security assessment - Protocol analysis (Modbus, DNP3, etc.) - Safety system security review - Human-Machine Interface (HMI) testing - Physical security controls assessment ### Deliverables - Detailed ICS security report - Network architecture recommendations - Protocol security analysis - Safety system findings - Physical security recommendations - Remediation priority matrix - 90-day retest period ### Tiers #### Core ICS Security Assessment: $35K Assessment of 1 site and one control system: ICS network architecture review, passive traffic capture, SCADA and HMI configuration review, a sample of up to 25 PLCs/RTUs/HMIs, and analysis of up to 2 industrial protocols. Includes a retest. Limits: locations 1, devices 25 Includes: - ICS network architecture and segmentation review - Passive traffic capture and asset inventory - SCADA server and HMI configuration review - Sample of up to 25 PLCs/RTUs/HMIs - Analysis of up to 2 protocols (e.g. Modbus, DNP3) - Report, remediation priority matrix, 90-day retest Excludes: - Safety instrumented system review - Active testing against controllers - Physical security controls assessment - Additional sites #### Advanced ICS Security Program: $60K Assessment of up to 2 sites and up to 75 controllers/HMIs. Adds active protocol testing in a maintenance window or test bed, safety system security review, HMI application testing, and physical security controls assessment. Includes a retest. Limits: locations 2, devices 75 Includes: - Everything in the Core tier, for up to 2 sites - Active protocol and controller testing in an agreed window or test bed - Safety system security review - HMI and engineering workstation testing - Physical security controls assessment - 90-day retest Excludes: - IT/OT convergence assessment of the corporate network side - OT monitoring design and setup - Custom test tooling for proprietary protocols #### Enterprise ICS Security Solution: $95K Assessment of up to 4 sites and up to 200 controllers/HMIs. Adds IT/OT convergence testing from the corporate network into OT, custom test tooling for proprietary protocols, and OT monitoring setup with detection use cases. Includes a retest. Limits: locations 4, devices 200 Includes: - Everything in the Advanced tier, for up to 4 sites - IT-to-OT attack path testing across the corporate boundary - Custom test tooling for proprietary or vendor-specific protocols - OT monitoring setup with tuned detection use cases - Network architecture recommendations per site - 90-day retest Excludes: - Monitoring product licences and sensors - Remediation engineering - Multi-month security program build (see ICS Security Program) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=industrial-control-system-ics-security-assessment ## Medical Device Security Assessment > From $32K · Offensive Security · https://cisomarketplace.services/services/medical-device-security-assessment Specialized security testing for medical devices and healthcare technology, focusing on patient safety, data security, and regulatory compliance. ### In scope - Device firmware analysis - Wireless protocol testing - Patient data security review - Authentication mechanism testing - Remote access security - Regulatory compliance check - Third-party component analysis ### Deliverables - Medical device security report - HIPAA compliance analysis - Patient safety risk assessment - Data security recommendations - Regulatory compliance guidance - Remediation roadmap - 90-day retest period ### Tiers #### Core Medical Device Assessment: $32K Security test of 1 device model over 1 communication interface: firmware analysis, authentication testing, patient data security review, remote access check, and HIPAA-oriented compliance review. Includes a retest. Limits: devices 1 Includes: - Testing of 1 device model on 1 interface (e.g. Ethernet or USB) - Firmware analysis - Authentication mechanism testing - Patient data security review - HIPAA compliance analysis - Report, remediation roadmap, 90-day retest period Excludes: - Wireless protocol testing (BLE, Wi-Fi, proprietary RF) - Third-party component / SBOM analysis - Companion app and cloud service testing - Additional device models #### Advanced Medical Device Assessment: $48K Security test of 1 device model across all its interfaces. Adds wireless protocol testing, remote access and update channel testing, third-party component analysis, patient safety risk assessment, and detailed regulatory compliance guidance. Includes a retest. Limits: devices 1 Includes: - Everything in the Core tier, across all device interfaces - Wireless protocol testing - Remote access and update channel security testing - Third-party component analysis - Patient safety risk assessment - Regulatory compliance guidance Excludes: - Additional device models or variants - Retest beyond 90 days - Regulatory submission document authoring #### Enterprise Medical Device Assessment: $65K Security test of up to 3 device models or variants across all interfaces. Adds firmware reverse engineering and exploit development for confirmed findings, a cross-device platform review, and an extended retest period. Limits: devices 3 Includes: - Everything in the Advanced tier, for up to 3 device models - Firmware reverse engineering and exploit proof-of-concepts - Shared platform / component review across devices - Retest period extended to 180 days - Engineering team readout Excludes: - Regulatory submission document authoring - Hospital network deployment assessment - More than 3 device models (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=medical-device-security-assessment ## Purple Team Assessment Program > From $45K · Offensive Security · https://cisomarketplace.services/services/purple-team-assessment Collaborative security assessment combining red team attacks with blue team defense to improve detection and response capabilities in real-time. ### In scope - Real-time attack simulations - Defense capability testing - Detection engineering validation - Response procedure assessment - Tool effectiveness evaluation ### Deliverables - Detailed attack narratives - Detection gap analysis - Defense improvement recommendations - Custom detection rules (Advanced and Enterprise tiers) - Response playbooks - Training materials ### Tiers #### Core Purple Team Assessment: $45K Up to 5 joint scenarios run with your defensive team, with detection gaps recorded for each. Limits: scenarios 5, locations 1 Includes: - Up to five joint scenarios - Detection gap analysis - Tuning recommendations Excludes: - Writing custom detection rules for you #### Advanced Purple Team Program: $75K Up to 10 joint scenarios, with detection rules drafted for each gap found. Limits: scenarios 10, locations 2 Includes: - Up to ten joint scenarios - Drafted detection rules - Re-run of failed scenarios Excludes: - 24/7 monitoring #### Enterprise Purple Team Solution: $120K Up to 20 joint scenarios across up to 3 sites, with a re-test after tuning and an executive readout. Limits: scenarios 20, locations 3 Includes: - Up to twenty joint scenarios - Re-test after tuning - Executive readout Excludes: - Ongoing exercises — scoped as a retainer ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=purple-team-assessment ## SMB Security Complete > From $8.5K · Offensive Security · https://cisomarketplace.services/services/smb-security-complete Full-spectrum security assessment covering all critical attack surfaces for established SMBs. ### In scope - All Essentials components - Wireless network security test - Source code review (up to 10,000 LOC) - Basic social engineering campaign - 30 days remediation support - Policy and procedure review ### Deliverables - Comprehensive findings report - Source code security analysis - Wireless security assessment - Social engineering metrics - 2-hour executive presentation - 90-day remediation roadmap ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-security-complete ## Social Engineering Campaign Assessment > From $7.5K · Offensive Security · https://cisomarketplace.services/services/social-engineering-assessment Comprehensive social engineering assessment including phishing campaigns, vishing attacks, physical security testing, and employee awareness evaluation. ### In scope - Phishing campaign development - Vishing attack scenarios - Physical security tests - Employee awareness evaluation - Access control testing - Removable-media and tailgating exercises (upper tiers) - Training session for the groups that responded (upper tiers) ### Deliverables - Campaign effectiveness report - Employee vulnerability analysis - Security awareness recommendations - Training program design - Response procedure assessment ### Tiers #### Entry — market-sized scope: $7.5K One email-only exercise for up to 100 staff with a results report. The smallest version of this work. Limits: employees 100, scenarios 1 Includes: - One email exercise - Results by department - Awareness recommendations Excludes: - Phone-based and on-site exercises - Follow-up training #### Core Social Engineering Assessment: $25K Email exercises for up to 500 staff: 2 campaigns plus an awareness baseline. Limits: employees 500, scenarios 2 Includes: - Two email campaigns - Awareness baseline - Executive summary Excludes: - Phone-based and on-site exercises #### Advanced Social Engineering Program: $45K Email and phone exercises for up to 2,000 staff, plus on-site testing at one location. Limits: employees 2000, scenarios 4, locations 1 Includes: - Email and phone exercises - On-site testing at one location - Targeted coaching for repeat responders Excludes: - More than one on-site location #### Enterprise Social Engineering Solution: $75K All channels for up to 5,000 staff, on-site testing at up to 3 locations and a follow-up awareness program. Limits: employees 5000, scenarios 8, locations 3 Includes: - All channels - Up to three on-site locations - Follow-up awareness program Excludes: - Ongoing monthly simulations — see Managed Security Awareness ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=social-engineering-assessment ## Wireless Infrastructure Attack Assessment > From $10K · Offensive Security · https://cisomarketplace.services/services/wireless-attack-assessment Advanced wireless security testing including WiFi, Bluetooth, RF, and cellular network attack simulation and vulnerability assessment. ### In scope - WiFi network penetration testing - Bluetooth security assessment - RF protocol analysis - Cellular network security testing - Wireless IoT device evaluation ### Deliverables - Wireless vulnerability report - Attack scenario documentation - Security control recommendations - Encryption assessment results - Protocol security analysis ### Tiers #### Entry — market-sized scope: $10K Single-office WiFi assessment: up to 5 networks. The smallest version of this work. Limits: locations 1, devices 5 Includes: - One office - WiFi only - Findings report Excludes: - Bluetooth and other radio protocols - More than one site #### Core Wireless Attack Assessment: $35K Essential wireless security testing covering basic WiFi and Bluetooth attacks Limits: locations 2, devices 15 Includes: - WiFi and Bluetooth - Up to two sites Excludes: - Cellular and other radio protocols #### Advanced Wireless Attack Program: $60K WiFi, Bluetooth and additional radio protocols at up to 4 sites. Limits: locations 4, devices 40 Includes: - Additional radio protocols - Up to four sites Excludes: - Custom tooling #### Enterprise Wireless Attack Solution: $95K All radio technologies at up to 8 sites, with custom tooling handed over at the end. Limits: locations 8, devices 100 Includes: - All radio technologies - Up to eight sites - Tooling handover Excludes: - Ongoing monitoring ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=wireless-attack-assessment ## Blockchain Security and Smart Contract Audit > From $60K · Offensive Security · https://cisomarketplace.services/services/blockchain-security-and-smart-contract-audit Comprehensive security assessment for blockchain implementations and smart contracts, including code audits, cryptographic review, and security architecture evaluation. ### In scope - Smart contract code audit - Cryptographic implementation review - Consensus mechanism assessment - Network security evaluation - Wallet security review ### Deliverables - Smart contract audit report - Security architecture document - Vulnerability assessment findings - Remediation guidelines - Security best practices - Monitoring recommendations ### Tiers #### Core Blockchain Assessment: $60K Manual and automated audit of up to 1 contract repository, roughly 2,500 lines of contract code on one chain, plus a review of the wallet and key handling around it. One fix-review round. Limits: repositories 1, wallets 3 Includes: - Line-by-line smart contract audit of 1 repository - Automated analysis and manual exploit attempts - Wallet and key management review for up to 3 wallets - Audit report with remediation guidelines - One fix-review round Excludes: - Cryptographic implementation review - Consensus mechanism and node network assessment - Multi-chain or bridge contracts - Custom tooling and monitoring #### Advanced Blockchain Assessment: $90K Up to 3 repositories, roughly 6,000 lines of contract code: everything in the basic tier, a cryptographic implementation review, consensus mechanism assessment and node network security evaluation. Two fix-review rounds. Limits: repositories 3, wallets 5 Includes: - Everything in the basic tier - Cryptographic implementation review - Consensus mechanism assessment - Node and network security evaluation - Two fix-review rounds Excludes: - Custom detection tooling - Post-deployment monitoring - Bridges and cross-chain messaging beyond the 3 repositories #### Enterprise Blockchain Assessment: $120K Full-scope blockchain security program including custom tool development and continuous monitoring Limits: repositories 5, wallets 10 Excludes: - Bug bounty program management - Formal verification of the full codebase ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=blockchain-security-and-smart-contract-audit ## Critical Infrastructure Protection Program > From $90K · Offensive Security · https://cisomarketplace.services/services/critical-infrastructure-protection Comprehensive security program for critical infrastructure protection, including water systems, emergency services, and essential facility security. ### In scope - Water system security - Emergency services protection - Essential facility assessment - Infrastructure interdependency analysis - Physical security integration ### Deliverables - Infrastructure security architecture - Protection framework - Interdependency analysis - Risk mitigation strategy - Emergency response procedures ### Tiers #### Core Infrastructure Protection Assessment: $90K Assessment of one site, covering the IT network and the boundary with the operational network. Limits: locations 1 Includes: - One site - IT and boundary review - Risk register Excludes: - Hands-on testing of operational equipment - More than one site #### Advanced Infrastructure Protection Program: $155K Up to 3 sites, including passive review of the operational network. Limits: locations 3 Includes: - Up to three sites - Passive operational network review Excludes: - Active testing of live operational equipment #### Enterprise Infrastructure Protection Solution: $240K Up to 6 sites with a protection program roadmap; larger estates are scoped at kickoff. Limits: locations 6 Includes: - Up to six sites - Program roadmap - Executive readout Excludes: - Implementation work ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=critical-infrastructure-protection ## Physical Security Assessment: SSAE 16/18 > From $12K · Offensive Security · https://cisomarketplace.services/services/physical-security-ssae-assessment In an era where cybersecurity threats dominate headlines, physical security remains a cornerstone of comprehensive risk management. This assessment evaluates physical access controls, surveillance, and response capabilities following SSAE 16/18 standards. ### In scope - Access control review - Surveillance system analysis - Physical intrusion detection assessment - Employee security awareness evaluation - SSAE 16/18 compliance check ### Deliverables - Physical Security Assessment Report - Gap analysis - Recommendations for improvements - SSAE 16/18 audit preparation support ### Tiers #### Standard Assessment: $12K Physical security assessment of one facility against SSAE-relevant controls. Limits: locations 1 Includes: - Facility walkthrough - Control evidence review - Findings report Excludes: - Covert entry testing - More than one facility #### Enterprise Assessment: $30K Up to 4 facilities, including data-centre cages, with a consolidated report for auditors. Limits: locations 4 Includes: - Up to four facilities - Consolidated auditor-ready report Excludes: - Covert entry testing ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=physical-security-ssae-assessment ## Physical Social Engineering Assessment > From $15K · Offensive Security · https://cisomarketplace.services/services/physical-social-engineering-assessment A Physical Social Engineering Assessment evaluates the vulnerability of your staff and physical premises to social engineering tactics, combining physical penetration testing and employee response assessments. ### In scope - Physical entry attempts - Employee interaction tests - Tailgating assessments - Badge cloning tests - Physical security culture evaluation ### Deliverables - Physical Social Engineering Report - Incident findings - Training recommendations ### Tiers #### Basic Physical SE Assessment: $15K On-site testing at one facility during business hours, with a findings report. Limits: locations 1 Includes: - One facility - Business-hours testing - Findings report and debrief Excludes: - After-hours testing - More than one facility #### Advanced Physical SE Assessment: $35K On-site testing at up to 3 facilities, including after-hours testing at one of them. Limits: locations 3 Includes: - Up to three facilities - After-hours testing at one facility - Executive debrief Excludes: - More than three facilities — scoped ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=physical-social-engineering-assessment ## Attack Surface Management Program > From $7.5K / mo · Offensive Security · https://cisomarketplace.services/services/attack-surface-management-program Continuous discovery, monitoring, and assessment of your organization's external attack surface and digital footprint. Our ongoing service provides real-time visibility into internet-exposed assets, shadow IT, misconfigurations, and newly emerging vulnerabilities, enabling proactive risk reduction before attackers can exploit these weaknesses. ### In scope - External asset discovery and inventory - Continuous vulnerability scanning - Cloud resource monitoring - Domain and subdomain tracking - Certificate management - Shadow IT discovery - Exposed credentials monitoring - API security monitoring - Third-party connection tracking - Priority alert notifications ### Deliverables - Real-time attack surface dashboard - Monthly vulnerability trend reports - Critical exposure notifications - Remediation guidance and verification - Executive risk summaries - Shadow IT alerts - Quarterly attack surface reduction plans - Risk prioritization framework - Continuous improvement recommendations ### Tiers #### Standard Attack Surface Monitoring: $7.5K / month Continuous external discovery and vulnerability scanning for up to 5 root domains, up to 250 external IPs and up to 3 cloud accounts. Standard alert rules, critical exposure notifications and one monthly trend report. Limits: domains 5, external ips 250, cloud accounts 3 Includes: - Asset discovery and inventory with subdomain tracking - Continuous external vulnerability scanning - Certificate and exposed-credential monitoring - Critical exposure notifications - Monthly vulnerability trend report Excludes: - Custom alert rules and risk scoring - Analyst-validated findings and remediation verification - Quarterly attack surface reduction plan - Penetration testing or exploitation of findings #### Advanced Attack Surface Management: $12.5K / month Continuous monitoring for up to 15 root domains, up to 1,000 external IPs and up to 10 cloud accounts. Analysts validate findings, rank them by risk, verify fixes, tune custom alerts and deliver a quarterly attack surface reduction plan. Limits: domains 15, external ips 1000, cloud accounts 10 Includes: - Everything in Standard at the larger footprint - Analyst validation and risk-ranked findings - Remediation guidance and fix verification - Custom alert rules - Shadow IT and exposed API monitoring - Quarterly attack surface reduction plan Excludes: - Threat intelligence integration - Custom risk scoring model - Named dedicated analyst - Penetration testing or exploitation of findings #### Enterprise Attack Surface Intelligence: $20K / month No fixed cap on domains, IPs or cloud accounts; footprint is scoped at onboarding, including subsidiaries and third-party connections. Adds threat intelligence integration, a custom risk scoring model, a named analyst and monthly executive risk summaries. Includes: - Footprint scoped at onboarding, no fixed cap - Subsidiary and third-party connection tracking - Threat intelligence integration - Custom risk scoring model - Named analyst - Monthly executive risk summary Excludes: - Penetration testing or exploitation of findings - Hands-on remediation in client systems - Internal network vulnerability scanning ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=attack-surface-management-program ## Continuous Security Validation Service > From $8.5K / mo · Offensive Security · https://cisomarketplace.services/services/continuous-security-validation Subscription-based ongoing testing of your security controls, detection capabilities, and response procedures against real-world attack techniques. Our continuous validation approach provides evidence-based assessment of security effectiveness beyond traditional point-in-time assessments, ensuring your defenses work as expected against evolving threats. ### In scope - Automated security control testing - MITRE ATT&CK-based scenarios - Detection capability validation - Prevention control validation - Response procedure testing - Purple team exercises - Evasion technique testing - Security tool configuration validation - Lateral movement simulation - Data exfiltration testing ### Deliverables - Monthly validation reports - Control effectiveness metrics - Detection gap analysis - Prevention bypass findings - Security improvement recommendations - MITRE technique coverage mapping - Response time analytics - Executive dashboards - Security ROI validation - Continuous improvement roadmap ### Tiers #### Essential Security Validation: $8.5K / month Monthly test cycle: up to 10 MITRE ATT&CK-based scenarios per cycle run from up to 5 test hosts against core prevention and detection controls (endpoint, email, network). Monthly report with detection gaps and 1 purple team session per year. Limits: scenarios 10, internal hosts 5, sessions 1 Includes: - 1 test cycle per month - Up to 10 ATT&CK scenarios per cycle - Prevention and detection control validation - Monthly report and technique coverage map - 1 purple team session per year Excludes: - Lateral movement and data exfiltration simulation - Evasion technique testing - Custom scenarios - Detection rule writing in the client's SIEM #### Advanced Security Validation Program: $15K / month Bi-weekly test cycles: up to 25 scenarios per cycle from up to 15 test hosts. Adds lateral movement, exfiltration and evasion testing, security tool configuration validation, response-time analytics and 4 purple team sessions per year. Limits: scenarios 25, internal hosts 15, sessions 4 Includes: - 2 test cycles per month - Up to 25 scenarios per cycle - Lateral movement, exfiltration and evasion tests - Security tool configuration validation - Response-time analytics - 4 purple team sessions per year Excludes: - Custom scenarios built for the client's threat profile - Full kill-chain simulations - Named dedicated engineers - Detection rule writing in the client's SIEM #### Enterprise Continuous Validation: $25K / month Continuous testing with no fixed scenario cap, from up to 50 test hosts. Adds custom scenarios built to the client's threat profile, full kill-chain simulations, named security engineers, monthly purple team sessions and executive dashboards. Limits: internal hosts 50, sessions 12 Includes: - Continuous testing, no fixed scenario cap - Custom threat-profile scenarios - Full kill-chain simulations - Named security engineers - 12 purple team sessions per year - Executive dashboards Excludes: - Full-scope red team engagement with physical or social engineering - Licences for the client's own security tools - 24/7 monitoring or incident response ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=continuous-security-validation ## Continuous Threat Exposure Management (CTEM) Program > Scoped per engagement · Offensive Security · https://cisomarketplace.services/services/continuous-threat-exposure-management-ctem-program A packaged CTEM program: continuous attack-surface discovery, threat-led validation (incl. pen test/red team), exposure prioritization, and measurable remediation — replacing point-in-time vuln scanning. ### In scope - Continuous attack surface discovery - Threat-led validation (pentest/red team) - Exposure scoping & prioritization - Remediation tracking & metrics - Continuous re-validation ### Deliverables - CTEM program plan - Exposure dashboard - Prioritized remediation backlog - Validation reports ### Tiers #### Essential: scoped Core CTEM cycle (discover + validate + prioritize) Limits: devices 1000 Excludes: - Monthly validation #### Advanced: scoped Up to 5,000 assets with monthly validation. Limits: devices 5000, months 12 Includes: - Monthly validation - Remediation tracking Excludes: - 24/7 monitoring #### Enterprise: scoped Up to 25,000 assets across business units, with an embedded program lead. Limits: devices 25000, months 12 Includes: - Embedded program lead - Executive exposure reporting Excludes: - Managed detection and response ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=continuous-threat-exposure-management-ctem-program ## Penetration Testing as a Service (PTaaS) Subscription > From $2K / mo · Offensive Security · https://cisomarketplace.services/services/penetration-testing-as-a-service-subscription An annual subscription that replaces the once-a-year pentest: a baseline test, then testing of new features and releases through the year, unlimited retests, findings delivered into your ticketing system and a standing attestation letter that is always current. It is the recurring form of the Penetration Testing service and the delivery model behind the PTaaS pillar of the program. ### In scope - Annual baseline penetration test - Release and feature testing on a monthly or quarterly cadence - Unlimited retests of fixed findings - Findings delivered to Jira / GitHub / Linear - Always-current attestation letter ### Deliverables - Baseline and incremental test reports - Live findings in your ticketing system - Quarterly security posture summary - Attestation letter on demand ### Tiers #### Essential PTaaS: $2K / month One application: annual baseline plus quarterly incremental testing and unlimited retests Limits: web apps 1, apis 2 #### Advanced PTaaS: $3.5K / month Up to three applications or one app plus infrastructure: monthly testing cadence, ticketing integration and quarterly review Limits: web apps 3, apis 6, external ips 100 #### Enterprise PTaaS: $6K / month Portfolio coverage with a dedicated testing pod, release-gated testing, threat modelling of major features and an annual red-team-style scenario Limits: web apps 12, apis 25, external ips 500 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=penetration-testing-as-a-service-subscription ## Vulnerability Management as a Service > From $1.5K / mo · Offensive Security · https://cisomarketplace.services/services/vulnerability-management-as-a-service Most organizations own a scanner and still carry a backlog nobody triages. We run authenticated internal and external scanning, prioritize by exploitability and business context rather than CVSS alone, open and track remediation tickets with your IT team or MSP, verify fixes and report the trend leadership and auditors want to see. ### In scope - Authenticated internal and external vulnerability scanning - Risk-based prioritization (KEV, EPSS, asset criticality) - Remediation ticketing and tracking with IT or your MSP - Fix verification and exception management - Monthly trend and SLA reporting ### Deliverables - Monthly prioritized remediation list - Open-risk and SLA dashboard - Exception register - Quarterly executive summary ### Tiers #### Essential VMaaS: $1.5K / month Up to 150 assets: monthly scanning, prioritized remediation list and monthly report Limits: devices 150 #### Advanced VMaaS: $3.5K / month Up to 750 assets: adds weekly scanning, ticketing integration, fix verification and exception management Limits: devices 750 #### Enterprise VMaaS: $7.5K / month Up to 3,000 assets across cloud and on-prem: adds cloud posture findings, remediation SLAs and a named remediation lead Limits: devices 3000 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=vulnerability-management-as-a-service ## API Security Assessment > From $12K · Offensive Security · https://cisomarketplace.services/services/api-security-assessment Comprehensive testing of API endpoints and integrations ### In scope - API inventory and documentation review (OpenAPI / GraphQL schemas) - Authentication and token handling (OAuth 2.0, JWT, API keys) - Object- and function-level authorization testing (OWASP API Security Top 10) - Input validation, mass assignment and injection testing - Rate limiting, quotas and abuse resistance - Gateway, logging and monitoring configuration review ### Deliverables - API security report mapped to the OWASP API Security Top 10 - Reproducible findings with requests and responses - Remediation guidance for developers and platform teams - Executive summary - Retest of fixed findings ### Tiers #### Core API Assessment: $12K Manual and automated security testing of 1 API with up to 25 endpoints and up to 2 user roles, against common API vulnerability classes (broken authorisation and authentication, injection, data exposure). Report plus 1 retest of fixed findings. Limits: apis 1 Includes: - 1 API, up to 25 endpoints - Up to 2 user roles - Common API vulnerability classes - Findings report with fix guidance - 1 retest round Excludes: - Third-party and internal integration testing - Detailed authentication and token flow review - Business logic abuse testing - Custom exploit development #### Advanced API Assessment: $20K Testing of up to 3 APIs with up to 75 endpoints in total and up to 4 user roles. Adds detailed review of authentication and token flows, business logic abuse, rate limiting, and testing of integration points such as webhooks and third-party connections. Limits: apis 3 Includes: - Up to 3 APIs, 75 endpoints total - Up to 4 user roles - Authentication and token flow review - Business logic and rate-limit testing - Integration point testing - 1 retest round Excludes: - Custom exploit development and chained attacks - API gateway and design architecture review - More than 1 retest round #### Enterprise API Assessment: $35K Testing of up to 10 APIs with up to 250 endpoints in total, all roles and all integrations. Adds custom exploit development, chained attack paths across services, API gateway configuration review and 2 retest rounds. Limits: apis 10 Includes: - Up to 10 APIs, 250 endpoints total - All user roles and integrations - Custom exploit development - Chained attack paths across services - API gateway configuration review - 2 retest rounds Excludes: - Web or mobile front-end testing - Source code review - Denial-of-service load testing - Continuous API monitoring ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=api-security-assessment ## Cloud Security Assessment > From $12K · Offensive Security · https://cisomarketplace.services/services/cloud-security-assessment Security evaluation of cloud infrastructure and configurations ### In scope - Cloud Infrastructure Review - Container Security Assessment - IAM Configuration Analysis - Network Security Groups Evaluation - Data Storage Security Review ### Deliverables - Cloud Security Report - Configuration Assessment Document - Security Best Practices Guide - Risk Mitigation Plan - Architecture Recommendations ### Tiers #### Basic Cloud Assessment: $12K Configuration review of 1 cloud provider, up to 3 accounts/subscriptions: IAM, network security groups, storage exposure and logging. Read-only access, tool-assisted plus manual validation. Limits: cloud accounts 3 Includes: - 1 cloud provider, up to 3 accounts/subscriptions - IAM, network security group and storage configuration review - Read-only, non-intrusive review - Findings report with risk mitigation plan Excludes: - Container and Kubernetes review - Benchmark mapping against a named framework - Active exploitation of cloud attack paths - Second cloud provider #### Advanced Cloud Assessment: $20K Configuration review of 1 cloud provider, up to 10 accounts/subscriptions, adding container workload review, architecture recommendations and a control-by-control check against 1 named framework. Limits: cloud accounts 10, frameworks 1 Includes: - 1 cloud provider, up to 10 accounts/subscriptions - Container and registry configuration review - Check against 1 named benchmark/framework - Architecture recommendations - Configuration assessment document per account Excludes: - Second or third cloud provider - Active exploitation / cloud penetration testing - Remediation work in your accounts #### Enterprise Cloud Assessment: $35K Multi-cloud assessment: up to 3 cloud providers and up to 25 accounts/subscriptions, with active testing of privilege-escalation and cross-account attack paths, container review and checks against up to 2 frameworks. Limits: cloud accounts 25, frameworks 2 Includes: - Up to 3 cloud providers, up to 25 accounts/subscriptions - Active testing of IAM privilege-escalation and cross-account paths - Container and orchestration review - Checks against up to 2 frameworks - Cross-cloud architecture recommendations Excludes: - Continuous monitoring after the engagement (see Cloud Security Monitoring) - Application-layer penetration testing of hosted apps - Remediation implementation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cloud-security-assessment ## Compliance Penetration Test > From $5.5K · Offensive Security · https://cisomarketplace.services/services/compliance-penetration-test Startups and smaller companies often need a real penetration test for an audit or a customer contract, not a multi-week offensive campaign. This is a fixed-scope, human-led test of one application or external perimeter with a report auditors accept, a retest of fixed findings and an attestation letter — the entry point to the Penetration Testing and Red Team services. ### In scope - One web application or API, or an external perimeter up to 25 IPs - Manual testing against OWASP Top 10 / ASVS and common misconfigurations - Authenticated testing with two user roles - Retest of remediated findings - Auditor- and customer-ready attestation letter ### Deliverables - Penetration test report with reproducible findings - Remediation guidance for developers - Retest results - Attestation letter ### Tiers #### Essential Compliance Pentest: $5.5K ONE target: a single web application or API with up to 2 user roles — alternatively an external perimeter of up to 25 IPs instead of the application, never both. Report, one retest and an attestation letter. Limits: web apps 1, apis 1, external ips 25 Excludes: - Internal network testing - Social engineering and physical testing - More than one target — that is the Advanced tier #### Advanced Compliance Pentest: $9.5K Web app plus API, or app plus external perimeter; adds cloud configuration spot-check and a findings walkthrough Limits: web apps 1, apis 2, external ips 50 Excludes: - Internal network testing - Social engineering and physical testing #### Enterprise Compliance Pentest: $14.5K Up to three applications or environments tested together, with a consolidated report for multiple frameworks Limits: web apps 3, apis 5, external ips 100 Excludes: - Internal network testing beyond a single segment - Red-team style objectives — see Red Team Assessment ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=compliance-penetration-test ## Email Security Assessment > From $25K · Offensive Security · https://cisomarketplace.services/services/email-security-assessment Comprehensive evaluation of your organization's email infrastructure, security controls, and policies to protect against phishing, business email compromise, and data loss. Our assessment identifies vulnerabilities and provides actionable recommendations to enhance your email security posture. ### In scope - Authentication protocol verification (SPF - DKIM - DMARC) - Anti-phishing control assessment - Email gateway configuration review - Data loss prevention analysis - Email retention policy evaluation - Account security assessment - Third-party integration review - User awareness testing ### Deliverables - Email security assessment report - Configuration improvement guide - Authentication protocol implementation plan - Phishing defense roadmap - Email security architecture recommendations - User awareness training recommendations - Policy enhancement guide ### Tiers #### Core Email Security Assessment: $25K Email security review for up to 500 mailboxes and 3 sending domains on one platform (Microsoft 365 or Google Workspace). Limits: users 500, domains 3 Includes: - Platform configuration review - SPF, DKIM and DMARC review - Prioritized hardening plan Excludes: - Staff email exercises - More than one email platform #### Advanced Email Defense Program: $45K Up to 2,500 mailboxes and 10 domains, including one staff email exercise and a review of mail-flow rules and third-party senders. Limits: users 2500, domains 10 Includes: - Everything in Basic - One staff email exercise - Third-party sender review Excludes: - Ongoing DMARC management — see Managed DMARC #### Enterprise Email Protection Suite: $75K Up to 10,000 mailboxes and 25 domains across multiple tenants or platforms; larger estates are scoped at kickoff. Limits: users 10000, domains 25 Includes: - Multi-tenant or hybrid mail estates - Two staff email exercises - Executive readout Excludes: - Migration or implementation work ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=email-security-assessment ## Embedded Systems Security Assessment > From $22K · Offensive Security · https://cisomarketplace.services/services/embedded-systems-security-assessment Deep-dive security evaluation of embedded systems, focusing on firmware security, hardware interfaces, and communication protocols specific to embedded devices. ### In scope - Hardware interface testing - Firmware reverse engineering - Debug port analysis - Boot sequence security review - Memory protection assessment - Secure boot verification - Side-channel attack testing ### Deliverables - Technical findings report - Hardware security analysis - Firmware vulnerability assessment - Debug protection recommendations - Secure boot implementation guide - Memory protection strategy - 60-day retest window ### Tiers #### Core Embedded Systems Assessment: $22K One device model and 1 firmware image: hardware interface and debug port testing, firmware extraction and reverse engineering, boot sequence and protocol review. Includes a retest. Limits: devices 1 Includes: - Hardware interface and debug port analysis (UART, JTAG, SWD) - Firmware extraction and reverse engineering - Boot sequence security review - Communication protocol review - 60-day retest window Excludes: - Side-channel attack testing - Secure boot bypass attempts - Memory protection deep dive - Companion app or cloud backend testing #### Advanced Embedded Security Program: $38K Up to 2 device models: everything in the basic tier, side-channel testing (power and timing), secure boot verification with bypass attempts, and memory protection assessment. Limits: devices 2 Includes: - Everything in the basic tier - Side-channel attack testing - Secure boot verification and bypass attempts - Memory protection assessment - Secure boot implementation guide Excludes: - Fault injection campaigns - Custom test fixtures and tooling - Secure development guidance for the product team #### Enterprise Embedded Security Solution: $65K Full-scope embedded security including custom testing tools, hardware security modules, and secure development guidance Limits: devices 4 Excludes: - Companion mobile app and cloud backend testing - Product certification lab testing - Firmware remediation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=embedded-systems-security-assessment ## Internal Network Assessment > From $20K · Offensive Security · https://cisomarketplace.services/services/internal-network-assessment Comprehensive onsite evaluation of internal network infrastructure and security controls ### In scope - Internal Network Architecture Review - Active Directory Assessment - Network Segmentation Testing - Privilege Escalation Testing ### Deliverables - Comprehensive Security Report - Network Architecture Review - Security Controls Assessment - Remediation Roadmap ### Tiers #### Core Network Assessment: $20K Internal network assessment of up to 250 hosts at one site, delivered remotely through a provided jump host or appliance. Limits: internal hosts 250, locations 1 Includes: - Internal network and directory review - Prioritized findings report - Remediation workshop Excludes: - External testing - More than one site - Retest #### Advanced Network Assessment: $35K Up to 1,000 hosts across up to 3 sites, including segmentation checks between sites and one retest. Limits: internal hosts 1000, locations 3 Includes: - Internal network and directory review - Segmentation checks - One retest Excludes: - External testing - Cloud environments #### Enterprise Network Assessment: $50K Up to 2,500 hosts across up to 5 sites, with a follow-up validation after the report. Limits: internal hosts 2500, locations 5 Includes: - Everything in Advanced - Follow-up validation at 90 days Excludes: - Continuous monitoring — this is a point-in-time engagement ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=internal-network-assessment ## IoT Security Assessment > From $10K · Offensive Security · https://cisomarketplace.services/services/iot-security-assessment Security testing of Internet of Things devices and infrastructure ### In scope - Device hardware and debug-interface review - Firmware extraction and analysis - Wireless and network communications (WiFi, Bluetooth, Zigbee, cellular as applicable) - Companion mobile application and cloud API testing - Update mechanism and secure-boot review - Default credentials, provisioning and lifecycle review ### Deliverables - IoT device security report with reproducible findings - Risk-rated findings per device model - Hardening guidance for engineering - Executive summary - Retest of fixed findings ### Tiers #### Basic IoT Assessment: $10K Security test of 1 IoT device model: network services, local interfaces, authentication, update mechanism and device-to-cloud traffic review, with architecture review and a findings report. No firmware extraction. Limits: devices 1 Includes: - Testing of 1 device model (network services, web/local interfaces) - Authentication and default credential checks - Update mechanism and traffic encryption review - Security architecture review - Report, executive summary and follow-up consultation Excludes: - Firmware extraction and reverse engineering - Hardware teardown (UART/JTAG) - Companion mobile app and cloud API testing - Retest #### Advanced IoT Assessment: $18K Security test of up to 3 device models. Adds firmware extraction and analysis, hardware interface testing (UART/JTAG/debug ports), wireless protocol review, and one retest. Limits: devices 3 Includes: - Everything in the Basic tier, for up to 3 device models - Firmware extraction, static analysis and secrets review - Hardware debug interface testing - Wireless protocol review (e.g. BLE, Zigbee, Wi-Fi) - One retest of fixed findings Excludes: - Companion mobile app testing - Cloud backend / API penetration testing - Network-wide deployment analysis #### Enterprise IoT Assessment: $30K Ecosystem assessment: up to 6 device models plus 1 companion mobile app, 1 cloud API/backend and the deployment network. Includes firmware analysis, device-to-cloud trust review, network segmentation analysis, compliance mapping and an implementation roadmap. Limits: devices 6, mobile apps 1, apis 1 Includes: - Everything in the Advanced tier, for up to 6 device models - Testing of 1 companion mobile app - Testing of 1 cloud API / backend - Deployment network and segmentation analysis - Compliance mapping and implementation roadmap - One retest Excludes: - Hardening implementation and monitoring setup (see IoT Security Hardening Program) - Industrial / OT environments (see IIoT Security Assessment) - More than 6 device models ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=iot-security-assessment ## Mobile Application Security Assessment > From $10K · Offensive Security · https://cisomarketplace.services/services/mobile-application-security-assessment Comprehensive security testing of iOS and Android applications ### In scope - iOS and Android application testing against OWASP MASVS - Local data storage, keychain / keystore and cryptography review - Authentication, session and authorization testing - Backend API testing for the application - Reverse-engineering resistance and tamper checks - Third-party SDK and permission review ### Deliverables - Mobile application security report mapped to OWASP MASVS - Reproducible findings with risk ratings - Developer remediation guidance - Executive summary - Retest of fixed findings ### Tiers #### Basic Assessment: $10K Security test of 1 mobile app on 1 platform (a single iOS build or a single Android build): static and dynamic analysis of the app binary, local storage, authentication, and app-to-server traffic. One retest. Limits: mobile apps 1 Includes: - 1 app, 1 platform build - Static and dynamic analysis of the binary - Local data storage, auth and session checks - Traffic interception of app-to-server calls - One retest of fixed findings Excludes: - Second platform build - Dedicated backend API penetration test - Source code review - CI/CD integration of SAST/DAST #### Advanced Assessment: $15K Security test of 1 mobile app on both platforms (iOS and Android builds) plus its 1 backend API (up to 50 endpoints), with dependency analysis and source-assisted review where code is provided. One retest. Limits: mobile apps 2, apis 1 Includes: - iOS and Android builds of 1 app (2 builds) - 1 backend API, up to 50 endpoints - Third-party dependency/SDK analysis - Source-assisted review where code is supplied - One retest of fixed findings Excludes: - Additional apps - Internal network testing - Social engineering - Ongoing testing of new releases ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=mobile-application-security-assessment ## Penetration Testing > From $8K · Offensive Security · https://cisomarketplace.services/services/penetration-testing Comprehensive penetration testing service including network, application, and infrastructure security assessment. Includes detailed reporting and remediation guidance. ### In scope - Scoping, rules of engagement and testing windows - External network testing of internet-facing systems - Web application testing (authenticated, by user role) - Internal network testing (Standard and Premium tiers) - Staff-targeted and on-site testing (Premium tier) - Retest of remediated findings ### Deliverables - Penetration test report with reproducible findings and risk ratings - Executive summary - Remediation guidance per finding - Findings walkthrough with your technical team - Retest results and attestation letter ### Tiers #### Basic (External only): $8K External testing only: up to 25 internet-facing IPs and 1 web application with up to 2 user roles. Report, one retest and an attestation letter. Limits: external ips 25, web apps 1, locations 1 Includes: - External network testing - One web application - Report and findings walkthrough - One retest Excludes: - Internal network testing - Staff-targeted and on-site testing - More than one application #### External Plus (External only): $12.5K External testing only, for a larger perimeter: up to 100 internet-facing IPs and 1 web application with up to 2 user roles. Report, one retest and an attestation letter. Limits: external ips 100, web apps 1, locations 1 Includes: - External network testing of up to 100 IPs - One web application - Report and findings walkthrough - One retest Excludes: - Internal network testing - Staff-targeted and on-site testing - More than one application #### Standard (External + Internal): $15K External and internal testing: up to 50 internet-facing IPs, up to 2 web applications and an internal network of up to 250 hosts at one site. Limits: external ips 50, web apps 2, internal hosts 250, locations 1 Includes: - External network testing - Internal network testing at one site - Up to two web applications - Report, walkthrough and one retest Excludes: - Staff-targeted and on-site testing - More than one site #### Premium (Full scope + Social Engineering): $25K External, internal, staff-targeted and on-site testing: up to 100 internet-facing IPs, 3 web applications, 500 internal hosts and 2 sites. Limits: external ips 100, web apps 3, internal hosts 500, locations 2 Includes: - External and internal network testing - Up to three web applications - One staff-targeted email exercise - On-site testing at up to two sites Excludes: - Objective-based adversary simulation — see Red Team Assessment - Environments above 500 hosts — scoped separately ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=penetration-testing ## Red Team Assessment > From $25K · Offensive Security · https://cisomarketplace.services/services/red-team-assessment Advanced adversary simulation to test your security controls ### In scope - Objectives and rules of engagement agreed with an executive sponsor - Threat-informed scenario design - Objective-based adversary simulation across people, process and technology - Measurement of detection and response by your defensive team - Joint replay session with the defensive team ### Deliverables - Engagement narrative: what was attempted, what worked, what was detected - Detection and response timeline - Prioritized improvement plan for prevention, detection and response - Executive and board-level summary - Debrief and replay session ### Tiers #### Basic Red Team: $25K One objective at one site, using standard scenarios agreed at kickoff. Limits: scenarios 1, locations 1 Includes: - One agreed objective - Executive and technical report - Debrief with the defensive team Excludes: - Custom tooling - On-site activity at more than one site #### Advanced Red Team: $44K Up to 2 objectives with scenarios tailored to the organization, across up to 2 sites. Limits: scenarios 2, locations 2 Includes: - Up to two objectives - Tailored scenarios - Detection and response timeline for the defensive team Excludes: - Engagements longer than 4 weeks #### Enterprise Red Team: $62.5K Up to 3 objectives across up to 3 sites, with a joint replay session for the defensive team. Limits: scenarios 3, locations 3 Includes: - Up to three objectives - Joint replay session - Board-level summary Excludes: - Ongoing adversary simulation — see Red Team Subscription ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=red-team-assessment ## SMB Security Essentials > From $5K · Offensive Security · https://cisomarketplace.services/services/smb-security-essentials Comprehensive security assessment tailored for growing businesses with complex infrastructure. ### In scope - External/Internal network penetration test - Web application assessment (1 application) - Active Directory security review - Cloud configuration review (AWS/Azure/GCP) - Compliance gap analysis ### Deliverables - Detailed technical report - Cloud security scorecard - AD security metrics - Web app vulnerability assessment - 1-hour findings review ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-security-essentials ## SMB Security Quickscan > From $2.5K · Offensive Security · https://cisomarketplace.services/services/smb-security-quickscan Rapid security assessment designed for small businesses needing basic security validation. ### In scope - External vulnerability scan (up to 256 IPs) - Basic phishing campaign (up to 100 employees) - Critical findings summary - Executive recommendations ### Deliverables - High-level findings report - Phishing statistics dashboard - 30-minute executive briefing - Basic remediation checklist ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-security-quickscan ## Security Awareness Program Assessment > From $28K · Offensive Security · https://cisomarketplace.services/services/security-awareness-program-assessment Comprehensive evaluation of your organization's security awareness and training initiatives, measuring effectiveness, cultural impact, and behavior change. Our assessment identifies gaps in your human security controls and provides a strategic roadmap for creating a security-conscious workforce that actively defends against social engineering and other human-targeted attacks. ### In scope - Training content evaluation - Awareness program effectiveness - Phishing simulation results analysis - Security culture assessment - Behavior change measurement - Training delivery methods - Executive engagement review - Compliance training adequacy ### Deliverables - Security awareness program report - Gap analysis and recommendations - Phishing simulation plan - Training content enhancement strategy - Security culture development roadmap - Metrics and measurement framework - Role-based training recommendations ### Tiers #### Essential Security Awareness Review: $28K Assessment of the awareness program for up to 500 staff. Limits: employees 500 Includes: - Program and content review - Metrics baseline - Improvement plan Excludes: - Running simulations for you #### Comprehensive Awareness Program Development: $48K Up to 2,000 staff, including a measured simulation and role-based gap analysis. Limits: employees 2000 Includes: - Measured simulation - Role-based gap analysis Excludes: - Ongoing program operation #### Enterprise Security Culture Program: $75K Up to 10,000 staff across regions; larger organizations are scoped at kickoff. Limits: employees 10000 Includes: - Multi-region program review - Executive and board reporting design Excludes: - Ongoing program operation — see Managed Security Awareness ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=security-awareness-program-assessment ## Vehicle Security Assessment > From $28K · Offensive Security · https://cisomarketplace.services/services/vehicle-security-assessment Comprehensive security assessment of modern vehicles, including CAN bus analysis, telematics systems, and connected car features. ### In scope - CAN bus security analysis - Telematics system testing - Bluetooth/WiFi interface assessment - Mobile app security review - Key fob security testing - OBD-II port security - ECU security assessment ### Deliverables - Vehicle security report - CAN bus vulnerability analysis - Wireless security findings - Mobile app security review - Key fob security recommendations - ECU security guidance - 90-day follow-up assessment ### Tiers #### Core Vehicle Security Assessment: $28K Essential vehicle security covering basic CAN bus analysis, telematics testing, and fundamental wireless security #### Advanced Vehicle Security Program: $48K Comprehensive assessment including detailed ECU analysis, advanced key fob testing, and complete mobile app security #### Enterprise Vehicle Security Solution: $75K Full-scope vehicle security with custom testing tools, advanced protocol analysis, and complete telematics protection ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=vehicle-security-assessment ## Vulnerability Management Maturity Assessment > From $34K · Offensive Security · https://cisomarketplace.services/services/vulnerability-management-maturity-assessment Comprehensive evaluation of your organization's vulnerability management program maturity, effectiveness, and integration with security operations. Our assessment examines scanning coverage, patch management processes, risk-based prioritization, and remediation workflows to identify program gaps and provide a roadmap for enhanced vulnerability risk reduction. ### In scope - Vulnerability scanning coverage assessment - Patch management process evaluation - Vulnerability prioritization methodology review - Remediation workflow assessment - Mean time to remediate analysis - Vulnerability tracking process evaluation - Risk acceptance process review - False positive management assessment - Asset inventory completeness evaluation - Vulnerability management governance - Tool effectiveness assessment - Integration with development workflows ### Deliverables - Vulnerability management maturity report - Program gap analysis - Scanning coverage recommendations - Prioritization framework optimization - Remediation process enhancements - MTTR improvement strategy - Governance model recommendations - Tool optimization guidance - DevSecOps integration roadmap - Metrics and KPI framework - Implementation timeline ### Tiers #### Essential Vulnerability Program Assessment: $34K Maturity assessment of a vulnerability management program covering up to 1,000 assets. Limits: devices 1000, locations 2 Includes: - Process and tooling review - Maturity score - Roadmap Excludes: - Running the scans for you #### Advanced Vulnerability Management Program: $60K Up to 5,000 assets, including cloud, with SLA and metrics design. Limits: devices 5000, locations 5 Includes: - Cloud coverage - SLA and metrics design Excludes: - Tool implementation #### Enterprise Vulnerability Program Transformation: $90K Up to 25,000 assets across business units, with an operating model and tooling selection. Limits: devices 25000, locations 15 Includes: - Operating model - Tooling selection support Excludes: - Ongoing operation — see Vulnerability Management as a Service ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=vulnerability-management-maturity-assessment ## Web Application Security Assessment > From $8K · Offensive Security · https://cisomarketplace.services/services/web-application-security-assessment In-depth testing of web applications for security vulnerabilities ### In scope - Authenticated testing by user role against OWASP ASVS and the OWASP Top 10 - Authentication, session management and access-control testing - Input handling and injection testing - Business-logic abuse cases - API endpoints used by the application - Configuration, headers and transport security review ### Deliverables - Web application security report with reproducible findings - Risk-rated findings mapped to OWASP ASVS - Developer remediation guidance - Executive summary - Retest of fixed findings ### Tiers #### Basic Web App Assessment: $8K Grey-box penetration test of 1 web application with up to 2 user roles: authenticated and unauthenticated testing against common web vulnerability classes, manual validation of findings. No separate API testing. One retest. Limits: web apps 1 Includes: - 1 web application, up to 2 user roles - Authenticated and unauthenticated testing - Manual validation of scanner findings - Vulnerability report with fixes - One retest of fixed findings Excludes: - Dedicated API testing - Source code review - More than 2 user roles - Ongoing scanning after the test #### Advanced Web App Assessment: $15K Penetration test of 1 web application with up to 5 user roles plus 1 API (up to 50 endpoints): business logic and access-control testing across roles, API authz testing, dependency analysis. One retest. Limits: web apps 1, apis 1 Includes: - 1 web application, up to 5 user roles - 1 API, up to 50 endpoints - Business logic and cross-role access control testing - Dependency analysis - One retest of fixed findings Excludes: - Additional applications - Ongoing scanning after the test - Source code review - CI/CD SAST/DAST integration #### Premium Web App Assessment: $25K Full-scope web application testing with continuous monitoring Limits: web apps 2, apis 3 Excludes: - Full manual re-test each month - Mobile app testing - Fixing the code - Infrastructure/network penetration testing ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=web-application-security-assessment ## Wireless Network Assessment > From $8K · Offensive Security · https://cisomarketplace.services/services/wireless-network-assessment Evaluate the security of your wireless infrastructure through comprehensive onsite testing ### In scope - Wireless Network Architecture Review - Access Point Security Assessment - Wireless Protocol Analysis - Signal Coverage Mapping ### Deliverables - Network Security Report - Coverage Analysis Maps - Configuration Recommendations - Security Improvement Plan ### Tiers #### Essential Wireless Assessment: $8K Wireless assessment of one office: up to 5 networks (SSIDs). Limits: locations 1, devices 5 Includes: - One office - Configuration and coverage review - Findings report Excludes: - More than one site - Non-WiFi radio protocols #### Advanced Wireless Assessment: $15K Up to 3 sites and 15 networks, including guest and IoT segmentation checks. Limits: locations 3, devices 15 Includes: - Up to three sites - Segmentation checks Excludes: - Non-WiFi radio protocols #### Enterprise Wireless Assessment: $25K Campus or up to 6 sites and 40 networks, with a retest. Limits: locations 6, devices 40 Includes: - Campus or multi-site - One retest Excludes: - Custom radio research — see Wireless Infrastructure Attack Assessment ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=wireless-network-assessment --- # Practice: AI Security Red teaming for LLM applications and agents, security for the pipelines behind them, and governance your auditors and board will accept. Delivered by an Anthropic Claude Partner and OpenAI TAC-verified firm. ## AI & Agentic Red Team > Scoped per engagement · AI Security · https://cisomarketplace.services/services/ai-agentic-red-team Offensive testing of LLMs and AI agents — prompt injection, jailbreaks, tool misuse, agent goal hijack, memory/context poisoning, model extraction, and agent identity abuse. Mapped to OWASP Top 10 for Agentic Applications, OWASP LLM Top 10, and MITRE ATLAS. ### In scope - Prompt injection & jailbreak testing - Agent tool misuse & goal hijack - Memory/context poisoning - Model extraction & inference attacks - Agent identity & privilege abuse - MCP/tool-connection abuse - OWASP Agentic + MITRE ATLAS mapping ### Deliverables - AI red team report - OWASP/ATLAS-mapped findings - Exploit chains & PoCs - Guardrail & mitigation recommendations - Re-test of fixes ### Tiers #### Essential: scoped Adversarial testing of 1 AI application or agent. Limits: ai systems 1 Includes: - One AI application or agent - Findings report - Fix guidance Excludes: - Tool and connector integrations beyond the first #### Advanced: scoped Up to 3 AI applications or agents, including their tool and data connections. Limits: ai systems 3 Includes: - Up to three systems - Tool and data connections Excludes: - Ongoing testing #### Enterprise: scoped Up to 8 systems, multi-agent workflows and a retest after fixes. Limits: ai systems 8 Includes: - Up to eight systems - Multi-agent workflows - Retest Excludes: - Continuous testing — scoped as a subscription ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ai-agentic-red-team ## AI/ML Security Assessment > From $42K · AI Security · https://cisomarketplace.services/services/ai-ml-security-assessment Expert evaluation of artificial intelligence and machine learning systems security, from model development to deployment. Our assessment identifies vulnerabilities in AI/ML infrastructure, examines risks of data poisoning, adversarial attacks, and model manipulation while providing guidance for securing these advanced technologies. ### In scope - ML pipeline security review - Training data integrity assessment - Model vulnerability testing - Adversarial attack simulation - Model poisoning resistance evaluation - Inference attack testing - AI infrastructure security assessment - Model governance review ### Deliverables - AI/ML security assessment report - Vulnerability analysis - Adversarial defense recommendations - Security control framework - Data poisoning protection strategy - Model security architecture - Secure AI/ML development practices - Governance and compliance guidance ### Tiers #### Essential AI/ML Security Review: $42K Security assessment of 1 AI system: model, data pipeline and hosting. Limits: ai systems 1 Includes: - One AI system - Risk register - Hardening plan Excludes: - Adversarial testing of the model #### Advanced AI/ML Security Program: $75K Up to 3 AI systems, including adversarial testing of one of them. Limits: ai systems 3 Includes: - Up to three AI systems - Adversarial testing of one system Excludes: - Ongoing monitoring #### Enterprise AI/ML Security Framework: $120K Up to 8 AI systems with an AI security standard for the organization. Limits: ai systems 8 Includes: - Up to eight AI systems - Organization-wide AI security standard Excludes: - Portfolios above eight systems — scoped ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ai-ml-security-assessment ## Generative AI Security Assessment > From $48K · AI Security · https://cisomarketplace.services/services/generative-ai-security-assessment Comprehensive security assessment for organizations implementing or developing generative AI systems. Our specialized evaluation examines unique security risks of large language models, generative image systems, and other AI tools, including prompt injection vulnerabilities, training data poisoning, model security, and output filtering controls to ensure the safe deployment of this transformative technology. ### In scope - Prompt injection vulnerability testing - AI model security assessment - Training data security evaluation - Output filtering and safety controls - Adversarial attack simulation - Model hallucination analysis - Intellectual property protection - GenAI integration security - Authentication and access controls - AI governance framework review ### Deliverables - GenAI security assessment report - Prompt injection vulnerability findings - Model security recommendations - Training data protection framework - Output safety control enhancements - Deployment security architecture - Integration security guidelines - GenAI security governance recommendations - Risk mitigation roadmap ### Tiers #### Essential GenAI Security Assessment: $48K Security assessment of up to 2 GenAI applications built on third-party models (e.g. a chatbot and a copilot). Prompt injection and output-filter testing, access control review, integration review and a governance gap check. Limits: ai systems 2 Includes: - Prompt injection and jailbreak testing against up to 2 applications - Output filtering and safety control review - Authentication and access control review of the GenAI integration - AI governance policy gap check - Findings report and risk mitigation roadmap Excludes: - RAG pipeline and agent/tool-use layer testing - Training data and fine-tuning pipeline review - Assessment of self-hosted or custom-trained models - Retest after remediation #### Advanced GenAI Security Program: $85K Assessment of up to 5 GenAI systems across application, RAG and agent layers. Custom prompt injection test cases per system, adversarial attack simulation, hallucination analysis, training/fine-tuning data handling review, and one retest. Limits: ai systems 5 Includes: - Everything in the Essential tier, for up to 5 systems - RAG data store and agent/tool-use abuse testing - Custom prompt injection test suite per system - Training and fine-tuning data security review - Deployment security architecture recommendations - One retest within 30 days of remediation Excludes: - Security architecture for custom-trained foundation models - Model theft / IP extraction testing of self-hosted models - Organization-wide GenAI governance framework build-out #### Enterprise GenAI Security Framework: $135K For organizations training or hosting their own models: up to 10 GenAI systems, model supply chain and training data poisoning review, model extraction/IP protection testing, model security architecture, and a written GenAI governance framework. Limits: ai systems 10 Includes: - Everything in the Advanced tier, for up to 10 systems - Training data poisoning and model supply chain review - Model extraction and intellectual property protection testing - Model hosting and deployment security architecture - GenAI security governance framework with roles and review gates - Executive briefing and one retest Excludes: - Ongoing / continuous AI red teaming after the engagement - Remediation engineering or guardrail implementation - More than 10 systems (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=generative-ai-security-assessment ## MCP & Agent Tool-Chain Security Assessment > Scoped per engagement · AI Security · https://cisomarketplace.services/services/mcp-agent-tool-chain-security-assessment Assess the security of agent tool-chains: MCP servers, tool/function connections, inter-agent communication, and the authz/credential model behind agent actions. ### In scope - MCP server security review - Tool/function connection authz - Inter-agent communication security - Credential & token scoping for tools - Supply-chain of agent tools ### Deliverables - MCP/tool-chain security report - Authz & credential findings - Inter-agent comms recommendations - Hardening guide ### Tiers #### Essential: scoped Review of 1 agent system with up to 3 MCP servers and up to 15 tool/function connections: server configuration, tool authorization checks and credential/token scoping. Design and configuration review. Limits: ai systems 1 Includes: - 1 agent system, up to 3 MCP servers - Up to 15 tool/function connections - Tool authz and credential scoping review - Findings report and hardening guide Excludes: - Inter-agent communication review - Tool supply-chain analysis - Hands-on abuse testing of tools - Ongoing monitoring #### Advanced: scoped Assessment of up to 5 agent systems with up to 10 MCP servers and up to 50 tool connections: authz, credential scoping, inter-agent communication, tool supply chain, and hands-on abuse testing of tool calls. Limits: ai systems 5 Includes: - Up to 5 agent systems, up to 10 MCP servers - Up to 50 tool/function connections - Inter-agent communication security review - Supply-chain review of third-party tools - Hands-on tool-abuse and privilege testing Excludes: - Ongoing monitoring of new tools and servers - Remediation implementation - Model-level red teaming (jailbreak/safety testing) #### Enterprise: scoped Continuous agent-supply-chain monitoring Excludes: - Remediation implementation - Model-level red teaming ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=mcp-agent-tool-chain-security-assessment ## Non-Human & Machine Identity Security > Scoped per engagement · AI Security · https://cisomarketplace.services/services/non-human-machine-identity-security Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle. ### In scope - Secrets & API key inventory - Service & workload identity review - AI agent identity & privilege - Rotation & lifecycle governance - Least-privilege & vaulting ### Deliverables - NHI security assessment report - Identity inventory & risk ranking - Secrets governance plan - Lifecycle & rotation recommendations ### Tiers #### Essential: scoped Point-in-time review for up to 3 cloud accounts and up to 25 repositories: inventory of secrets, API keys and service accounts, exposure and over-privilege findings, and a risk-ranked inventory with rotation recommendations. Limits: cloud accounts 3, repositories 25 Includes: - Secrets and API key inventory - Service account privilege review - Repository secret scanning - Risk-ranked identity inventory - Rotation recommendations Excludes: - Workload identities (Kubernetes, CI/CD, cloud roles) - AI agent identities - Secrets governance plan and lifecycle policy - Vault implementation #### Advanced: scoped Assessment for up to 10 cloud accounts and up to 100 repositories. Adds workload identities (CI/CD, Kubernetes, cloud roles) and AI agent identities and their privileges, a secrets governance plan, lifecycle and rotation policy, and least-privilege and vaulting design. Limits: cloud accounts 10, repositories 100 Includes: - Everything in Essential at the larger scope - Workload identity review - AI agent identity and privilege review - Secrets governance plan - Lifecycle and rotation policy - Vaulting and least-privilege design Excludes: - Ongoing inventory refresh - Vault or secrets manager implementation - Rotating credentials on the client's behalf #### Enterprise: scoped Continuous machine-identity governance program Excludes: - Vault or secrets manager licences - Rotating credentials on the client's behalf ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=non-human-machine-identity-security ## AI Governance & TRiSM Program > Scoped per engagement · AI Security · https://cisomarketplace.services/services/ai-governance-trism-program Stand up AI governance (TRiSM): inventory AI systems, classify risk, map to EU AI Act / NIST AI RMF / ISO 42001, and operate ongoing AI risk, trust, and security management with human oversight. ### In scope - AI system inventory & risk classification - EU AI Act / NIST AI RMF / ISO 42001 mapping - AI policy & oversight framework - Model risk & bias governance - Ongoing AI risk management ### Deliverables - AI governance framework - AI Act/RMF/42001 gap analysis - AI risk register - Oversight & policy pack ### Tiers #### Essential: scoped Inventory and risk classification of up to 10 AI systems and a gap analysis against 1 framework chosen from EU AI Act, NIST AI RMF and ISO 42001. Delivers the inventory, risk tiers and gap list. Limits: ai systems 10, frameworks 1 Includes: - Up to 10 AI systems inventoried - Risk classification per system - Gap analysis against 1 framework - Prioritized gap list Excludes: - AI policy and oversight framework - AI risk register - Model risk and bias governance - Ongoing risk management #### Advanced: scoped AI governance framework for up to 25 AI systems: inventory and classification, mapping to EU AI Act, NIST AI RMF and ISO 42001 (3 frameworks), AI policy and oversight pack, model risk and bias governance, and an AI risk register. Limits: ai systems 25, frameworks 3 Includes: - Up to 25 AI systems - Mapping to 3 frameworks - AI policy and oversight pack - Model risk and bias governance procedures - AI risk register Excludes: - Operating the program after handover - Oversight board facilitation - Technical model testing or red teaming #### Enterprise: scoped Continuous AI TRiSM program with oversight board Limits: frameworks 3, sessions 4 Excludes: - Technical model testing or red teaming - Legal advice or regulatory filings - Certification audit fees ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ai-governance-trism-program ## ISO/IEC 42001 & EU AI Act Readiness > From $7.5K · AI Security · https://cisomarketplace.services/services/iso-42001-eu-ai-act-readiness Organizations building or deploying AI are being asked for ISO/IEC 42001 certification and EU AI Act conformity. This engagement inventories your AI systems, classifies them under the AI Act risk tiers, assesses the AI management system against ISO 42001 Annex A, and produces the policies, impact assessments and roadmap needed to reach certification readiness. ### In scope - AI system inventory and EU AI Act risk classification - ISO/IEC 42001 clause and Annex A gap analysis - AI risk and impact assessment method - AI policy, roles and lifecycle controls - Certification readiness roadmap ### Deliverables - AI system register with risk tiers - ISO 42001 gap analysis - AI governance policy set - Readiness roadmap and audit preparation plan ### Tiers #### Essential AI Governance Gap Analysis: $7.5K Up to 5 AI systems: inventory, AI Act classification and ISO 42001 gap analysis Limits: ai systems 5 #### Advanced ISO 42001 Readiness: $18K Up to 20 AI systems: adds policy set, impact assessment method, role design and internal-audit preparation Limits: ai systems 20 #### Enterprise AI Management System Program: $38K Portfolio of AI systems or high-risk AI: adds conformity documentation, supplier controls, training and certification-audit support Limits: ai systems 100 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=iso-42001-eu-ai-act-readiness ## Phase 0 — Enterprise AI Risk Assessment > From $17.5K · AI Security · https://cisomarketplace.services/services/phase-0-enterprise-ai-risk-assessment The six pillars of the AI security program are not sold off a shelf — they are built into your ecosystem, and that requires knowing the ecosystem first. Phase 0 is a scoped, fixed-fee assessment that maps your environment end to end: every AI system in use (sanctioned and shadow), the DevSecOps reality, the data and identity stack, the SIEM / EDR / tooling landscape, and where testing should start. It defines how each pillar gets built for you (BYOK and open-source first, commercial upgrades where they earn their place), designs the integration seams into what you already run, and plans the deployment topology for distributed sites. The output is the current-state map, the future-state design and a sequenced build plan — and only then does the program get a number. CISO Marketplace members get the Phase 0 fee credited toward the program if they proceed. ### In scope - AI and security footprint map: sanctioned and shadow AI, data, identity, SIEM / EDR and tooling - Functional model for each of the six pillars (BYOK and open-source first) - Integration seams into the platforms and tools you already run - Deployment topology for distributed sites and segments - Sequenced, risk-ordered build plan for the pillars ### Deliverables - Current-state ecosystem map - Future-state program architecture - Sequenced build plan with the entry-point pillars - Executive readout and build vault hand-over ### Tiers #### Essential Phase 0: $17.5K One business unit or platform, up to ~250 employees, delivered remotely: footprint map, pillar model and sequenced build plan Limits: employees 250, locations 1 Excludes: - On-site week - Sibling entities or additional platforms - Distributed collection-plane design #### Standard Phase 0: $30K The standard engagement: 10 business days with week 1 on site, the full ecosystem map, integration seams, deployment topology and the executive readout Limits: employees 2500, locations 5 Excludes: - Sibling entities or additional platforms - Board-level readout #### Enterprise Phase 0: $45K Multi-site, multi-entity or regulated enterprises: adds sibling entities or platforms, the distributed collection-plane design and a board-level readout Limits: employees 25000, locations 50 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=phase-0-enterprise-ai-risk-assessment ## Secure AI/ML Infrastructure Assessment > From $16.5K · AI Security · https://cisomarketplace.services/services/secure-aiml-infrastructure-assessment Comprehensive security assessment and hardening program for artificial intelligence and machine learning infrastructures, focusing on model security, data protection, and adversarial defense. ### In scope - Model security assessment - Training pipeline security - Data privacy evaluation - Adversarial attack testing - Infrastructure hardening ### Deliverables - AI security architecture document - Model protection guidelines - Data security controls - Adversarial defense playbook - Security monitoring framework - Implementation roadmap ### Tiers #### Entry — market-sized scope: $16.5K Point-in-time audit of 1 AI system (one model or one LLM application) in 1 cloud account: threat model, adversarial testing of the deployed endpoint, and a data-exposure check. Findings report only. Limits: ai systems 1, cloud accounts 1 Includes: - 1 AI system - Threat model - Adversarial testing of the deployed endpoint - Data exposure check - Findings report with fixes Excludes: - Training pipeline review - Infrastructure hardening - AI security architecture document - Retest #### Core AI/ML Security Assessment: $75K Up to 3 AI systems in 1 cloud account: model security assessment, training pipeline review, data privacy evaluation, adversarial testing of each system and hosting infrastructure hardening review. Delivers all six documents. Limits: ai systems 3, cloud accounts 1 Includes: - Up to 3 AI systems - Training pipeline security review - Data privacy evaluation - Adversarial testing per system - AI security architecture document - Implementation roadmap Excludes: - MLOps toolchain and CI/CD testing - Multi-layer testing of RAG and agent components - Custom protection tooling - Hands-on hardening work #### Advanced AI/ML Security Program: $125K Up to 5 AI systems across up to 3 cloud accounts: adds adversarial testing across application, RAG and agent layers, training pipeline and MLOps toolchain testing, poisoning and model-theft scenarios, and one retest. Limits: ai systems 5, cloud accounts 3 Includes: - Up to 5 AI systems - App, RAG and agent layer adversarial testing - MLOps and training pipeline testing - Poisoning and model-theft scenarios - One retest - Adversarial defense playbook Excludes: - Custom detection or guardrail tooling - Monitoring implementation - Hands-on infrastructure hardening #### Enterprise AI/ML Security Platform: $195K Up to 10 AI systems across up to 5 cloud accounts: Advanced scope plus custom guardrail and detection tooling, security monitoring implemented for the model estate, and hands-on hardening of the ML infrastructure. Limits: ai systems 10, cloud accounts 5 Includes: - Up to 10 AI systems - Custom guardrail and detection tooling - Monitoring framework implemented - Hands-on infrastructure hardening - Everything in the Advanced tier Excludes: - Ongoing managed monitoring after handover - Tool licence costs - Model retraining ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=secure-aiml-infrastructure-assessment ## AI-Powered Compliance Analysis Suite > From $3.5K / mo · AI Security · https://cisomarketplace.services/services/ai-powered-compliance-suite AI-driven solution to navigate complex regulatory compliance landscapes, offering automated analysis and recommendations for compliance management. ### In scope - Automated compliance monitoring - Regulatory change tracking - Risk assessment automation - Control effectiveness analysis - Compliance gap identification ### Deliverables - Monthly compliance reports - Real-time compliance dashboard - Automated alerts and notifications - Remediation recommendations - Compliance metrics and KPIs ### Tiers #### Single Framework License: $3.5K / month Monthly subscription covering 1 regulatory framework: automated control monitoring, gap identification, control-effectiveness analysis and regulatory change tracking for that framework, with dashboard, alerts and one monthly report. Limits: frameworks 1 Includes: - 1 framework monitored - Compliance dashboard and automated alerts - Monthly compliance report with KPIs - Remediation recommendations for identified gaps - Regulatory change tracking for that framework Excludes: - Second or further frameworks - Cross-framework control mapping - Audit or certification fees and auditor liaison - Hands-on remediation of gaps #### Multi-Framework License: $7.5K / month Monthly subscription covering up to 3 regulatory frameworks, with shared controls mapped across them so one piece of evidence is analysed once. Dashboard, alerts and a monthly report per framework plus a consolidated gap list. Limits: frameworks 3 Includes: - Up to 3 frameworks monitored - Cross-framework control mapping - Consolidated gap and remediation list - Monthly report per framework - Regulatory change tracking across all 3 Excludes: - Fourth or further frameworks - Custom or internal control frameworks - Audit or certification fees - Hands-on remediation of gaps #### Unlimited Framework License: $15K / month Monthly subscription with no fixed cap on frameworks; the framework list is scoped at onboarding and can be extended during the term. Adds custom or internal control sets mapped alongside the regulatory frameworks, and a consolidated monthly report. Includes: - No fixed framework cap, scoped at onboarding - Custom and internal control frameworks - Cross-framework control mapping - Consolidated monthly report and KPIs - New frameworks added during the term Excludes: - Audit or certification fees - Hands-on remediation of gaps - Acting as the named compliance officer ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ai-powered-compliance-suite ## AI-SOC / Managed Agentic Security Services (MASS) > Scoped per engagement · AI Security · https://cisomarketplace.services/services/ai-soc-managed-agentic-security-services-mass An AI-native managed detection & response service: AI agents handle triage/investigation with identity + business context, human threat hunters and responders own escalation and response — beyond traditional MDR. ### In scope - AI-assisted alert triage & investigation - Identity + business-context enrichment - Human-led threat hunting - Incident response & containment - Detection engineering ### Deliverables - Managed AI-SOC service - Monthly detection/response reports - Threat hunt findings - IR coordination ### Tiers #### Essential: scoped Core AI-SOC monitoring + triage Limits: devices 500, users 500 Excludes: - Human-led threat hunting - Incident response and containment actions - Custom detection engineering #### Advanced: scoped Full MASS with human hunters + IR Limits: devices 2500, users 2500 Excludes: - Dedicated analyst pod - On-site incident response and forensics - Security tooling licences #### Enterprise: scoped Enterprise AI-SOC with dedicated pod + 24/7 Excludes: - Security tooling and data platform licences - Legal, PR and breach notification services - On-site forensics beyond the agreed IR scope ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ai-soc-managed-agentic-security-services-mass ## Microsoft 365 Copilot & GenAI Data-Oversharing Readiness > From $12.5K · AI Security · https://cisomarketplace.services/services/m365-copilot-genai-data-oversharing-readiness Copilot and other GenAI assistants answer with whatever a user can technically reach. This engagement maps overshared SharePoint, OneDrive and Teams content, stale and broken permissions, sensitivity labelling gaps and risky sites, then delivers the remediation and governance plan that makes a Copilot rollout defensible — including an AI acceptable-use policy and the Purview controls to enforce it. ### In scope - Permission and sharing analysis across SharePoint, OneDrive and Teams - Sensitive data discovery and sensitivity-label coverage - Copilot / GenAI access-path review (who can reach what) - Purview DLP, labelling and retention baseline - AI acceptable-use policy and rollout guardrails ### Deliverables - Oversharing findings report with the top risky sites and groups - Remediation plan with owner-ready task lists - AI acceptable-use policy - Go / no-go readiness scorecard for the Copilot rollout ### Tiers #### Essential Copilot Readiness: $12.5K Up to 250 users: oversharing analysis, top-risk remediation plan and AI acceptable-use policy Limits: users 250 #### Advanced Copilot Readiness: $18.5K Up to 1,000 users: adds sensitivity-label design, Purview DLP baseline and a pilot-group rollout plan Limits: users 1000 #### Enterprise GenAI Data Governance: $32K 1,000+ users or multiple GenAI tools: adds data-owner workshops, automated remediation runbooks and post-rollout monitoring design Limits: users 10000 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=m365-copilot-genai-data-oversharing-readiness ## Threat Modeling as a Service > From $6.5K · AI Security · https://cisomarketplace.services/services/threat-modeling-as-a-service Threat modelling finds design flaws before they are built, which is cheaper than finding them in a pentest. Per application or major feature, we run facilitated sessions with your engineers, produce data-flow diagrams and a STRIDE-based threat register, rate the risks, and hand back mitigations as backlog-ready stories. AI-assisted diagramming keeps it fast; a security architect keeps it right. ### In scope - Architecture and data-flow discovery - Facilitated threat-modelling sessions with engineers - STRIDE-based threat register with risk ratings - Mitigations written as backlog-ready stories - Re-review after design changes ### Deliverables - Data-flow diagrams - Threat register - Prioritized mitigation backlog - Design review summary for auditors and customers ### Tiers #### Essential Threat Model: $6.5K One application or major feature: two facilitated sessions, data-flow diagrams, a STRIDE threat register and a mitigation backlog. Limit key 'web_apps' = applications modelled. Limits: web apps 1 #### Advanced Threat Model: $12.5K One complex application or up to three services: adds abuse cases, cloud trust-boundary analysis and a re-review Limits: web apps 3 #### Enterprise Threat Modeling Program: $24K Up to eight applications: adds a reusable threat library, engineer training and quarterly re-reviews Limits: web apps 8 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=threat-modeling-as-a-service --- # Practice: Cloud & Application Security Cloud posture, application and API security, secure code review and DevSecOps. Security built into how you ship, not bolted on afterwards. ## DevSecOps Pipeline Testing > From $12K / mo · Cloud & Application Security · https://cisomarketplace.services/services/devsecops-pipeline-testing Comprehensive security testing integrated into your development pipeline with regular assessments. ### In scope - CI/CD pipeline security - Container security - Code security ### Deliverables - Daily pipeline security reports - Weekly container scan findings - Bi-weekly code review reports ### Tiers #### Standard: $12K / month Monthly subscription covering up to 10 repositories with their CI/CD pipelines and up to 25 developers: daily automated pipeline security checks and weekly container image scan findings. No manual code review. Limits: repositories 10, developers 25 Includes: - Up to 10 repositories and their pipelines - Daily pipeline security report - Weekly container scan findings - Triage of scanner results to cut false positives Excludes: - Bi-weekly manual code review - Fixing findings in your code - Penetration testing of deployed applications #### Enterprise: $20K / month Monthly subscription covering up to 25 repositories with their CI/CD pipelines and up to 75 developers: daily pipeline checks, weekly container scans, plus a manual security code review of changed code on a cadence agreed at kickoff. Limits: repositories 25, developers 75 Includes: - Up to 25 repositories and their pipelines - Daily pipeline security report - Weekly container scan findings - Bi-weekly manual code review report - Review call with engineering leads each cycle Excludes: - Fixing findings in your code - Penetration testing of deployed applications - Scanner/tool licence costs ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=devsecops-pipeline-testing ## Cloud Security Monitoring > From $10K / mo · Cloud & Application Security · https://cisomarketplace.services/services/cloud-security-monitoring Continuous monitoring and assessment of your cloud infrastructure security posture. ### In scope - Cloud configuration - IAM security - Architecture security ### Deliverables - Daily cloud configuration reports - Weekly IAM assessment findings - Monthly architecture review documents ### Tiers #### Basic: $10K / month Monthly subscription covering 1 cloud provider and up to 5 accounts/subscriptions: daily configuration-drift report and weekly IAM assessment findings. Findings are reported; your team remediates. Limits: cloud accounts 5 Includes: - 1 cloud provider, up to 5 accounts/subscriptions - Daily cloud configuration report - Weekly IAM assessment findings - Read-only access to your accounts Excludes: - Monthly architecture review - Remediation in your accounts - 24/7 alert response or incident handling - Additional cloud providers #### Advanced: $18K / month Monthly subscription covering up to 2 cloud providers and up to 15 accounts/subscriptions: daily configuration reports, weekly IAM findings, plus a monthly architecture review document with a review call. Limits: cloud accounts 15 Includes: - Up to 2 cloud providers, up to 15 accounts/subscriptions - Daily cloud configuration report - Weekly IAM assessment findings - Monthly architecture review document and call Excludes: - Remediation in your accounts - 24/7 alert response or incident handling - CSPM platform licence costs ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cloud-security-monitoring ## Cloud Security Posture Management > From $65K · Cloud & Application Security · https://cisomarketplace.services/services/cloud-security-posture-management Advanced cloud security assessment and continuous monitoring implementation across multi-cloud environments, focusing on compliance, cost optimization, and security automation. ### In scope - Multi-cloud security assessment - Compliance gap analysis - Security automation implementation - Cost optimization review - Identity management evaluation ### Deliverables - Cloud security baseline report - Compliance mapping document - Security automation playbooks - Cost optimization recommendations - Incident response procedures - Security dashboard implementation ### Tiers #### Core CSPM Assessment: $65K CSPM baseline for 1 primary cloud provider, up to 10 accounts/subscriptions: security baseline report, gap analysis against 1 framework, identity review, cost-optimization review and up to 5 standard automation playbooks. Limits: cloud accounts 10, frameworks 1 Includes: - 1 cloud provider, up to 10 accounts/subscriptions - Cloud security baseline report - Compliance mapping to 1 framework - Up to 5 standard automation playbooks - Cost optimization recommendations Excludes: - Second cloud provider - Security dashboard build - Custom-coded automation - CSPM platform licence costs #### Advanced CSPM Program: $95K CSPM program across up to 2 cloud providers and up to 25 accounts/subscriptions: baseline, compliance mapping to up to 3 frameworks, up to 15 automation playbooks, incident response procedures and a security dashboard. Limits: cloud accounts 25, frameworks 3 Includes: - Up to 2 cloud providers, up to 25 accounts/subscriptions - Compliance mapping to up to 3 frameworks - Up to 15 automation playbooks - Security dashboard implementation - Cloud incident response procedures Excludes: - Custom automation beyond playbook templates - Post-project monitoring operations - CSPM platform licence costs #### Enterprise CSPM Solution: $150K Full-scale CSPM implementation across all cloud environments with custom automation and continuous monitoring Limits: frameworks 5 Excludes: - CSPM platform licence costs - Application penetration testing ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cloud-security-posture-management ## Comprehensive Container Security Assessment > From $15K · Cloud & Application Security · https://cisomarketplace.services/services/comprehensive-container-security-assessment Deep-dive security assessment of container environments, including infrastructure, images, runtime security, and orchestration platforms. ### In scope - Container infrastructure security review - Image security analysis (up to 50 images) - Runtime security assessment - Kubernetes/orchestration platform review - CI/CD pipeline security evaluation - Container network security analysis - Secrets management review - Container registry security assessment ### Deliverables - Detailed findings report - Custom scanning rules - Vulnerable container inventory - YAML security templates - Policy-as-code examples - Remediation scripts - Security hardening guide - Container security roadmap ### Tiers #### Basic: $15K Point-in-time review of 1 Kubernetes/orchestration cluster in 1 cloud account and up to 10 container images: image vulnerability analysis, cluster configuration, secrets handling and registry settings. No CI/CD assessment. Limits: cloud accounts 1 Includes: - Up to 10 container images - 1 cluster, configuration-level orchestration review - Secrets management and registry review - Findings report and vulnerable container inventory - Hardening guide Excludes: - CI/CD pipeline security evaluation - Runtime security assessment - Custom scanning rules and policy-as-code - More than 1 cluster #### Enterprise: $65K No image cap and up to 5 clusters across up to 5 cloud accounts: infrastructure, image, runtime, orchestration, network and CI/CD pipeline review, custom policy-as-code and scanning rules, then a follow-up re-review. Limits: cloud accounts 5, months 6 Includes: - Unlimited images, up to 5 clusters - Runtime and container network security assessment - CI/CD pipeline security evaluation - Custom policy-as-code, YAML templates and scanning rules - Remediation scripts and roadmap - Re-review at 6 months Excludes: - Remediation implementation in your clusters - Continuous runtime monitoring - Application-layer penetration testing of containerized apps ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=comprehensive-container-security-assessment ## SMB Advanced Tech > From $7.5K · Cloud & Application Security · https://cisomarketplace.services/services/smb-advanced-tech Modern tech stack security assessment for digital-first SMBs. ### In scope - Container security review (up to 20 images) - API security assessment (up to 3 APIs) - Infrastructure-as-code review - CI/CD pipeline security analysis - Microservices architecture review - Kubernetes security assessment - DevSecOps maturity evaluation ### Deliverables - Technical findings report - Security as code templates - Pipeline security rules - Container hardening guide - API security specifications ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-advanced-tech ## Data Security Posture Management (DSPM) Assessment > Scoped per engagement · Cloud & Application Security · https://cisomarketplace.services/services/data-security-posture-management-dspm-assessment Discover known and shadow data across cloud and on-prem, classify sensitive data, map access and flows, and remediate exposure. Establishes a continuous data security posture aligned to privacy regimes. ### In scope - Data discovery (cloud + on-prem + shadow) - Classification of sensitive/regulated data - Access & entitlement mapping - Data flow & exposure analysis - Remediation prioritization ### Deliverables - DSPM assessment report - Data inventory & classification - Exposure & access findings - Remediation roadmap ### Tiers #### Essential: scoped Discovery and classification of up to 10 priority data stores in up to 2 cloud accounts. Cloud only. Delivers a data inventory with sensitivity classes and a list of exposed stores. Limits: cloud accounts 2 Includes: - Up to 10 priority data stores - Up to 2 cloud accounts - Sensitive/regulated data classification - Data inventory and exposure findings Excludes: - On-prem data stores - Access and entitlement mapping - Data flow analysis - Shadow data discovery beyond the named stores #### Advanced: scoped DSPM assessment across up to 10 cloud accounts and up to 3 on-prem locations, up to 50 data stores including shadow-data discovery, with access/entitlement mapping, data flow and exposure analysis and a prioritized remediation roadmap. Limits: cloud accounts 10, locations 3 Includes: - Up to 50 data stores, cloud and on-prem - Shadow data discovery - Access and entitlement mapping - Data flow and exposure analysis - Remediation roadmap Excludes: - Ongoing monitoring after the report - Remediation implementation - Data governance operating model #### Enterprise: scoped Continuous DSPM program with monitoring + governance Limits: cloud accounts 25, locations 5 Excludes: - DSPM tool licence costs - Hands-on remediation in your systems - Privacy legal advice ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=data-security-posture-management-dspm-assessment ## Zero Trust Architecture Implementation > From $75K · Cloud & Application Security · https://cisomarketplace.services/services/zero-trust-architecture-implementation Comprehensive zero trust security architecture design and implementation service tailored for enterprise environments. Includes network segmentation, identity-based access controls, and continuous monitoring setup. ### In scope - Network architecture review and redesign - Identity and access management integration - Microsegmentation implementation - Security monitoring and analytics setup - Cloud and on-premise infrastructure ### Deliverables - Detailed zero trust architecture blueprint - Implementation roadmap and timeline - Security policies and procedures documentation - Training materials for security team - Monitoring and incident response playbooks - Post-implementation security assessment report ### Tiers #### Core Zero Trust Implementation: $75K Zero trust design and implementation for up to 500 users, up to 2 locations and 1 cloud environment: IAM integration with 1 identity provider, microsegmentation of up to 10 application groups, baseline monitoring. Limits: users 500, locations 2, cloud accounts 1 Includes: - Up to 500 users, up to 2 locations - Architecture blueprint and roadmap - 1 identity provider integrated - Microsegmentation of up to 10 application groups - Baseline monitoring and post-implementation assessment Excludes: - Custom access policies per application - Policy automation - Product licences and hardware - Multi-cloud segmentation #### Advanced Zero Trust Program: $125K Zero trust program for up to 2,500 users, up to 5 locations and up to 3 cloud environments: segmentation of up to 30 application groups, custom access-control policies per group, security team training and IR playbooks. Limits: users 2500, locations 5, cloud accounts 3 Includes: - Up to 2,500 users, up to 5 locations - Up to 3 cloud environments plus on-prem - Segmentation of up to 30 application groups - Custom access-control policy framework - Team training and monitoring/IR playbooks Excludes: - Custom policy automation - Behavioral analytics build-out - Product licences and hardware - Post-go-live operations #### Enterprise Zero Trust Platform: $195K Full-scope zero trust implementation with custom automation, advanced analytics, and complete security transformation support Excludes: - Product licences and hardware - Managed operation beyond the support period - Application refactoring ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=zero-trust-architecture-implementation ## Managed DMARC & Email Authentication Enforcement > From $3.5K · Cloud & Application Security · https://cisomarketplace.services/services/managed-dmarc-email-authentication Spoofed email is how business email compromise starts, and mailbox providers now require authentication from bulk senders. We inventory every service sending as your domains, fix SPF, DKIM and alignment, move DMARC from monitoring to quarantine to reject in controlled steps, and then monitor it so a new marketing tool does not quietly break it. ### In scope - Sender inventory across every domain and subdomain - SPF, DKIM and alignment remediation - Staged DMARC policy rollout: none, quarantine, reject - Parked-domain protection - Ongoing monitoring and new-sender onboarding ### Deliverables - Sender inventory - DMARC enforcement at p=reject - Runbook for onboarding new mail senders - Monthly monitoring report (managed tiers) ### Tiers #### Essential DMARC Enforcement: $3.5K Up to 3 domains: sender inventory, SPF/DKIM fixes and staged rollout to p=reject Limits: domains 3 #### Advanced DMARC Enforcement: $7.5K Up to 15 domains: adds parked-domain protection, BIMI readiness and 6 months of monitoring Limits: domains 15 #### Enterprise DMARC Program: $14K Large domain portfolios: adds subdomain policy design, third-party sender governance and 12 months of managed monitoring Limits: domains 100 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=managed-dmarc-email-authentication ## Microsoft 365 & Entra ID Security Assessment > From $4.5K · Cloud & Application Security · https://cisomarketplace.services/services/microsoft-365-entra-security-assessment A fixed-scope assessment of the Microsoft 365 tenant most organizations run their business on: identity and conditional access in Entra ID, Exchange Online and anti-phishing, SharePoint/OneDrive/Teams sharing, Defender and Purview configuration, admin roles and break-glass accounts. Measured against the CIS Microsoft 365 Foundations Benchmark and Microsoft Secure Score, delivered as a prioritized hardening plan your IT team or MSP can execute. ### In scope - Entra ID: MFA, conditional access, legacy auth, privileged roles - Exchange Online: anti-phishing, SPF/DKIM/DMARC, mail flow rules, forwarding - SharePoint, OneDrive and Teams external sharing and guest access - Defender for Office 365 / Endpoint and Purview baseline - Audit logging, alerting and break-glass account review ### Deliverables - CIS Microsoft 365 benchmark scorecard - Prioritized hardening plan (quick wins / 30 / 90 days) - Conditional access policy recommendations - Executive summary for leadership or your cyber insurer ### Tiers #### Essential M365 Review: $4.5K Single tenant up to 100 users: CIS benchmark review, Secure Score analysis and a prioritized hardening plan Limits: users 100, locations 3 #### Advanced M365 & Entra Assessment: $9.5K Up to 500 users: adds conditional access design, privileged access review, Defender and Purview configuration and a remediation workshop Limits: users 500, locations 10 #### Enterprise M365 Security Program: $18K Multi-tenant or 500+ users: adds hybrid identity (AD Connect), application consent and service principal review, and 30 days of remediation support Limits: users 5000 Excludes: - Tenants above 5,000 users are scoped individually ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=microsoft-365-entra-security-assessment ## SMB Comprehensive Security Assessment > From $25K · Cloud & Application Security · https://cisomarketplace.services/services/smb-comprehensive-security-assessment Practical and efficient security evaluation designed specifically for small and medium-sized businesses. This streamlined assessment focuses on essential security controls, cloud security, and practical recommendations that can be implemented with limited resources. Our SMB-focused approach delivers actionable security guidance without requiring enterprise-scale security teams or budgets. ### In scope - Essential security controls assessment - Cloud security configuration review - Identity and access management evaluation - Data protection practices assessment - Network security fundamentals review - Endpoint protection assessment - Business email security evaluation - Backup and recovery assessment - Basic incident response readiness - Vendor security review - Security awareness evaluation - Regulatory compliance fundamentals ### Deliverables - SMB security assessment report - Prioritized security recommendations - Implementation roadmap with timeframes - Security quick-wins list - Cloud security checklist - Essential security policy templates - Vendor security questionnaire template - Incident response plan template - Security awareness materials - Executive summary with clear next steps ### Tiers #### Essential SMB Security Review: $25K Assessment of the 12 core control areas for a business of up to 50 employees, 1 location and 1 cloud environment. Interviews, configuration checks of email, identity, endpoints and backup; no compliance mapping. Limits: employees 50, locations 1, cloud accounts 1 Includes: - Up to 50 employees, 1 location - 1 cloud/productivity environment reviewed - Email, identity, endpoint and backup checks - Quick-wins list and roadmap - Policy and IR plan templates Excludes: - Compliance mapping to a framework - Custom application review - Penetration testing - Additional locations #### Standard SMB Security Assessment: $35K Assessment of the 12 control areas for up to 100 employees, up to 3 locations and up to 2 cloud environments, adding mapping to 1 compliance framework and review of up to 5 key vendors. Limits: employees 100, locations 3, cloud accounts 2, frameworks 1, vendors 5 Includes: - Up to 100 employees, up to 3 locations - Up to 2 cloud environments - Gap mapping to 1 compliance framework - Security review of up to 5 key vendors - Roadmap with timeframes Excludes: - Custom application review - On-prem/hybrid infrastructure deep-dive - Penetration testing #### Advanced SMB Security Program: $45K Assessment for up to 250 employees, up to 5 locations and up to 3 cloud environments with hybrid on-prem infrastructure, adding a design-level review of 1 custom application, mapping to up to 2 frameworks and up to 10 vendors. Limits: employees 250, locations 5, cloud accounts 3, frameworks 2, vendors 10, web apps 1 Includes: - Up to 250 employees, up to 5 locations - Hybrid on-prem and up to 3 cloud environments - Design-level review of 1 custom application - Gap mapping to up to 2 frameworks - Security review of up to 10 vendors Excludes: - Penetration testing - Remediation implementation - Organizations over 250 employees (use an enterprise assessment) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-comprehensive-security-assessment ## SaaS Security Posture Assessment > From $32K · Cloud & Application Security · https://cisomarketplace.services/services/saas-security-posture-assessment Comprehensive security evaluation of your cloud-based productivity and collaboration platforms, including Microsoft 365, Google Workspace, and other critical SaaS environments. Our assessment identifies security misconfigurations, access control weaknesses, data protection gaps, and provides actionable recommendations to secure your cloud-based business operations. ### In scope - Identity and access management review - Admin privilege assessment - Data loss prevention controls - Security configuration analysis - Third-party application integration security - Shadow IT discovery - Multi-factor authentication implementation - Conditional access policy evaluation - Information protection settings - Collaboration security controls ### Deliverables - SaaS security posture report - Configuration baseline recommendations - Access control framework - Data protection strategy - Tenant security roadmap - Secure collaboration guidelines - Third-party app governance model - Cloud security monitoring recommendations ### Tiers #### Essential SaaS Security Review: $32K Configuration assessment of 1 primary SaaS platform (one Microsoft 365 tenant, or one Google Workspace tenant), up to 500 users: identity, admin privileges, MFA, conditional access, sharing and DLP settings. Limits: users 500 Includes: - 1 SaaS platform, 1 tenant, up to 500 users - Identity, MFA and conditional access review - Admin privilege assessment - Sharing, DLP and information protection settings - Posture report with baseline recommendations Excludes: - Second SaaS platform - Third-party app integration review - Shadow IT discovery - Remediation in your tenant #### Comprehensive SaaS Security Program: $55K Assessment of up to 3 SaaS platforms, up to 2,500 users: all first-tier checks per platform plus third-party app/OAuth integration review, shadow IT discovery, access control framework and data protection strategy. Limits: users 2500 Includes: - Up to 3 SaaS platforms, up to 2,500 users - Third-party app and OAuth integration review - Shadow IT discovery - Access control framework - Data protection strategy and tenant roadmap Excludes: - Custom security baseline per platform - On-premises identity integration review - Remediation in your tenants #### Enterprise SaaS Security Framework: $85K Assessment of up to 6 SaaS platforms; no fixed user cap - scoped at kickoff. Adds a custom security baseline per platform, a third-party app governance model, and review of integration with on-premises identity and security tooling. Includes: - Up to 6 SaaS platforms, user count scoped - Custom configuration baseline per platform - Third-party app governance model - On-premises identity/security integration review - Monitoring recommendations Excludes: - Remediation implementation in your tenants - Ongoing posture monitoring - SaaS licence or tooling costs ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=saas-security-posture-assessment ## Secure Code Review > From $35K · Cloud & Application Security · https://cisomarketplace.services/services/secure-code-review Comprehensive analysis of application source code to identify security vulnerabilities, coding flaws, and implementation issues that could lead to security breaches. Our expert review combines automated scanning with manual expert analysis. ### In scope - Manual code review - Automated static analysis - Business logic review - Third-party component analysis - Security control assessment - Secure coding practices evaluation ### Deliverables - Detailed vulnerability report - Code-level remediation guidance - Risk prioritization - Secure coding best practices - Software composition analysis - Secure development training recommendations ### Tiers #### Essential Code Review: $35K Review of the security-critical components of 1 application: up to 2 repositories and up to 100,000 lines of code. Automated static analysis of the whole codebase, manual review limited to auth, session, input handling and crypto. Limits: repositories 2 Includes: - 1 application, up to 2 repositories, up to 100k LOC - Automated static analysis of all code - Manual review of auth, session, input and crypto code - Vulnerability report with code-level fixes Excludes: - Manual review of the full codebase - Business logic review - Software composition analysis of all dependencies - Developer training #### Comprehensive Code Security Assessment: $65K Whole-codebase review of 1 application: up to 5 repositories and up to 500,000 lines of code. Manual review of all modules, business logic review, software composition analysis and a remediation plan. Limits: repositories 5 Includes: - 1 application, up to 5 repositories, up to 500k LOC - Manual review across all modules - Business logic review - Software composition analysis - Prioritized remediation plan Excludes: - Secure SDLC process design - Custom static-analysis rules - Developer training delivery - Fixing the code #### Enterprise Secure SDLC Program: $95K Code review of up to 3 applications and up to 15 repositories, plus secure SDLC design, custom static-analysis rules wired into your pipeline and secure-coding training for up to 50 developers. Lines of code scoped at kickoff. Limits: repositories 15, developers 50 Includes: - Up to 3 applications, up to 15 repositories - Secure SDLC process design and rollout plan - Custom static-analysis rules in your pipeline - Secure-coding training for up to 50 developers - Software composition analysis Excludes: - Fixing the code - Ongoing review of new commits - Dynamic/penetration testing of running apps ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=secure-code-review ## Secure Development Training & Security Champions Program > From $4.5K · Cloud & Application Security · https://cisomarketplace.services/services/secure-development-training-security-champions Annual slide-deck training does not change how code is written. We train developers on the vulnerabilities found in your own stack and findings, run hands-on labs, and stand up a security champions program — named engineers in each team with a playbook, office hours and metrics — so secure design survives after the training ends. Satisfies SOC 2, ISO 27001 and PCI developer-training requirements. ### In scope - Training needs analysis from your stack and past findings - Hands-on secure coding workshops - Security champions selection, playbook and office hours - Threat modelling and secure design clinic - Completion evidence for auditors ### Deliverables - Tailored training curriculum and labs - Security champions playbook - Training completion records - Program metrics and 12-month plan ### Tiers #### Essential Developer Training: $4.5K Up to 15 developers: one tailored workshop day, labs and completion evidence Limits: developers 15 #### Advanced Training & Champions Launch: $12K Up to 50 developers: adds language-specific tracks, champions selection, playbook and three months of office hours Limits: developers 50 #### Enterprise Champions Program: $28K Up to 200 developers: adds threat-modelling clinics, champion coaching for 12 months and program metrics Limits: developers 200 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=secure-development-training-security-champions --- # Practice: Managed Security & Incident Response Incident response readiness, retainers, threat hunting, forensics and tabletop exercises, so the first time you run your plan is not during an incident. ## Incident Response Readiness & Tabletop Exercise > From $25K · Managed Security & Incident Response · https://cisomarketplace.services/services/incident-response-readiness-tabletop-exercise Comprehensive incident response assessment and tabletop exercise designed to validate your organization's IR preparedness through focused policy review, stakeholder coordination validation, and scenario-based team exercises. Our specialized approach combines industry-standard IR maturity assessment with practical tabletop simulations to enhance your incident response capabilities, team coordination, and regulatory compliance readiness. ### In scope - Comprehensive IR policy review and gap analysis against industry standards (6 hours) - Current incident response capability maturity assessment (4 hours) - Insurance and legal coordination validation with carrier requirements (4 hours) - Threat landscape analysis and scenario development (6 hours) - Multi-scenario tabletop exercise facilitation (4 hours) - Team readiness discussion and role validation session (3 hours) - Interactive Q&A on IR procedures and decision-making (2 hours) - OSINT research on insurance claims history and provider ecosystem (3 hours) - Process walkthrough using developed scenarios with timing analysis (4 hours) - Communication and escalation pathway validation (2 hours) - Technical response capability assessment (4 hours) - Post-exercise analysis and improvement recommendations (3 hours) ### Deliverables - Comprehensive IR readiness assessment report (15-20 pages) - Current state vs. industry benchmark analysis - Priority recommendations matrix with timeline and resource requirements - Validated quick reference contact sheet and escalation procedures - 3-5 relevant walkthrough scenarios based on threat intelligence - Detailed after-action report from tabletop exercise - Process improvement recommendations with implementation roadmap - Team readiness assessment with skills gap analysis - Insurance and legal coordination optimization plan - Communication template library for various incident types - Regulatory compliance mapping and requirements - Executive summary with board-ready metrics ### Tiers #### Essential IR Assessment & Tabletop: $25K IR policy review and maturity rating, insurance and legal contact validation, then one 3-4 hour tabletop with up to 2 scenarios for up to 15 participants. 45 consulting hours, after-action report and priority recommendations. Limits: participants 15, scenarios 2, sessions 1, hours 45 Includes: - IR policy gap analysis and maturity rating - Insurance carrier and legal coordination check - One 3-4 hour facilitated tabletop - Validated contact sheet and escalation procedures - After-action report with priority matrix Excludes: - Stakeholder interviews beyond the core IR team - Full-day exercise - Regulatory reporting requirements mapping - Follow-up review after the report #### Comprehensive IR Readiness Program: $42.5K Adds up to 10 stakeholder interviews, one full-day tabletop with up to 3 scenarios for up to 30 participants, a 15-20 page after-action report, regulatory reporting requirements mapping, and a 90-day follow-up review. 80 consulting hours. Limits: participants 30, scenarios 3, sessions 2, hours 80, months 3 Includes: - Everything in the Essential tier - Up to 10 stakeholder interviews - Full-day immersive tabletop - Regulatory reporting requirements mapping - Communication template library - 90-day follow-up review session Excludes: - Separate executive-only exercise - Crisis simulation gaming platform access - Recurring quarterly assessments #### Enterprise IR Transformation: $67.5K Advanced incident response program with multi-scenario exercises, crisis simulation gaming platform access, executive briefings, custom scenario development, and quarterly maturity assessments Limits: participants 50, scenarios 5, sessions 5 Excludes: - Incident response retainer or live incident handling - Rewriting the full IR plan - Technical attack simulation against production systems ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=incident-response-readiness-tabletop-exercise ## SOC Maturity & Incident Response Assessment > From $40K · Managed Security & Incident Response · https://cisomarketplace.services/services/soc-maturity-incident-response-assessment Comprehensive evaluation of your organization's Security Operations Center (SOC) capabilities and incident response readiness. Our assessment examines detection coverage, response procedures, team capabilities, and technology effectiveness to identify gaps in your security operations and provide a roadmap for enhanced threat detection and response capabilities. ### In scope - SOC maturity model assessment - Incident response procedure evaluation - Detection coverage analysis - Threat hunting capabilities review - SOC technology stack assessment - Analyst workflow evaluation - Alert triage effectiveness - Incident response tabletop exercise - Metrics and KPI evaluation - Threat intelligence integration - MITRE ATT&CK coverage analysis - SOC team skills assessment - SIEM configuration analysis - Detection rule coverage - Alert triage process review ### Deliverables - SOC maturity assessment report - Incident response capability analysis - Detection gap recommendations - SOC enhancement roadmap - Tabletop exercise findings - Technology optimization guidance - Workflow improvement plan - Metrics framework development - Staffing and skills recommendations - Implementation timeline and prioritization ### Tiers #### Essential SOC & IR Assessment: $40K One SOC site: maturity model scoring, IR procedure review, MITRE ATT&CK detection coverage analysis, alert triage and KPI evaluation, up to 6 analyst interviews. 180 consulting hours. IR procedures are walked through; no facilitated tabletop. Limits: locations 1, hours 180 Includes: - SOC maturity model assessment - IR procedure evaluation by walkthrough - MITRE ATT&CK coverage analysis - Alert triage and metrics evaluation - Maturity report with prioritized recommendations Excludes: - Facilitated tabletop exercise - Detection engineering recommendations at rule level - SOC team skills assessment - Implementation support #### Comprehensive SOC Enhancement Program: $75K Up to 2 SOC sites. Adds up to 2 IR tabletop scenarios for up to 20 participants, rule-level detection engineering recommendations, threat intelligence integration review, team skills assessment, and a sequenced roadmap. 330 consulting hours. Limits: locations 2, scenarios 2, participants 20, hours 330 Includes: - Everything in the basic tier - Up to 2 IR tabletop scenarios - Rule-level detection engineering recommendations - Threat hunting and threat intelligence integration review - SOC team skills assessment - Roadmap with timeline and prioritization Excludes: - Writing and deploying the detections - Hands-on technical incident simulation - Implementation support after the roadmap #### Enterprise Security Operations Transformation: $120K Advanced SOC transformation with implementation support, custom detection engineering, and advanced incident simulation exercises Limits: scenarios 4, participants 40 Excludes: - 24x7 monitoring or staff augmentation - Incident response retainer - Tool licensing costs ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=soc-maturity-incident-response-assessment ## Advanced Threat Hunting Program > From $70K · Managed Security & Incident Response · https://cisomarketplace.services/services/advanced-threat-hunting-program Proactive threat hunting service combining machine learning, behavioral analytics, and expert analysis to identify sophisticated threats and establish continuous hunting capabilities. ### In scope - Environment baseline analysis - Threat intelligence implementation - Detection rule development - Behavioral analytics setup - Hunt process establishment ### Deliverables - Threat hunting playbooks - Custom detection rules - Behavioral analysis framework - Investigation procedures - Threat intelligence feeds integration - Team training materials ### Tiers #### Core Threat Hunting Program: $70K Essential threat hunting covering primary attack vectors and basic MITRE ATT&CK mapping Limits: devices 1000 Excludes: - Behavioral analytics setup - Threat intelligence feed integration - Automated response playbooks #### Advanced Threat Hunting Solution: $120K Comprehensive hunting program with custom detection engineering, behavioral analytics, and automated response Limits: devices 2500 Excludes: - ML-based detection models - Incident response for confirmed intrusions - SIEM or EDR licences #### Enterprise Threat Hunting Platform: $180K Full-scale hunting program with ML-powered detection, custom playbooks, and 24/7 expert monitoring Limits: devices 5000 Excludes: - Full incident response and forensics (separate retainer) - SIEM, EDR or data platform licences - Environments above 5,000 endpoints (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=advanced-threat-hunting-program ## DR/IR/BCP Trifecta Tabletop Exercise > From $9.5K · Managed Security & Incident Response · https://cisomarketplace.services/services/dr-ir-bcp-trifecta-tabletop-exercise Comprehensive multi-scenario tabletop exercise program that integrates Disaster Recovery, Incident Response, and Business Continuity Planning into a unified preparedness assessment. Our specialized approach tests your organization's ability to handle cascading incidents that impact technology infrastructure, security operations, and business operations simultaneously, providing a holistic view of organizational resilience and cross-functional coordination capabilities. ### In scope - Integrated assessment of DR - IR - and BCP current state capabilities (12 hours) - Cross-functional team readiness evaluation and role validation (8 hours) - Multi-domain threat landscape analysis and cascading scenario development (10 hours) - Comprehensive tabletop exercise facilitation with escalating scenarios (8 hours) - Real-time decision-making assessment across technical and business functions (6 hours) - Cross-departmental communication and coordination testing (4 hours) - Executive crisis management and decision authority validation (4 hours) - Resource allocation and priority assessment during multi-domain incidents (4 hours) - Vendor and third-party coordination during complex scenarios (3 hours) - Regulatory compliance and reporting requirements during cascading incidents (3 hours) - Recovery coordination between IT systems and business operations (4 hours) - Post-exercise comprehensive analysis and improvement planning (6 hours) ### Deliverables - Comprehensive trifecta assessment report (25-30 pages) - Integrated maturity assessment across DR - IR - and BCP domains - Cross-functional capability gap analysis with prioritized recommendations - Multi-scenario exercise findings with timeline analysis - Executive decision-making effectiveness assessment - Inter-departmental coordination and communication evaluation - Integrated improvement roadmap with cross-domain dependencies - Resource allocation optimization recommendations - Vendor and third-party coordination enhancement plan - Regulatory compliance readiness across all domains - Cascading incident response playbook development - Executive briefing with board-ready metrics and ROI analysis - 180-day follow-up assessment and progress review plan ### Tiers #### Entry — market-sized scope: $9.5K Scoped like the market's version of this work (AI-facilitated tabletop (async format)): a fixed, smaller engagement that leads into the Essential Trifecta Exercise tier. Limits: participants 10, scenarios 1, sessions 1 Excludes: - Review of existing DR, IR or BCP plans - Custom scenario development - Live multi-day facilitated exercise - Maturity assessment and improvement roadmap #### Essential Trifecta Exercise: $55K Current-state review of DR, IR and BCP plans, then 2 live facilitated cascading scenarios over 2 sessions for up to 20 participants. Report with integrated maturity ratings, roadmap and a 180-day follow-up plan. Limits: participants 20, scenarios 2, sessions 2, hours 72 Includes: - DR, IR and BCP current-state assessment - 2 cascading scenarios built for the organization - 2 live facilitated exercise sessions - Cross-functional gap analysis and roadmap - 25-30 page report and executive briefing Excludes: - Separate executive crisis simulation - Delivery of the 180-day follow-up review (plan only) - Cascading incident playbook authoring - More than 20 participants #### Comprehensive Trifecta Program: $85K Up to 3 scenarios over 4 sessions for up to 40 participants, including a dedicated executive crisis simulation, per-department coordination analysis, a cascading-incident playbook, and the 180-day follow-up review delivered. 115 consulting hours. Limits: participants 40, scenarios 3, sessions 4, hours 115, months 6 Includes: - Everything in the Essential tier - Dedicated executive crisis simulation session - Per-department coordination and communication analysis - Cascading incident response playbook - 180-day follow-up assessment session Excludes: - Recurring quarterly exercises - Crisis simulation gaming platform access - Executive one-to-one coaching #### Enterprise Resilience Transformation: $135K Advanced multi-domain program with custom scenario development, crisis simulation gaming platform, quarterly integrated exercises, executive coaching, and ongoing organizational resilience optimization Limits: participants 75, scenarios 6, sessions 8 Excludes: - Live technical failover or recovery testing - Rewriting the DR, IR and BCP plans themselves - Incident response retainer hours ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=dr-ir-bcp-trifecta-tabletop-exercise ## Cryptocurrency Recovery Service > From $3.5K · Managed Security & Incident Response · https://cisomarketplace.services/services/cryptocurrency-recovery-service Professional assistance in recovering lost or inaccessible cryptocurrency assets, including wallet recovery, seed phrase reconstruction, and hardware wallet troubleshooting. ### In scope - Wallet access analysis - Private key recovery - Seed phrase reconstruction - Hardware wallet issues - Exchange account recovery - Smart contract interaction issues - Transaction analysis ### Deliverables - Recovery feasibility report - Technical recovery plan - Step-by-step recovery documentation - Security recommendations - Future protection guidelines - Asset recovery confirmation - Secure storage recommendations ### Tiers #### Core Crypto Recovery: $3.5K Essential crypto recovery service covering basic wallet recovery, seed phrase assistance, and hardware wallet troubleshooting Limits: wallets 1 Excludes: - Exchange account recovery - Password brute-forcing of encrypted wallet files - Tracing stolen or scammed funds - Any guarantee that funds are recovered #### Advanced Crypto Recovery: $6.5K Comprehensive recovery including advanced wallet analysis, exchange account recovery, and detailed forensics Limits: wallets 3 Excludes: - Smart contract or DeFi position recovery - Custom recovery tooling - Tracing stolen funds or law-enforcement reporting packages - Any guarantee that funds are recovered #### Premium Crypto Recovery: $12K Full-scope recovery program with custom tools, smart contract interaction recovery, and complete blockchain forensics Limits: wallets 5 Excludes: - Theft, scam or ransomware fund tracing investigations - Expert witness or litigation support - Negotiation with exchanges or counterparties - Any guarantee that funds are recovered ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cryptocurrency-recovery-service ## NFT Asset Recovery & Analysis > From $2,800 · Managed Security & Incident Response · https://cisomarketplace.services/services/nft-asset-recovery-analysis Specialized service for recovering compromised or lost NFT assets and analyzing NFT-related smart contracts for security vulnerabilities. ### In scope - NFT ownership history - Smart contract interactions - Marketplace transactions - Transfer patterns - Wallet security - Gas optimization - Marketplace integration ### Deliverables - NFT recovery assessment - Smart contract audit report - Security vulnerability analysis - Recovery action plan - Marketplace security review - Future protection strategy - NFT management best practices ### Tiers #### Core NFT Recovery: $2,800 One wallet on one chain, up to 5 NFTs: ownership history verification, transfer tracing on one marketplace, review of 1 smart contract interaction, and a recovery action plan. 15 analyst hours. Limits: wallets 1, hours 15 Includes: - Ownership history for up to 5 NFTs - Transfer tracing on 1 chain and 1 marketplace - Review of 1 contract interaction (approvals, malicious signatures) - Recovery action plan with marketplace report templates - Wallet security recommendations Excludes: - Cross-chain or bridge tracing - Line-by-line smart contract audit - Any guarantee that assets are recovered - Legal action or law-enforcement filing on the client's behalf #### Advanced NFT Recovery: $5.5K Up to 3 wallets and up to 25 NFTs across up to 2 chains: cross-chain tracking, investigation on up to 3 marketplaces, and vulnerability analysis of up to 3 smart contracts. 30 analyst hours. Limits: wallets 3, hours 30 Includes: - Everything in the basic tier - Cross-chain tracking across up to 2 chains - Investigation on up to 3 marketplaces - Vulnerability analysis of up to 3 contracts - Evidence package for marketplace and exchange reports Excludes: - Chain forensics through mixers or many-hop laundering - Marketplace integration security audit - Any guarantee that assets are recovered #### Premium NFT Recovery: $9.5K Up to 10 wallets across up to 4 chains: end-to-end chain forensics of the stolen assets, custom contract analysis scripts, audit of up to 5 contracts, and a security review of the client's marketplace integration. 50 analyst hours. Limits: wallets 10, hours 50 Includes: - Everything in the advanced tier - End-to-end chain forensics with flow diagrams - Custom contract analysis scripts - Audit report on up to 5 contracts - Marketplace integration security review - Future protection strategy Excludes: - Any guarantee that assets are recovered - Legal representation or court filings - Ongoing wallet monitoring after delivery ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=nft-asset-recovery-analysis ## Incident Response Readiness Program > From $1.5K / mo · Managed Security & Incident Response · https://cisomarketplace.services/services/incident-response-readiness-program For organizations that need to show — to a board, a customer or a cyber insurer — that they are ready for an incident, without paying for a full response retainer. The program builds or refreshes the incident response plan, runs a tabletop every year, keeps contact trees and playbooks current, and holds prepaid responder hours that convert to proactive work if unused. It is the step below the Incident Response Retainer, which adds contractual response SLAs. ### In scope - Incident response plan build or refresh - Annual tabletop exercise with leadership - Ransomware and business email compromise playbooks - Prepaid responder hours (convertible to proactive work) - Quarterly readiness check-in and contact-tree upkeep ### Deliverables - Incident response plan and playbooks - Annual tabletop after-action report - Insurer / customer-ready readiness attestation letter - Quarterly readiness report ### Tiers #### Essential IR Readiness: $1.5K / month IR plan build or refresh, one leadership tabletop a year, two playbooks and 10 prepaid responder hours a year. For organizations up to 250 employees and a single site team. Limits: employees 250, scenarios 1, hours 10 #### Advanced IR Readiness: $4.5K / month Adds quarterly check-ins, five playbooks, 40 prepaid hours per year and next-business-day responder access Limits: employees 1000, scenarios 1, hours 40 #### Enterprise IR Readiness: $9.5K / month Adds two tabletops a year (technical and executive), 100 prepaid hours, forensic-readiness review and priority access to the response team Limits: employees 5000, scenarios 2, hours 100 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=incident-response-readiness-program ## Disaster Recovery Assessment & Planning > From $8,100 · Managed Security & Incident Response · https://cisomarketplace.services/services/disaster-recovery-assessment-planning Comprehensive evaluation of your organization's disaster recovery capabilities and recovery readiness through thorough analysis of current DR plans, infrastructure assessment, and recovery objective validation. Our specialized approach combines vulnerability identification with practical recovery solutions to enhance your organization's resilience against cyberattacks, natural disasters, and system failures. ### In scope - Current disaster recovery plan assessment and gap analysis (6 hours) - Critical systems and infrastructure evaluation (8 hours) - Recovery Point Objective (RPO) and Recovery Time Objective (RTO) analysis (4 hours) - Backup and restoration process validation (6 hours) - Data replication and storage assessment (4 hours) - Recovery site evaluation and capacity planning (6 hours) - Vendor and third-party recovery dependencies review (4 hours) - Recovery testing methodology development (3 hours) - Cost-benefit analysis of DR investments (3 hours) - Risk assessment against various disaster scenarios (4 hours) - Recovery prioritization framework development (2 hours) ### Deliverables - Comprehensive disaster recovery assessment report (15-20 pages) - Current state vs. desired state analysis - Recovery objectives recommendations (RPO/RTO) - Infrastructure resilience evaluation - Backup and recovery process optimization plan - Recovery site recommendations and capacity planning - Vendor dependency analysis and alternatives - Recovery testing framework and schedule - DR investment roadmap with cost-benefit analysis - Risk-based recovery prioritization matrix - Implementation timeline with milestones ### Tiers #### Essential DR Assessment: $8,100 Review of one existing DR plan for a single site: up to 15 critical systems, RPO/RTO analysis, backup and restore process check, and up to 5 recovery vendors. 50 consulting hours, 15-20 page report and a prioritized roadmap. Limits: locations 1, vendors 5, hours 50 Includes: - Gap analysis of the current DR plan - RPO/RTO analysis for up to 15 critical systems - Backup and restoration process review - Recovery prioritization matrix - 15-20 page assessment report with roadmap Excludes: - Recovery testing framework and test schedule - Cost-benefit analysis of DR investments - Second site or cloud DR evaluation - Implementation support after the report #### Comprehensive DR Program: $15,400 Complete disaster recovery assessment with detailed testing framework, vendor analysis, cost-benefit evaluation, and implementation support Limits: locations 3, vendors 15 Excludes: - Cloud DR migration planning - Design of automated failover or recovery runbooks - Facilitating a live recovery test - Support beyond the included hours #### Enterprise DR Transformation: $27K Advanced disaster recovery program with multi-site assessment, cloud migration planning, automated recovery solutions, and ongoing optimization support Excludes: - Building or operating the DR environment - Hardware, software or cloud hosting costs - Business continuity planning for non-IT functions ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=disaster-recovery-assessment-planning ## Malware Analysis Services > From $30K · Managed Security & Incident Response · https://cisomarketplace.services/services/malware-analysis-services Specialized security service providing in-depth analysis of suspected malware to understand capabilities, behavior, and impact. Our expert analysis combines static, dynamic, and memory forensics techniques to identify indicators of compromise, attribution details, and remediation strategies. ### In scope - Static code analysis - Dynamic behavior analysis - Memory forensics - Network traffic analysis - Anti-analysis technique identification - Exploit mechanism review - C2 infrastructure analysis - Attribution assessment ### Deliverables - Detailed malware analysis report - Indicators of compromise (IOCs) - MITRE ATT&CK mapping - Tactical remediation guidance - Strategic defense recommendations - Detection rule development - Threat actor profile ### Tiers #### Essential Malware Analysis: $30K Analysis of one malware family, up to 3 related samples: static and sandboxed dynamic analysis, capability summary, network and host IOCs, and MITRE ATT&CK mapping. One host memory image. 80 analyst hours. Limits: devices 1, hours 80 Includes: - Static and dynamic analysis of up to 3 samples - Memory analysis of 1 host image - IOC list (hashes, domains, IPs, file and registry artifacts) - MITRE ATT&CK mapping - Tactical remediation guidance Excludes: - Full reverse engineering of packed or obfuscated code - Custom detection rule development - C2 infrastructure and attribution analysis - Incident response on affected systems #### Advanced Malware Investigation: $50K Up to 10 samples across up to 2 families with code-level reverse engineering, anti-analysis and exploit mechanism review, C2 protocol analysis, complete IOC set, and custom detection rules. Up to 3 host memory images. 140 analyst hours. Limits: devices 3, hours 140 Includes: - Everything in the basic tier - Code-level reverse engineering including unpacking - Anti-analysis and exploit mechanism review - C2 protocol and infrastructure analysis - Custom host and network detection rules Excludes: - Campaign-wide analysis across the environment - Threat actor profile - Enterprise-wide detection rollout strategy #### Incident-Based Malware Response: $85K Malware work tied to an active or recent incident: up to 25 samples, memory and network captures from up to 10 hosts, campaign timeline, threat actor profile, and a detection strategy for the whole environment. 240 analyst hours. Limits: devices 10, hours 240 Includes: - Everything in the advanced tier - Campaign analysis linking samples, hosts and infrastructure - Threat actor profile and attribution assessment - Enterprise-wide detection and hunting strategy - Briefings for the incident response team Excludes: - Containment, eradication and system rebuilds - Full disk forensics of every affected host - Expert witness testimony ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=malware-analysis-services ## Business Continuity Assessment > From $32K · Managed Security & Incident Response · https://cisomarketplace.services/services/business-continuity-assessment Comprehensive evaluation of your organization's business continuity planning, capabilities, and readiness to maintain critical operations during disruptions. We assess operational resilience, recovery strategies, and provide actionable recommendations to enhance your continuity posture. ### In scope - Business impact analysis review - Critical function identification - Recovery strategy assessment - BC documentation evaluation - Crisis management procedures - BC governance framework - Alternate site capabilities - Supply chain resilience ### Deliverables - Business continuity capability report - Gap analysis and recommendations - Business impact analysis update - BC program development roadmap - Crisis management improvement plan - BC policy and procedure enhancements ### Tiers #### Core Business Continuity Assessment: $32K Up to 250 employees and 1 site. Review of the existing BIA, BC documentation, recovery strategies and crisis procedures, identifying up to 10 critical functions. Capability report, gap analysis and BC program roadmap. Limits: employees 250, locations 1 Includes: - Review of existing BIA and BC documentation - Critical function identification (up to 10) - Recovery strategy and crisis procedure assessment - Gap analysis and recommendations - BC program development roadmap Excludes: - Conducting a new BIA - Writing recovery strategies or BC plans - Supply chain resilience review - Exercises and testing #### Standard BC Program Development: $55K Up to 1,000 employees and up to 3 sites. We run a new BIA for up to 25 critical functions with RTO/RPO targets, develop recovery strategies per function, review alternate site capability and BC governance, and update BC policies and procedures. Limits: employees 1000, locations 3 Includes: - Everything in the core assessment - New BIA for up to 25 critical functions - Recovery strategy development per function - Alternate site and BC governance review - BC policy and procedure enhancements Excludes: - Integrated IT disaster recovery planning - Supply chain resilience program - Crisis management exercise - Live testing #### Enterprise Resilience Program: $90K Up to 2,500 employees and up to 10 sites. BIA for up to 50 critical functions, integrated BC/DR planning with IT, crisis management improvement plan with 1 facilitated crisis exercise, and supply chain resilience review of up to 15 critical suppliers. Limits: employees 2500, locations 10, scenarios 1, vendors 15 Includes: - Everything in the standard tier - BIA for up to 50 critical functions - Integrated BC/DR planning with IT recovery owners - One facilitated crisis management exercise - Supply chain resilience review (up to 15 suppliers) Excludes: - Technical DR failover testing - BC software platform licences - Ongoing program management - Organizations above 2,500 employees (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=business-continuity-assessment ## Digital Forensics Readiness Assessment > From $32K · Managed Security & Incident Response · https://cisomarketplace.services/services/digital-forensics-readiness-assessment Comprehensive evaluation of your organization's ability to collect, preserve, and analyze digital evidence following security incidents. Our assessment examines logging configurations, evidence collection processes, and forensic capabilities to ensure your organization can support investigations, legal proceedings, and regulatory requirements. ### In scope - Log retention configuration - Evidence collection procedures - Forensic tool evaluation - Chain of custody processes - Digital evidence preservation capabilities - Memory capture mechanisms - Network traffic recording - Legal hold procedures - Forensic investigation playbooks - Insider threat investigation capabilities ### Deliverables - Forensic readiness report - Logging enhancement recommendations - Evidence collection framework - Chain of custody procedures - Forensic tool recommendations - Investigation playbook development - Training recommendations for IT staff - Legal and regulatory compliance guidance ### Tiers #### Essential Forensic Readiness Review: $32K Up to 250 employees and 1 site. Reviews log retention on up to 10 critical log sources, evidence collection and chain of custody practice, and current forensic tooling. Readiness report with logging and evidence collection recommendations. Limits: employees 250, locations 1 Includes: - Log retention review for up to 10 critical sources - Evidence collection and chain of custody process review - Forensic tool evaluation - Forensic readiness report - Logging enhancement recommendations Excludes: - Writing evidence collection procedures - Investigation playbooks - Memory capture and network recording capability review - Legal hold process design #### Comprehensive Forensic Readiness Program: $55K Up to 1,000 employees and up to 3 sites, up to 25 log sources. Adds memory capture and network traffic recording review, and we write the evidence collection framework, chain of custody procedures and 5 investigation playbooks including insider threat. Limits: employees 1000, locations 3 Includes: - Everything in the readiness review - Memory capture and network recording capability review - Evidence collection framework and chain of custody procedures - 5 investigation playbooks (including insider threat) - Training recommendations for IT staff Excludes: - Custom collection scripts or tooling - Logging infrastructure design - Legal hold process integration with counsel - Performing an actual investigation #### Enterprise Forensic Investigation Framework: $85K Up to 2,500 employees and up to 10 sites, up to 50 log sources. Adds custom evidence collection scripts for your platforms, a target logging architecture for forensic retention, 10 playbooks, and legal hold procedures designed with your counsel. Limits: employees 2500, locations 10 Includes: - Everything in the standard tier - Custom evidence collection scripts - Target logging architecture for forensic retention - 10 investigation playbooks - Legal hold procedures and regulatory evidence guidance Excludes: - Deploying logging infrastructure or buying tools - Incident response or forensic investigation retainer - Legal advice (provided by the client's counsel) - Organizations above 2,500 employees (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=digital-forensics-readiness-assessment ## Disaster Recovery Assessment > From $35K · Managed Security & Incident Response · https://cisomarketplace.services/services/disaster-recovery-assessment Comprehensive evaluation of your organization's disaster recovery capabilities, testing recovery procedures, and ensuring business continuity in the event of catastrophic incidents or outages. ### In scope - Recovery plan assessment - Backup system evaluation - RTO/RPO validation - DR testing procedures - Technical recovery capabilities - Crisis communication review - DR documentation analysis ### Deliverables - Detailed DR capability report - Gap analysis and recommendations - Recovery test results - Updated DR documentation - Recovery improvement roadmap - Critical system recovery procedures ### Tiers #### Core DR Assessment: $35K Up to 250 employees and 1 primary site. DR plan, backup configuration and RTO/RPO targets reviewed for up to 10 critical systems, with one witnessed backup restore test. DR capability report, gap analysis and improvement roadmap. Limits: employees 250, locations 1 Includes: - DR plan and documentation analysis - Backup system evaluation - RTO/RPO validation for up to 10 critical systems - One witnessed backup restore test - Gap analysis and recovery improvement roadmap Excludes: - Tabletop exercises - Recovery testing beyond one restore - Rewriting DR documentation - Failover validation #### Standard DR Program: $60K Up to 1,000 employees and up to 3 sites, up to 25 critical systems. Adds 2 facilitated DR tabletop scenarios, recovery tests of up to 3 systems measured against RTO/RPO, crisis communication review, and updated DR documentation and recovery procedures. Limits: employees 1000, locations 3, scenarios 2 Includes: - Everything in the core assessment - 2 facilitated DR tabletop scenarios - Recovery tests of up to 3 systems with measured results - Crisis communication review - Updated DR documentation and critical system recovery procedures Excludes: - Live failover of production - Automated failover validation - Crisis management program development - Remediation of backup or DR infrastructure #### Enterprise DR Solution: $95K Up to 2,500 employees and up to 10 sites, up to 50 critical systems. Adds live recovery testing of up to 5 systems including a planned failover to the recovery site, automated failover validation, 3 tabletop scenarios and a crisis management exercise with executives. Limits: employees 2500, locations 10, scenarios 3 Includes: - Everything in the standard tier - Live recovery test of up to 5 systems with planned failover - Automated failover validation - 3 tabletop scenarios including an executive crisis exercise - Recovery test results report against RTO/RPO Excludes: - Building or buying DR infrastructure - Business-side continuity planning (see Business Continuity Assessment) - Ongoing DR test program management - Organizations above 2,500 employees (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=disaster-recovery-assessment ## Ransomware Readiness Assessment > From $30K · Managed Security & Incident Response · https://cisomarketplace.services/services/ransomware-readiness-assessment Evaluate your organization's ability to prevent, detect, and recover from sophisticated ransomware attacks. Our assessment identifies critical gaps in ransomware defense and provides a clear roadmap for enhancing resilience. ### In scope - Email security controls - Endpoint protection assessment - Network segmentation review - Backup and recovery systems - Active Directory security - User awareness evaluation - Privileged access management ### Deliverables - Ransomware defense report - Technical control recommendations - Recovery capability assessment - Remediation roadmap - Tabletop scenario results - Incident response playbook updates ### Tiers #### Essential Ransomware Defense: $30K Control review for up to 500 employees and 1 location with one AD forest: email security, endpoint protection, segmentation, backups, AD and privileged access, by configuration review and interviews. Report and remediation roadmap. Limits: employees 500, locations 1 Includes: - Review of the 7 ransomware control areas - Backup and recovery capability review on paper - Active Directory security configuration review - Ransomware defense report - Remediation roadmap Excludes: - Tabletop exercise - Hands-on restore testing - Attack simulation - IR playbook updates #### Enhanced Ransomware Protection Program: $55K Up to 2,500 employees and up to 3 locations. Adds 1 ransomware tabletop scenario for up to 20 participants, observed restore tests of up to 3 critical systems, a user awareness evaluation, and updates to the existing IR playbook. Limits: employees 2500, locations 3, scenarios 1, participants 20 Includes: - Everything in the basic tier - 1 ransomware tabletop scenario - Observed restore tests of up to 3 critical systems - User awareness evaluation - Updates to the existing IR playbook Excludes: - Ransomware attack simulation in the environment - A new custom playbook written from scratch - Remediation implementation #### Complete Anti-Ransomware Solution: $85K No fixed employee cap - scoped at kickoff; up to 10 locations. Adds ransomware attack simulation with non-destructive techniques, restore validation of up to 8 critical systems, 2 tabletop scenarios for up to 40 participants, and a custom playbook. Limits: locations 10, scenarios 2, participants 40 Includes: - Everything in the enhanced tier - Non-destructive ransomware attack simulation - Restore validation of up to 8 critical systems - 2 tabletop scenarios (technical and executive) - Custom ransomware response playbook Excludes: - Remediation implementation - Incident response retainer - Ransom negotiation services ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ransomware-readiness-assessment ## Security Automation & Orchestration Assessment > From $36K · Managed Security & Incident Response · https://cisomarketplace.services/services/security-automation-orchestration-assessment Comprehensive evaluation of your organization's security automation capabilities and integration with security workflows. Our assessment analyzes your current security orchestration, automation, and response (SOAR) implementation, identifies opportunities for enhanced efficiency, and provides a roadmap to accelerate threat response through optimized automation. ### In scope - Security automation platform assessment - Workflow integration analysis - Playbook effectiveness evaluation - Alert triage automation review - Orchestration capability assessment - Response time metrics analysis - Integration ecosystem evaluation - Automation governance review - Security tool integration assessment - Automation ROI analysis - Skills gap identification - Use case prioritization ### Deliverables - Security automation maturity report - Workflow optimization recommendations - Playbook enhancement strategy - Integration architecture recommendations - Automation roadmap and timeline - Response time improvement projections - ROI analysis for proposed automations - Use case prioritization framework - Skills development recommendations - Tool integration guidance ### Tiers #### Essential Automation Assessment: $36K Assessment of 1 automation platform: up to 10 existing playbooks and up to 10 tool integrations reviewed, alert triage and response time metrics analysis, maturity report and prioritized use case list. 160 consulting hours. No playbooks are written. Limits: hours 160 Includes: - Automation maturity report for 1 platform - Review of up to 10 playbooks and 10 integrations - Alert triage and response time metrics analysis - Use case prioritization framework - Skills gap findings Excludes: - New playbook design or development - Integration architecture design - ROI model for proposed automations - Implementation support #### Advanced Automation & Orchestration Program: $65K Comprehensive assessment with detailed automation roadmap, playbook development, and integration architecture Excludes: - Building and deploying playbooks in the platform - Post-deployment ROI measurement - Platform licensing or procurement #### Enterprise Security Automation Transformation: $95K Complete automation transformation program with custom playbook development, implementation support, and ROI validation Excludes: - Platform licensing costs - 24x7 operation of the automation platform - Development beyond the included hours ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=security-automation-orchestration-assessment ## Tabletop Exercises Program > From $28K · Managed Security & Incident Response · https://cisomarketplace.services/services/tabletop-exercises Structured, facilitated simulations of cybersecurity incidents designed to test your organization's incident response capabilities, processes, and decision-making. Our exercises create realistic scenarios to identify gaps, improve coordination, and enhance your incident response effectiveness. ### In scope - Incident response plan review - Custom scenario development - Exercise facilitation - Decision point evaluation - Interdepartmental coordination assessment - Communications procedure testing - Executive decision-making assessment ### Deliverables - Exercise findings report - IR plan improvement recommendations - Incident response procedure gaps - Response timeline analysis - Communications effectiveness assessment - Executive briefing - Follow-up exercise roadmap ### Tiers #### Basic Response Exercise: $28K Single scenario tabletop exercise focused on technical incident response procedures Limits: participants 15, scenarios 1, sessions 1 Excludes: - Management and communications team exercise - Executive participation and executive briefing - Multiple scenarios - Follow-up exercise #### Advanced Exercise Program: $45K Up to 3 scenarios over up to 3 sessions for up to 30 participants, testing technical, communications and management response separately. Adds communications effectiveness assessment, executive briefing, and a follow-up exercise roadmap. Limits: participants 30, scenarios 3, sessions 3 Includes: - Everything in the basic tier - Up to 3 scenarios across technical, communications and management teams - Communications procedure testing - Executive briefing of results - Follow-up exercise roadmap Excludes: - Single combined simulation with executives, legal and PR in the room - Escalating injects across business units - Crisis communications drafting #### Comprehensive Crisis Simulation: $75K Full-day crisis simulation plus preparation sessions: up to 5 escalating scenarios over up to 4 sessions for up to 60 participants from executives, technical teams, legal, PR and business units, with live injects and decision-point scoring. Limits: participants 60, scenarios 5, sessions 4 Includes: - Everything in the advanced tier - Full-day multi-team crisis simulation - Up to 5 escalating scenarios with live injects - Executive decision-making assessment - Interdepartmental coordination assessment - Executive and board-level briefing Excludes: - Technical attack simulation against live systems - Rewriting the IR plan - Recurring quarterly exercises ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=tabletop-exercises --- # Practice: Advisory / vCISO Fractional security leadership, program development and board-level risk communication from practitioners who have held the role. ## Zero Trust Security Assessment > From $38K · Advisory / vCISO · https://cisomarketplace.services/services/zero-trust-security-assessment Comprehensive evaluation of your organization's zero trust architecture implementation, examining identity verification, network segmentation, and access controls. Our assessment identifies gaps in your zero trust strategy and provides a roadmap for enhancing security beyond traditional perimeter-based approaches. ### In scope - Identity and access management evaluation - Microsegmentation assessment - Continuous verification analysis - Least privilege implementation review - Network traffic inspection capabilities - Device trust verification - Data protection controls - Zero trust policy enforcement ### Deliverables - Zero trust maturity assessment report - Architecture gap analysis - Implementation roadmap - Identity strategy recommendations - Microsegmentation design guidance - Policy enforcement framework - Continuous monitoring strategy - Technology stack recommendations ### Tiers #### Zero Trust Readiness Assessment: $38K Zero trust readiness review for up to 500 employees, up to 3 locations and up to 2 cloud accounts: current-state maturity scoring across identity, devices, network, data and policy enforcement from interviews and document review, with a gap list and next steps. Limits: employees 500, locations 3, cloud accounts 2 Includes: - Maturity scoring across zero trust pillars - Identity and access management evaluation - Device trust and least-privilege review - Gap list with next steps - 1 readout Excludes: - Hands-on configuration review - Phased implementation roadmap - Technology stack recommendations - Microsegmentation design #### Comprehensive Zero Trust Program: $65K Assessment for up to 2,500 employees, up to 10 locations and up to 5 cloud accounts. Adds configuration review of identity, segmentation and traffic inspection controls, a phased implementation roadmap, identity strategy and technology stack recommendations. Limits: employees 2500, locations 10, cloud accounts 5 Includes: - Configuration review of identity and network controls - Microsegmentation assessment - Phased implementation roadmap - Identity strategy recommendations - Technology stack recommendations - Continuous monitoring strategy Excludes: - Target architecture design - Microsegmentation policy design - Vendor selection support - Implementation work #### Enterprise Zero Trust Transformation: $95K No fixed headcount or location cap (scoped at kickoff). Everything in Standard plus target zero trust architecture design, microsegmentation design guidance, a policy enforcement framework, implementation planning by workstream and integration design with existing tools. Includes: - Scope set at kickoff, no fixed cap - Target architecture design - Microsegmentation design guidance - Policy enforcement framework - Workstream implementation plan - Integration design with existing tools Excludes: - Deployment and configuration of products - Product licences - Ongoing operation of the zero trust controls ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=zero-trust-security-assessment ## CISO Comprehensive Security Assessment > From $65K · Advisory / vCISO · https://cisomarketplace.services/services/ciso-comprehensive-security-assessment Holistic evaluation of your organization's entire security program across all critical domains. This efficient, structured assessment provides CISOs and security leaders with a complete diagnostic of security capabilities, maturity gaps, and prioritized improvement opportunities. Our comprehensive approach delivers actionable insights across governance, technical controls, and operational security to inform strategic decision-making and resource allocation. ### In scope - Security program governance assessment - Security architecture evaluation - Cloud security posture review - Identity and access management analysis - Application security program assessment - Data protection controls review - Network security evaluation - Vulnerability management program assessment - Security operations and incident response review - Third-party risk management assessment - Security awareness program evaluation - Compliance posture analysis - Emerging technology risk assessment - Security metrics and reporting review ### Deliverables - Comprehensive security posture report - Security program maturity scoring - Domain-by-domain gap analysis - Risk-prioritized recommendation roadmap - Security investment guidance - Executive presentation with findings - Implementation timeline and resource requirements - Benchmark comparison to industry peers - Security metrics dashboard - Detailed technical findings appendix ### Tiers #### Standard Enterprise Assessment: $65K Security programme assessment across all 14 domains for up to 500 employees, up to 3 locations and up to 3 cloud accounts. Based on up to 15 stakeholder interviews and document review; maturity scoring, gap analysis, prioritised roadmap and 1 executive readout. Limits: employees 500, locations 3, cloud accounts 3, sessions 1 Includes: - All 14 programme domains assessed - Up to 15 stakeholder interviews - Maturity scoring and domain gap analysis - Risk-prioritised roadmap - 1 executive readout Excludes: - Hands-on configuration review of cloud, identity and network controls - Penetration testing or vulnerability scanning - Peer benchmark comparison - Board presentation and executive workshops #### Advanced Enterprise Assessment: $95K All 14 domains for up to 2,500 employees, up to 10 locations and up to 10 cloud accounts. Adds hands-on configuration review of cloud, identity and network controls, up to 30 interviews, a technical findings appendix, peer benchmark and remediation guidance per finding. Limits: employees 2500, locations 10, cloud accounts 10, sessions 2 Includes: - Up to 30 stakeholder interviews - Configuration review of cloud, identity and network controls - Detailed technical findings appendix - Peer benchmark comparison - Remediation guidance with resource estimates - 2 readouts (technical and executive) Excludes: - Penetration testing - Board-level presentation - Executive workshops - Multi-year investment plan #### Executive Security Program Assessment: $150K No fixed headcount or location cap; scoped for multi-entity or multi-region enterprises. Everything in Advanced plus a board-level presentation, up to 4 executive workshops, a multi-year strategic roadmap with investment guidance and a security metrics dashboard design. Limits: sessions 4 Includes: - Scope set at kickoff, no fixed size cap - Board-level presentation - Up to 4 executive workshops - Multi-year roadmap with investment guidance - Detailed peer benchmarking - Security metrics dashboard design Excludes: - Penetration testing - Implementation of roadmap items - Ongoing vCISO support after delivery ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ciso-comprehensive-security-assessment ## Security Technology Selection Advisory > From $40K · Advisory / vCISO · https://cisomarketplace.services/services/security-technology-selection-advisory Vendor-neutral guidance for organizations navigating complex security technology decisions. Our expert advisory service helps security leaders define requirements, evaluate solutions, and select technologies that align with their security strategy and business needs, avoiding costly procurement mistakes and ensuring optimal return on security investments. ### In scope - Security needs assessment - Current technology stack review - Requirements definition framework - Solution evaluation methodology - Vendor shortlist development - POC/testing criteria development - TCO and ROI analysis - Implementation considerations - Vendor negotiation guidance - Technology roadmap alignment ### Deliverables - Technology requirements document - Evaluation framework and criteria - Vendor landscape analysis - RFP development guidance - Solution comparison matrix - Selection recommendation report - Implementation roadmap - Procurement strategy - Contract review guidance - Technology integration considerations ### Tiers #### Single Technology Selection: $40K Selection of 1 security technology category (for example EDR or SIEM): needs assessment, requirements document, evaluation criteria, up to 5 vendors compared, proof-of-concept test criteria, cost-of-ownership comparison and a selection recommendation. Limits: vendors 5 Includes: - 1 technology category - Requirements document - Up to 5 vendors compared - Proof-of-concept criteria - TCO comparison and recommendation Excludes: - Running the proof of concept - More than 1 category - Contract negotiation on the client's behalf - Implementation #### Security Program Technology Selection: $75K Selection of up to 4 related technology categories within 1 security domain, up to 15 vendors in total. Adds current stack review, integration fit between the chosen products, RFP guidance, negotiation guidance and an implementation roadmap. Limits: vendors 15 Includes: - Up to 4 categories in 1 domain - Up to 15 vendors compared - Current stack review - Integration fit analysis - RFP and negotiation guidance - Implementation roadmap Excludes: - Enterprise-wide architecture strategy - Multi-year technology roadmap - Running proofs of concept - Implementation #### Enterprise Security Technology Strategy: $120K Enterprise-wide technology strategy with no fixed category or vendor cap (scoped at kickoff): full stack review, consolidation opportunities, a reusable selection framework, multi-year technology roadmap, integration strategy, procurement strategy and contract review guidance. Includes: - Scope set at kickoff, no fixed cap - Full security stack review - Reusable selection framework - Multi-year technology roadmap - Integration and procurement strategy - Contract review guidance Excludes: - Running proofs of concept - Implementation or migration work - Legal review of contracts ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=security-technology-selection-advisory ## CCO-as-a-Service Subscription > From $6.5K / mo · Advisory / vCISO · https://cisomarketplace.services/services/cco-as-a-service Outsourced Chief Compliance Officer service providing ongoing compliance management and governance support. ### In scope - Compliance program management - Policy development and maintenance - Regulatory monitoring - Compliance training oversight - Board and management reporting ### Deliverables - Monthly compliance reports - Policy updates - Training materials - Compliance dashboards - Board presentations - Audit support ### Tiers #### Startup CCO Service: $6.5K / month CCO services for startups and small businesses Limits: employees 50, frameworks 1 Excludes: - Board presentations - On-site audit or regulator exam support - Second regulatory regime - Compliance manager and analyst support beyond the CCO #### Growth Company CCO Service: $12K / month CCO services for growing mid-market companies Limits: employees 500, frameworks 3 Excludes: - Multi-entity or multi-jurisdiction programmes - Dedicated regulatory analyst - Legal advice or representation in enforcement matters #### Enterprise CCO Service: $20K / month CCO services for large enterprises Limits: employees 2500, frameworks 5 Excludes: - Legal advice or representation in enforcement matters - Compliance software licences - Data Protection Officer designation (separate service) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cco-as-a-service ## CISO & CCO Executive Training and Life Coaching Subscription > From $3.5K / mo · Advisory / vCISO · https://cisomarketplace.services/services/ciso-cco-executive-coaching Executive-level training and coaching services for Chief Information Security Officers and Chief Compliance Officers, including leadership development. ### In scope - Leadership development - Executive presence coaching - Strategic thinking training - Communication skills enhancement - Work-life balance coaching ### Deliverables - Monthly coaching sessions - Personalized development plans - Training materials - Progress assessments - Networking opportunities ### Tiers #### Individual Executive Coaching: $3.5K / month One-to-one coaching for 1 CISO or CCO: 1 session of 90 minutes each month, a personal development plan set in month one, and a progress assessment every quarter. Limits: participants 1, sessions 1 Includes: - 1 coaching session per month (90 minutes) - Personal development plan - Quarterly progress assessment - Training materials Excludes: - Weekly sessions - Coach contact between sessions - Coaching of direct reports or the wider team - Preparation support for specific board meetings #### Intensive Executive Development: $7.5K / month One-to-one coaching for 1 executive: 4 sessions of 60 minutes each month (weekly), message access to the coach between sessions, preparation support for board and executive presentations, and a monthly progress review. Limits: participants 1, sessions 4 Includes: - 4 coaching sessions per month (weekly) - Coach contact between sessions - Board and executive presentation preparation - Monthly progress review - Access to an industry mentor Excludes: - Coaching for more than one person - Team workshops - Technical security training #### Group Executive Program: $12K / month Group coaching for leadership teams Limits: participants 8, sessions 4 Excludes: - Weekly one-to-one sessions for each participant - Coaching for more than 8 people - Technical security training ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ciso-cco-executive-coaching ## Data Protection & Compliance Officer Advisory Services > From $8.5K / mo · Advisory / vCISO · https://cisomarketplace.services/services/data-protection-compliance-officer-services Specialized advisory service providing organizations with expert Data Protection Officer (DPO) and/or Chief Compliance Officer (CCO) capabilities without the overhead of full-time executive hires. Our experienced professionals serve as your designated privacy and compliance leadership, fulfilling regulatory requirements while implementing effective data protection and compliance programs tailored to your organization's specific needs. ### In scope - Data protection program management - Privacy impact assessment oversight - Regulatory monitoring and updates - Compliance program administration - Board and executive reporting - Regulatory liaison services - Data subject request management - Employee training program oversight - Audit preparation and supervision - Privacy by design implementation - Incident response coordination - Vendor compliance management - Program documentation maintenance - Regulatory filing preparation ### Deliverables - Monthly compliance status reports - Data protection strategy guidance - Executive briefing materials - Regulatory compliance roadmaps - Audit preparation documentation - Incident response guidance - Policy and procedure updates - Employee training materials - Regulatory submission drafts - Risk assessment reports - Board presentation materials - Compliance metrics dashboard ### Tiers #### Compliance Officer Advisory Services: $8.5K / month Expert guidance and support for your existing privacy and compliance teams with regular consulting and program oversight Limits: employees 250, frameworks 2 Excludes: - Acting as the named DPO or CCO - Contact with regulators on the client's behalf - Handling individual data subject requests - Board presentations #### Fractional DPO & CCO Service: $15K / month Part-time designated Data Protection Officer and/or Compliance Officer providing leadership, regulatory representation, and program management Limits: employees 1000, frameworks 4 Excludes: - Day-to-day processing of every data subject request - Dedicated supporting team - Legal representation in enforcement proceedings - Privacy tooling licences #### Enterprise Privacy & Compliance Leadership: $25K / month Full outsourced privacy and compliance function with dedicated team, comprehensive program management, and executive representation Excludes: - Legal representation in enforcement proceedings - Privacy tooling licences - Security operations or technical incident response ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=data-protection-compliance-officer-services ## Managed Security Awareness & Phishing Simulation > From $450 / mo · Advisory / vCISO · https://cisomarketplace.services/services/managed-security-awareness-phishing-simulation Buying an awareness platform is easy; running it well every month is what nobody has time for. We run the whole program on the platform of your choice: monthly phishing simulations written against current lures, targeted training for repeat clickers, new-hire onboarding, and the metrics your auditor and insurer ask for — reviewed by a CISO, not just scheduled by a tool. ### In scope - Monthly phishing simulations based on current lures - Role-based and remedial training assignments - New-hire onboarding track - Executive and finance-team spear-phishing scenarios - Audit- and insurer-ready reporting ### Deliverables - Monthly campaign results and trend report - Repeat-clicker remediation plan - Annual training completion evidence - Quarterly human-risk briefing ### Tiers #### Essential Awareness Program: $450 / month Up to 50 users: monthly simulations, annual training and compliance reporting Limits: users 50 #### Advanced Awareness Program: $1,200 / month Up to 250 users: adds role-based training, repeat-clicker coaching and quarterly briefing Limits: users 250 #### Enterprise Awareness Program: $2,800 / month Up to 1,000 users: adds executive spear-phishing, vishing scenarios, custom content and human-risk scoring Limits: users 1000 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=managed-security-awareness-phishing-simulation ## Private Equity Portfolio Cyber Oversight Program > Scoped per engagement · Advisory / vCISO · https://cisomarketplace.services/services/pe-portfolio-cyber-oversight-program Sponsors carry cyber risk across every platform and add-on they own, usually with no consistent view of it. This program gives the fund a portfolio CISO: a common baseline assessment for each company, quarterly scorecards for operating partners and LPs, pre-close cyber diligence on new deals, 100-day plans after close and incident escalation support. Priced per portfolio after scoping — the number of companies, their size and the diligence cadence drive it. ### In scope - Common cyber baseline for every portfolio company - Quarterly portfolio scorecards and board reporting - Pre-close cyber due diligence on new deals and add-ons - Post-close 100-day security plans - Incident escalation and insurer coordination ### Deliverables - Portfolio cyber risk dashboard - Per-company baseline reports and roadmaps - Diligence reports per transaction - Quarterly operating-partner and LP briefing ### Tiers #### Essential Portfolio Oversight: scoped Up to 5 portfolio companies: annual baselines, semi-annual scorecards and diligence on demand #### Advanced Portfolio Oversight: scoped Up to 15 companies: quarterly scorecards, 100-day plans for new acquisitions and a named portfolio CISO #### Enterprise Portfolio Oversight: scoped Large or multi-fund portfolios: embedded team, continuous monitoring, incident response coordination and LP reporting ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=pe-portfolio-cyber-oversight-program ## SMB Continuous Security > From $2K / mo · Advisory / vCISO · https://cisomarketplace.services/services/smb-continuous-security Ongoing security monitoring and assessment program. ### In scope - Weekly vulnerability scans - Monthly phishing campaigns - Quarterly penetration tests - Bi-weekly security advisory - Incident response support - Security metrics dashboard - Annual risk assessment ### Deliverables - Monthly security scorecard - Quarterly executive summary - Annual security posture report - Real-time dashboard access - 4 hours monthly advisory ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-continuous-security ## Security Program Development > From $5K · Advisory / vCISO · https://cisomarketplace.services/services/security-program-development Build and mature your security program with expert guidance ### In scope - Security Architecture Review - Controls Assessment - Risk Analysis - Compliance Mapping - Security Program Evaluation ### Deliverables - Detailed Assessment Report - Executive Summary - Recommendations Document - Implementation Roadmap - Follow-up Consultation ### Tiers #### Core Security Program Development: $5K Up to 20 consulting hours a month with 1 guidance session monthly: programme gap review, core policy set drafted from templates, and a prioritised plan for baseline controls with follow-up on progress. Limits: hours 20, sessions 1 Includes: - Up to 20 hours per month - 1 guidance session per month - Core policy set from templates - Baseline controls plan - Programme roadmap Excludes: - Security architecture design - Mapping to a specific compliance framework - Board reporting - Hands-on tool implementation #### Advanced Security Program Development: $8.5K Up to 40 consulting hours a month with weekly guidance sessions. Adds security architecture review and target design, adaptation of 1 control framework to the organisation, compliance mapping, risk analysis and a maintained risk register. Limits: hours 40, sessions 4 Includes: - Up to 40 hours per month - Weekly guidance sessions - Security architecture review and design - 1 control framework adapted - Compliance mapping - Risk register Excludes: - Named dedicated consultant - More than 1 framework - Board presentations - Hands-on tool implementation #### Enterprise Security Program Development: $15K Up to 80 consulting hours a month with a named consultant and up to 8 sessions monthly. Adds implementation of up to 3 frameworks, programme metrics, a quarterly programme review with leadership and continuous roadmap updates. Limits: hours 80, sessions 8 Includes: - Up to 80 hours per month - Named consultant - Up to 3 frameworks implemented - Programme metrics - Quarterly leadership review - Continuous roadmap updates Excludes: - Acting as the named CISO (see vCISO services) - Hands-on engineering and tool deployment - Audit or certification fees ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=security-program-development ## Security Questionnaire & RFP Response Service > From $950 / mo · Advisory / vCISO · https://cisomarketplace.services/services/security-questionnaire-rfp-response-service Every enterprise deal arrives with a security questionnaire — SIG, CAIQ, a customer spreadsheet or an RFP security section. We build your answer library from your real controls, complete questionnaires inside an agreed turnaround, have a CISO review every submission, and stand up a trust center so many requests never need a questionnaire at all. AI-assisted drafting keeps it fast; a named practitioner keeps it accurate. ### In scope - Answer library built from your policies, controls and audit reports - Questionnaire completion (SIG, CAIQ, custom spreadsheets, portals) - CISO review of every submission - Trust center setup and upkeep - Gap log: questions you cannot yet answer 'yes' to ### Deliverables - Maintained answer library - Completed questionnaires within the agreed turnaround - Public or gated trust center - Quarterly gap report that feeds your security roadmap ### Tiers #### Essential Questionnaire Support: $950 / month Up to 3 questionnaires a month, 5-business-day turnaround, answer library and a basic trust center page. Limit key 'sessions' = questionnaires per month. Limits: sessions 3 #### Advanced Questionnaire Support: $2.5K / month Up to 10 a month, 3-day turnaround, gated trust center with document requests and quarterly gap report Limits: sessions 10 #### Enterprise Questionnaire Desk: $6.5K / month Fair-use volume up to 40 questionnaires a month, 48-hour turnaround, RFP security sections and live customer security calls with a CISO. Limits: sessions 40 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=security-questionnaire-rfp-response-service ## Sr Engineer-as-a-Service Subscription > From $8.5K / mo · Advisory / vCISO · https://cisomarketplace.services/services/sr-engineer-as-a-service Access to senior-level engineering expertise on a subscription basis for cybersecurity implementation and support. ### In scope - Security architecture design - Tool implementation and configuration - Security automation development - Infrastructure hardening - Technical mentoring ### Deliverables - Monthly engineering reports - Implemented security controls - Automation scripts and tools - Architecture documentation - Knowledge transfer sessions ### Tiers #### Part-Time Engineer: $8.5K / month 20 hours per week of senior engineering support Excludes: - Full-time availability - More than 1 engineer or specialism at once - On-call or after-hours support - Tool and cloud licence costs #### Full-Time Engineer: $16K / month 40 hours per week of senior engineering support Excludes: - Parallel workstreams across several specialisms - On-call or after-hours support - Tool and cloud licence costs #### Engineering Team: $28K / month Access to a team of senior engineers Excludes: - Security leadership or vCISO duties - Tool and cloud licence costs ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=sr-engineer-as-a-service ## Technical Writer & Report Proofer Subscription > From $4.5K / mo · Advisory / vCISO · https://cisomarketplace.services/services/technical-writer-subscription Professional technical writing services for cybersecurity documentation, reports, and compliance materials. ### In scope - Security documentation creation - Report writing and editing - Policy and procedure development - Technical content review - Compliance documentation support ### Deliverables - Monthly documentation deliverables - Edited reports - Policy documents - Technical guides - Style guide maintenance ### Tiers #### Basic Documentation Support: $4.5K / month Up to 10 documents a month and up to 40 writer hours: editing and proofing of security reports, policy and procedure drafting from client input, 1 revision round per document, 5-business-day turnaround. Limits: hours 40 Includes: - Up to 10 documents per month - Up to 40 writer hours - Report editing and proofing - Policy and procedure drafting - 1 revision round per document Excludes: - Style guide creation and upkeep - Rush turnaround - Subject-matter technical review of findings - More than 1 revision round #### Professional Documentation Support: $8.5K / month Up to 25 documents a month and up to 80 writer hours. Adds a maintained style guide, technical guides and compliance documentation, 2 revision rounds per document and 3-business-day turnaround. Limits: hours 80 Includes: - Up to 25 documents per month - Up to 80 writer hours - Maintained style guide - Technical guides and compliance documentation - 2 revision rounds per document Excludes: - Named dedicated writer - Same-week rush on large reports - Subject-matter technical review of findings #### Enterprise Documentation Support: $15K / month Unlimited documentation support Excludes: - Translation - Subject-matter technical review of findings - Graphic design beyond diagrams and tables ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=technical-writer-subscription ## Virtual & Fractional CISO Services > From $9.5K / mo · Advisory / vCISO · https://cisomarketplace.services/services/virtual-fractional-ciso-services Expert security leadership for organizations that need executive-level cybersecurity guidance without the cost of a full-time CISO. Our Virtual/Fractional CISO service provides experienced security executives who integrate with your team to develop and manage your security program, guide strategic initiatives, communicate with your board, and ensure security aligns with business objectives. ### In scope - Security program development and oversight - Board and executive reporting - Security strategy development - Budget planning and management - Security team leadership - Risk assessment and management - Vendor security management - Regulatory compliance guidance - Policy and standards development - Security architecture review - Security metrics program - Incident response leadership - Security awareness program oversight - Technology selection advisory ### Deliverables - Monthly security status reports - Executive briefing materials - Board presentations - Security roadmap development - Budget recommendations - Security policies and procedures - Risk register and analysis - Vendor security requirements - Compliance tracking dashboard - Security metrics reporting - Security architecture guidance - Incident response coordination - Strategic technology planning ### Tiers #### CISO Advisory Services: $9.5K / month Strategic security guidance and advisory support for organizations with existing security teams that need executive expertise Limits: employees 250 Excludes: - Presenting to the board - Managing the security team day to day - Incident response leadership - Vendor security reviews #### Fractional CISO Program: $17.5K / month Dedicated part-time CISO providing hands-on security leadership, board reporting, and program management on a regular cadence Limits: employees 1000 Excludes: - Supporting architect or governance specialists - Hands-on engineering #### Enterprise Security Leadership Program: $28K / month Comprehensive security leadership with dedicated CISO and supporting team, providing full executive security function for complex organizations Excludes: - Hands-on engineering and tool deployment - SOC monitoring - Hours beyond the monthly allotment ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=virtual-fractional-ciso-services ## Board & Executive Cyber Risk Education Program > From $45K · Advisory / vCISO · https://cisomarketplace.services/services/board-executive-cyber-risk-education Specialized education program designed to help boards of directors and executive teams understand, govern, and communicate about cybersecurity risks and their fiduciary responsibilities. Our expert-led program addresses the growing regulatory requirements for cyber risk oversight, SEC disclosure obligations, and provides practical frameworks for effective security governance at the highest organizational levels. ### In scope - Board cyber governance assessment - SEC disclosure requirements review - Cyber risk quantification training - Board reporting framework development - Crisis response role-playing - Legal and fiduciary responsibility education - Cyber risk communication workshop - Industry-specific threat briefings - Comparative peer analysis - Executive tabletop scenario ### Deliverables - Board cyber governance playbook - Executive briefing materials - Cyber risk dashboard templates - SEC disclosure guidance - Crisis communication framework - Board committee charter recommendations - Governance maturity assessment - Quarterly reporting templates - Year-long education roadmap ### Tiers #### Essential Board Cyber Education: $45K Core education program with fundamental cyber risk governance training and basic reporting frameworks Limits: participants 12, sessions 4, scenarios 1 Excludes: - Cyber risk quantification with the organisation's own figures - Custom governance playbook and committee charter recommendations - Peer comparison analysis - Advisory support after the final session #### Comprehensive Board Governance Program: $75K Complete education program with detailed risk quantification, sophisticated reporting, and customized governance frameworks Limits: participants 15, sessions 6, scenarios 2 Excludes: - Quarterly briefings after the programme ends - On-call advisory to the board or committee chair - Industry benchmarking refresh - Drafting of actual SEC filings #### Premium Board & Executive Cyber Program: $125K Advanced program with ongoing advisory support, quarterly updates, industry benchmarking, and tailored committee structures Limits: participants 20, sessions 10, scenarios 4 Excludes: - Drafting of actual SEC filings or legal opinions - Serving as a board member or named CISO - Security awareness training for general staff ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=board-executive-cyber-risk-education ## Identity Threat Detection & Response (ITDR) > Scoped per engagement · Advisory / vCISO · https://cisomarketplace.services/services/identity-threat-detection-response-itdr Identity-centric threat detection and response across Active Directory / Entra ID — privilege escalation, lateral movement, account takeover, and identity misconfiguration detection + response playbooks. ### In scope - AD/Entra attack-path analysis - Privilege escalation & lateral movement detection - Account takeover detection - Identity misconfiguration review - IR playbooks for identity attacks ### Deliverables - ITDR assessment report - Identity attack-path map - Detection gaps & recommendations - Identity IR playbooks ### Tiers #### Essential: scoped Point-in-time review for up to 1,000 users in 1 AD forest and 1 Entra ID tenant: identity misconfiguration review and attack-path analysis to privileged groups. Report with attack-path map and ranked fixes. Limits: users 1000 Includes: - 1 AD forest and 1 Entra ID tenant - Identity misconfiguration review - Attack-path map to privileged accounts - Ranked remediation list - 1 readout Excludes: - Detection rule engineering - Identity incident response playbooks - Review of existing detection coverage - Ongoing monitoring #### Advanced: scoped Assessment for up to 5,000 users across up to 3 AD forests and Entra tenants. Adds a detection gap review for privilege escalation, lateral movement and account takeover, detection logic written for the client's SIEM, and identity incident response playbooks. Limits: users 5000 Includes: - Up to 3 forests and tenants - Attack-path analysis and misconfiguration review - Detection gap analysis - Detection logic for the client's SIEM - Identity incident response playbooks - Retest of fixed attack paths (1 round) Excludes: - Ongoing detection monitoring and tuning - 24/7 response to identity alerts - SIEM or ITDR product licences #### Enterprise: scoped Managed ITDR program with continuous detection Excludes: - SIEM or ITDR product licences - Hands-on remediation in AD or Entra ID ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=identity-threat-detection-response-itdr --- # Practice: Compliance & GRC SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, FedRAMP and privacy programs, scoped to the audit you actually face. ## Continuous Attack Surface Monitoring > From $8K / mo · Compliance & GRC · https://cisomarketplace.services/services/continuous-attack-surface-monitoring Comprehensive continuous monitoring of your external attack surface with regular assessments and testing. ### In scope - External attack surface - Vulnerability management - Penetration testing ### Deliverables - Weekly external scan reports - Monthly vulnerability assessment reports - Quarterly penetration test findings ### Tiers #### Basic: $8K / month Monthly subscription covering up to 100 external IPs and up to 5 root domains: weekly external scans with a report each week, and a monthly analyst-reviewed vulnerability assessment report with prioritized fixes. No penetration testing. Limits: external ips 100, domains 5 Includes: - Weekly external scan reports - Monthly analyst-reviewed vulnerability assessment report - Asset and subdomain discovery for up to 5 root domains - Prioritized remediation list each month Excludes: - Quarterly penetration tests - Internal network or authenticated application testing - Remediation of findings - 24/7 alerting or incident response #### Premium: $15K / month Monthly subscription covering up to 250 external IPs and up to 15 root domains: weekly scans, monthly vulnerability assessment reports, plus a manual external penetration test every quarter (4 per year) with a findings report and one retest of fixed findings per test. Limits: external ips 250, domains 15 Includes: - Weekly external scan reports - Monthly analyst-reviewed vulnerability assessment report - Quarterly manual external penetration test (4 per year) - Penetration test findings report each quarter - One retest of fixed findings per quarterly test Excludes: - Internal network testing - Authenticated web application or API testing - Social engineering - Remediation of findings ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=continuous-attack-surface-monitoring ## Business Continuity Planning Assessment > From $10,800 · Compliance & GRC · https://cisomarketplace.services/services/business-continuity-planning-assessment Comprehensive evaluation of your organization's business continuity capabilities and operational resilience through detailed Business Impact Analysis (BIA), risk assessment, and continuity planning. Our specialized approach combines regulatory compliance requirements with practical business resilience strategies to ensure your organization can maintain critical operations during disruptions and recover effectively from various business interruption scenarios. ### In scope - Business Impact Analysis (BIA) for critical processes (12 hours) - Risk assessment and threat identification (8 hours) - Current business continuity plan evaluation (6 hours) - Critical business process mapping and dependencies (10 hours) - Recovery time and point objectives definition (4 hours) - Alternative site and workspace planning (6 hours) - Communication and notification procedures assessment (4 hours) - Supplier and vendor continuity evaluation (6 hours) - Regulatory compliance requirements analysis (5 hours) - Crisis management team structure review (3 hours) - Business continuity testing methodology development (4 hours) - Training and awareness program assessment (2 hours) ### Deliverables - Comprehensive business continuity assessment report (20-25 pages) - Business Impact Analysis with critical process prioritization - Risk register with threat scenarios and mitigation strategies - Current state vs. desired state gap analysis - Business continuity plan template and framework - Recovery strategies for critical business functions - Alternative site recommendations and workspace planning - Communication and crisis management procedures - Supplier continuity requirements and alternatives - Regulatory compliance mapping and requirements - BCP testing framework and schedule - Training and awareness program recommendations - Implementation roadmap with timeline and resource requirements ### Tiers #### Essential BCP Assessment: $10,800 70 consulting hours and up to 3 stakeholder workshops for 1 site and up to 10 critical processes: BIA, threat/risk assessment, review of the current plan, RTO/RPO definition and a continuity plan template. Limits: locations 1, hours 70, sessions 3 Includes: - 70 consulting hours, up to 3 workshops - BIA for up to 10 critical processes - Risk register and gap analysis - RTO/RPO definitions - BCP template and implementation roadmap Excludes: - Multi-scenario recovery strategies - Testing framework and schedule - Supplier continuity evaluation - Exercises or simulations #### Comprehensive BCP Program: $20,300 130 consulting hours and up to 6 workshops for up to 2 sites and up to 25 critical processes: detailed BIA with dependency mapping, recovery strategies for up to 3 disruption scenarios, regulatory mapping and a BCP testing framework. Limits: locations 2, hours 130, sessions 6 Includes: - 130 consulting hours, up to 6 workshops - BIA for up to 25 processes with dependency mapping - Recovery strategies for up to 3 disruption scenarios - Regulatory compliance mapping - BCP testing framework and schedule Excludes: - Facilitated crisis simulation exercise - Supply chain continuity planning - Ongoing program management #### Enterprise Continuity Transformation: $36.5K Advanced business continuity program with multi-site assessment, supply chain continuity planning, crisis simulation exercises, and ongoing program management support Limits: locations 5, sessions 12, scenarios 2, vendors 15 Excludes: - IT disaster recovery implementation - Alternate site contracts or costs - BCM software licences ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=business-continuity-planning-assessment ## Cannabis Industry Security Program > From $45K · Compliance & GRC · https://cisomarketplace.services/services/cannabis-industry-security Comprehensive security assessment for cannabis operations, including cultivation facilities, retail operations, and supply chain compliance with state-specific regulations. ### In scope - Seed-to-sale tracking security - Payment processing compliance - Cultivation facility security - Retail operation protection - Supply chain validation - State compliance verification ### Deliverables - Cannabis security architecture - Compliance documentation - Track-and-trace security - Payment system security framework - Physical security integration plan - Employee security procedures ### Tiers #### Core Cannabis Security Assessment: $45K Security and state-compliance assessment for a single-state operator: up to 2 licensed facilities, up to 50 employees and up to 5 vendors. Reviews seed-to-sale tracking, payment handling and physical security integration; delivers a gap report and roadmap. Limits: locations 2, employees 50, vendors 5 Includes: - Seed-to-sale / track-and-trace system security review - Payment processing review for up to 2 sites - On-site physical security walkthrough of each facility - State compliance gap report for 1 state - Prioritized remediation roadmap Excludes: - Writing policies and employee procedures - Hands-on control implementation - Operations licensed in more than 1 state - Penetration testing #### Advanced Cannabis Security Program: $75K Assessment plus build-out for operators with up to 5 licensed facilities, up to 250 employees and up to 15 vendors, in up to 2 states. Adds written compliance documentation, employee security procedures, supply chain validation and guided control implementation. Limits: locations 5, employees 250, vendors 15 Includes: - Everything in the Core assessment, for up to 5 facilities - Compliance documentation set for up to 2 states - Employee security procedures - Supply chain and vendor validation for up to 15 vendors - Guided implementation of priority controls - Security architecture document Excludes: - Ongoing program management after hand-off - Recurring compliance monitoring - More than 2 state jurisdictions #### Enterprise Cannabis Security Solution: $120K Full-scope cannabis security with custom compliance tools, continuous monitoring, and complete program management Limits: locations 15, employees 1000, vendors 40 Excludes: - Purchase or installation of cameras, access control or alarm hardware - Legal representation before state regulators ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cannabis-industry-security ## Educational Institution Security Program > From $45K · Compliance & GRC · https://cisomarketplace.services/services/educational-security Comprehensive security assessment for educational institutions, covering student data protection, campus infrastructure, and remote learning systems. ### In scope - Student data protection review - Campus network assessment - Remote learning security evaluation - Physical security analysis - FERPA compliance assessment ### Deliverables - Education security framework - Data protection strategy - Network security analysis - Physical security recommendations - Compliance documentation ### Tiers #### Core Education Security Assessment: $45K Assessment for an institution of up to 2,500 students and staff on 1 campus: student data protection review, FERPA gap assessment, network architecture review, remote learning platform review and a physical security walkthrough. Report and recommendations. Limits: users 2500, locations 1 Includes: - Student data protection review - FERPA compliance gap assessment - Campus network architecture review (document and config based) - Remote learning platform security review - Physical security walkthrough of 1 campus Excludes: - Network vulnerability scanning or penetration testing - Compliance documentation writing - Implementation support - Additional campuses #### Advanced Education Security Program: $75K Up to 10,000 students and staff across up to 3 campuses. Adds vulnerability scanning of campus networks, a segment-by-segment infrastructure analysis, a complete FERPA compliance review with documentation, and a data protection strategy. Limits: users 10000, locations 3 Includes: - Everything in the Core assessment, for up to 3 campuses - Vulnerability scanning of campus networks - Infrastructure analysis per network segment - FERPA compliance documentation - Data protection strategy - Education security framework Excludes: - Program implementation and project management - Custom data-protection tooling or scripts - Penetration testing - Staff and student training delivery #### Enterprise Education Security Solution: $120K Full-scope education security with custom protection tools and complete program implementation Limits: locations 10 Excludes: - Purchase of hardware or software licences - Physical security equipment installation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=educational-security ## Executive Travel Privacy & Security Assessment > From $35K · Compliance & GRC · https://cisomarketplace.services/services/executive-travel-privacy-security-assessment Comprehensive international travel security and privacy assessment for executives, high-net-worth individuals, and VIPs. Ensures secure and private travel across borders while protecting digital assets, communications, and financial transactions. ### In scope - International travel risk assessment - Private aviation security review - Hotel and accommodation security audit - Cross-border payment security - International mobile device security - Travel communication protocols - Digital currency usage abroad - International SIM card security - Ground transportation security - Travel itinerary privacy - Border crossing data protection - International banking security ### Deliverables - Travel security risk assessment report - Secure travel communications playbook - International payment security guide - Hotel security checklist - Private aviation security protocols - Digital security travel kit - Emergency response procedures - Secure travel apps configuration guide - International privacy compliance guide - Travel security incident response plan ### Tiers #### Core Executive Travel Security: $35K Travel security assessment for 1 principal, up to 3 destination countries and up to 3 devices: travel risk assessment, communications and mobile device security, itinerary privacy, border-crossing data protection and hotel security checklist. Limits: subjects 1, devices 3 Includes: - Travel risk assessment for up to 3 destination countries - Secure travel communications playbook - Mobile device and SIM security guidance for up to 3 devices - Itinerary privacy and border-crossing data protection - Hotel security checklist and emergency procedures Excludes: - Private aviation security review - Cross-border payment and banking security - Hands-on device configuration - Support while travelling #### Advanced Executive Travel Protection: $60K Up to 3 principals (executive plus family and staff), up to 6 destination countries and up to 10 devices. Adds private aviation security review, hands-on setup of secure communications and travel apps, cross-border payment, banking and digital currency security. Limits: subjects 3, devices 10 Includes: - Everything in Core, for up to 3 principals and 6 countries - Private aviation security protocols - Hands-on secure communications and travel app configuration - Cross-border payment, banking and digital currency security guide - Ground transportation security review - Travel security incident response plan Excludes: - 24/7 incident response line - Custom travel kit hardware - Support beyond the engagement - Physical protection or security drivers #### Elite Executive Travel Security: $95K Full-scope travel security program with dedicated support, custom secure travel kit, and 24/7 global incident response Limits: subjects 6, devices 20 Excludes: - Physical close protection, security drivers or armed personnel - Medical evacuation or insurance - Cost of travel kit hardware beyond the initial kits - Travel booking ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=executive-travel-privacy-security-assessment ## Hospitality Sector Security Program > From $35K · Compliance & GRC · https://cisomarketplace.services/services/hospitality-sector-security Specialized security assessment for hotels, resorts, restaurants, and hospitality organizations, addressing the unique challenges of securing guest data, payment systems, property management systems, and physical-digital security convergence. Our assessment helps hospitality businesses protect guest privacy, ensure PCI compliance, and maintain operational continuity while delivering exceptional guest experiences. ### In scope - Property management system security - Payment card environment review - Guest data protection assessment - Physical security integration - Smart room/IoT security - Reservation system security - Loyalty program data protection - Third-party vendor assessment - Staff security awareness evaluation - Mobile app and kiosk security ### Deliverables - Hospitality security assessment report - PCI DSS compliance gap analysis - Guest data protection framework - Property management system security recommendations - Physical-digital security integration plan - Staff security procedures - Vendor security management framework - Implementation roadmap ### Tiers #### Essential Hospitality Security Assessment: $35K One property (hotel, resort, restaurant site): property management system, payment card environment and guest data handling reviewed by interview, configuration review and one site walkthrough. Up to 5 vendors reviewed. PCI DSS gap analysis and roadmap. Limits: locations 1, vendors 5 Includes: - PMS and reservation system security review - Payment card environment review with PCI DSS gap analysis - Guest data protection assessment - One on-site walkthrough - Assessment report and implementation roadmap Excludes: - Smart room/IoT and physical-digital integration review - Loyalty program and mobile app/kiosk review - Penetration testing - Formal PCI validation (SAQ sign-off, ROC) #### Comprehensive Hospitality Security Program: $65K Up to 3 properties and up to 15 vendors. Adds smart room/IoT, physical-digital integration (locks, cameras, access control), loyalty program data, staff awareness evaluation and 1 guest mobile app plus kiosks. Delivers staff procedures and a vendor management framework. Limits: locations 3, vendors 15, mobile apps 1 Includes: - Everything in the single-property tier, across up to 3 properties - Smart room/IoT security review - Physical-digital security integration plan - Loyalty program data protection review - Staff security procedures and vendor security management framework Excludes: - VIP guest protection and privacy procedures - Brand protection strategy - Penetration testing of apps, kiosks and networks - Remediation work #### Luxury Hospitality Security Framework: $95K Up to 10 properties under one brand, up to 25 vendors and up to 2 guest apps. All standard-tier work plus VIP guest protection procedures, privacy controls for high-profile guests (records access, staff handling, discretion) and a brand protection plan. Limits: locations 10, vendors 25, mobile apps 2 Includes: - All standard-tier assessment areas across up to 10 properties - VIP guest protection and privacy procedures - Guest-record access and privacy control design - Brand protection plan (impersonation, fraud, leak scenarios) - Executive briefing for brand and property leadership Excludes: - Executive protection or physical guarding services - Penetration testing - Ongoing monitoring or managed services - Portfolios above 10 properties (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=hospitality-sector-security ## Retail & E-commerce Security Assessment > From $38K · Compliance & GRC · https://cisomarketplace.services/services/retail-ecommerce-security Comprehensive security assessment designed specifically for retail and e-commerce organizations, addressing the complex challenges of securing omnichannel retail environments, payment processing systems, customer data, and inventory management. Our specialized assessment helps retailers protect their brand, customer trust, and operational continuity across physical and digital retail channels. ### In scope - E-commerce platform security - Point-of-sale system assessment - Online payment security - Customer data protection review - Inventory management security - Supply chain validation - Omnichannel security integration - Mobile application security - In-store technology assessment - Loyalty program data protection ### Deliverables - Retail security assessment report - PCI DSS compliance gap analysis - Customer data protection framework - E-commerce security enhancement plan - Point-of-sale security recommendations - Omnichannel security strategy - Third-party integrations review - Implementation roadmap ### Tiers #### Essential Retail Security Assessment: $38K Online-led retailers: 1 e-commerce platform and up to 5 store locations. E-commerce platform configuration, online payment flow, customer data protection and third-party integrations reviewed, POS reviewed at 1 representative store, with a PCI DSS gap analysis. Limits: web apps 1, locations 5 Includes: - E-commerce platform security review - Online payment security and PCI DSS gap analysis - Customer data protection review - POS review at 1 representative store - Third-party integrations review and roadmap Excludes: - Mobile app security review - Omnichannel, inventory and supply chain assessment - Fraud prevention review - Penetration testing of the storefront #### Comprehensive Retail Security Program: $70K Up to 3 e-commerce storefronts, up to 25 store locations and 1 customer mobile app. Adds omnichannel integration, inventory management, loyalty program data, in-store technology (POS sampled at 3 stores) and a fraud prevention control review. Limits: web apps 3, locations 25, mobile apps 1 Includes: - Everything in the online-led tier - Omnichannel security strategy - Mobile app security design review - In-store technology and POS review at 3 sampled stores - Fraud prevention and loyalty program control review Excludes: - International operations and multi-country data handling - Supply chain partner validation - Penetration testing of apps or stores - Remediation work #### Enterprise Retail Security Framework: $110K Up to 5 storefronts, up to 100 store locations and up to 3 mobile apps, including international operations. Adds supply chain validation, multi-country customer data handling and POS review at 5 sampled stores per region. Limits: web apps 5, locations 100, mobile apps 3 Includes: - Everything in the standard tier - Supply chain and logistics partner validation - Multi-country customer data handling review - Regional store sampling for in-store technology - Executive briefing and phased implementation roadmap Excludes: - Penetration testing and red teaming - Formal PCI validation - Managed fraud monitoring - Chains above 100 locations (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=retail-ecommerce-security ## Security Architecture Review > From $40K · Compliance & GRC · https://cisomarketplace.services/services/security-architecture-review Comprehensive analysis of your organization's security architecture design, evaluating defense-in-depth strategies, security control effectiveness, and alignment with business objectives and threat models. ### In scope - Network segmentation analysis - Access control frameworks - Data flow assessment - Security boundary evaluation - Defense-in-depth review - Zero Trust framework compatibility - Identity and authentication architecture review ### Deliverables - Detailed architecture assessment report - Security control gap analysis - Reference architecture recommendations - Risk mitigation roadmap - Prioritized security enhancement plan - Threat modeling documentation ### Tiers #### Core Architecture Assessment: $40K One environment: up to 500 employees, up to 2 data centers/sites and up to 3 cloud accounts. Reviews segmentation, access control, identity architecture, data flows and security boundaries from diagrams, configs and workshops. One high-level threat model. Limits: employees 500, locations 2, cloud accounts 3 Includes: - Network segmentation and security boundary analysis - Identity and authentication architecture review - Data flow assessment for critical data - One high-level threat model - Control gap analysis and prioritized enhancement plan Excludes: - Zero Trust implementation strategy - Per-system threat models - Reference architecture design - Penetration testing or configuration scanning #### Advanced Architecture Program: $75K Up to 2,500 employees, up to 5 sites and up to 10 cloud accounts. Adds documented threat models for up to 5 critical systems, a defense-in-depth control mapping and a phased Zero Trust implementation strategy. Limits: employees 2500, locations 5, cloud accounts 10 Includes: - Everything in the core assessment - Threat models for up to 5 critical systems - Zero Trust compatibility assessment and phased strategy - Defense-in-depth control mapping - Risk mitigation roadmap Excludes: - Target-state reference architecture - Security governance framework - Implementation or engineering work - Penetration testing #### Enterprise Security Architecture Transformation: $125K No fixed headcount cap - scoped. Up to 10 sites and up to 25 cloud accounts. Adds a target-state reference architecture, a multi-year modernization roadmap, threat models for up to 10 critical systems and an architecture governance framework (review board, standards, exceptions). Limits: locations 10, cloud accounts 25 Includes: - Everything in the advanced tier - Target-state reference architecture - Multi-year modernization roadmap with sequencing - Architecture governance framework - Threat models for up to 10 critical systems Excludes: - Building or deploying the target architecture - Product selection RFPs - Penetration testing - Ongoing architecture review board participation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=security-architecture-review ## CMMC 2.0 Level 1 & 2 Readiness (NIST SP 800-171) > From $9.5K · Compliance & GRC · https://cisomarketplace.services/services/cmmc-level-1-2-readiness For contractors handling FCI or CUI. We scope the CUI boundary, assess all NIST SP 800-171 practices, calculate and document your SPRS score, write the System Security Plan and POA&M, and prepare you for self-assessment or a C3PAO assessment. CMMC phase-in dates have moved more than once; NIST SP 800-171 and DFARS 252.204-7012 obligations apply regardless, so we plan against the requirement rather than a single deadline. ### In scope - CUI / FCI scoping and enclave boundary definition - NIST SP 800-171 practice-by-practice gap assessment - SPRS score calculation and documentation - System Security Plan and POA&M authoring - Self-assessment or C3PAO assessment preparation ### Deliverables - Gap assessment report with SPRS score - System Security Plan (SSP) - Plan of Action & Milestones (POA&M) - Assessment-readiness checklist ### Tiers #### Essential CMMC Level 1 Readiness: $9.5K FCI only: 17 practices, self-assessment package and annual affirmation support Limits: users 100, locations 2 Excludes: - CUI — Level 1 covers FCI only - SSP and POA&M authoring #### Advanced CMMC Level 2 Readiness: $22K CUI, single enclave up to 250 users: full 110-practice gap assessment, SPRS score, SSP and POA&M Limits: users 250, locations 3 #### Enterprise CMMC Level 2 Program: $45K Multiple enclaves or 250+ users: adds enclave design, remediation oversight and a mock C3PAO assessment Limits: users 2500, locations 15 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cmmc-level-1-2-readiness ## California Privacy Law Assessment (CCPA/CPRA) > From $35K · Compliance & GRC · https://cisomarketplace.services/services/california-privacy-law-assessment Comprehensive evaluation of your organization's compliance with California's privacy regulations, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Our assessment examines data handling practices, consumer rights processes, and disclosure requirements to identify compliance gaps and provide a detailed remediation roadmap. ### In scope - CCPA/CPRA applicability assessment - Personal information inventory - Consumer rights implementation review - Privacy notice evaluation - Do Not Sell implementation assessment - Sensitive personal information handling - Data retention practices - Service provider agreement review - Employee data handling assessment - Consumer request process evaluation - Privacy policy review - Risk assessment methodology ### Deliverables - California privacy compliance report - Applicability determination - Data inventory and mapping - Consumer rights procedure recommendations - Notice requirements implementation plan - Privacy disclosure updates - Vendor management framework - Data retention guidelines - Implementation roadmap and timeline - Compliance monitoring strategy ### Tiers #### Essential California Privacy Assessment: $35K CCPA/CPRA applicability determination and gap assessment for up to 250 employees: personal information inventory of up to 15 systems, privacy notice and policy review, consumer request process check, up to 10 service provider agreements. Limits: employees 250, vendors 10, frameworks 1 Includes: - Up to 250 employees, up to 15 systems inventoried - Applicability determination - Privacy notice and policy review - Review of up to 10 service provider agreements - Compliance report and roadmap Excludes: - Drafting updated notices and procedures - Consumer rights procedure build-out - Data retention schedule - Other privacy frameworks #### Comprehensive California Privacy Program: $60K CCPA/CPRA assessment for up to 1,000 employees: data mapping of up to 40 systems, up to 25 service provider agreements, plus drafted privacy disclosures, consumer rights procedures, retention guidelines and vendor management framework. Limits: employees 1000, vendors 25, frameworks 1 Includes: - Up to 1,000 employees, up to 40 systems mapped - Review of up to 25 service provider agreements - Drafted notices and privacy disclosures - Consumer rights request procedures - Data retention guidelines and vendor framework Excludes: - Hands-on implementation in your systems - Integration with other privacy frameworks - Post-project compliance maintenance #### Enterprise California Compliance Framework: $95K Advanced compliance program for complex organizations with custom implementation support, integration with other privacy frameworks, and ongoing compliance maintenance Limits: vendors 50, frameworks 3 Excludes: - Legal representation or regulator filings - Privacy tooling licences ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=california-privacy-law-assessment ## Compliance Automation Implementation & Managed Compliance > From $8.5K · Compliance & GRC · https://cisomarketplace.services/services/compliance-automation-implementation-managed-compliance Compliance automation platforms collect evidence; they do not write your policies, fix failing tests, scope your audit or answer your auditor. We implement the platform against your real environment, author policies that match how you work, close the failing controls, prepare you for the audit and stay on as the managed compliance team if you want one. Platform-neutral: we work with the tool you chose and never take a fee from an auditor. ### In scope - Platform configuration and integration of cloud, identity, HR and code systems - Policy authoring matched to your operations - Remediation of failing automated tests - Audit scoping, auditor selection support and evidence review - Optional ongoing managed compliance ### Deliverables - Configured compliance platform with passing controls - Approved policy set - Audit-readiness report - Managed compliance runbook (if retained) ### Tiers #### Essential Implementation: $8.5K One framework (SOC 2 or ISO 27001), one cloud environment: platform setup, policies and remediation plan Limits: frameworks 1, cloud accounts 1, employees 150 #### Advanced Implementation: $16.5K Two frameworks or a complex environment: adds hands-on remediation, vendor risk module and auditor liaison through fieldwork Limits: frameworks 2, cloud accounts 5, employees 750 #### Enterprise Implementation & Managed Compliance: $28K Multi-framework programs: adds custom control mapping, internal audit, and transition into a monthly managed compliance retainer Limits: frameworks 5, cloud accounts 25, employees 5000 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=compliance-automation-implementation-managed-compliance ## Data Privacy Compliance Program > From $50K · Compliance & GRC · https://cisomarketplace.services/services/data-privacy-compliance Comprehensive data privacy compliance program covering GDPR, CCPA, and other international privacy regulations with implementation support. ### In scope - GDPR compliance assessment - CCPA requirements review - International privacy law analysis - Data mapping exercise - Privacy control implementation - Consent management review ### Deliverables - Privacy impact assessment - Data protection framework - Implementation roadmap - Policy documentation - Training materials - Compliance monitoring plan ### Tiers #### Core Privacy Compliance Assessment: $50K GDPR and CCPA assessment for up to 250 employees and up to 15 data-processing vendors: data mapping of up to 25 systems, consent management review, privacy impact assessment, gap report and roadmap. Limits: frameworks 2, employees 250, vendors 15 Includes: - GDPR and CCPA gap assessment - Data mapping of up to 25 systems - Consent management review - 1 privacy impact assessment - Implementation roadmap Excludes: - Privacy laws beyond GDPR and CCPA - Policy and notice drafting - Control implementation support - Training delivery #### Advanced Privacy Compliance Program: $85K Comprehensive program including international privacy laws and detailed implementation support Limits: frameworks 5, employees 1000, vendors 50 Excludes: - Ongoing program management after hand-off - Compliance monitoring reviews - Legal opinions or DPO-as-a-service #### Enterprise Privacy Compliance Solution: $135K Full-scope privacy program with custom frameworks, automated monitoring, and complete program management Limits: frameworks 10, employees 5000, vendors 150 Excludes: - Licences for privacy management or consent software - Legal representation before regulators - Acting as the appointed DPO ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=data-privacy-compliance ## Data Privacy Impact Assessment > From $20K · Compliance & GRC · https://cisomarketplace.services/services/data-privacy-impact-assessment Systematic evaluation of data handling practices to ensure compliance with privacy regulations and identify potential privacy risks. ### In scope - Data flow mapping - Privacy risk assessment - Consent mechanism review - Data protection controls evaluation - Third-party data sharing analysis ### Deliverables - Privacy impact assessment report - Risk mitigation recommendations - Privacy control improvements - Compliance gap analysis - Implementation roadmap ### Tiers #### Small Organization DPIA: $20K DPIA for an organization of up to 100 employees: up to 5 processing activities and up to 5 third-party data recipients. Data flow maps, privacy risk assessment, consent mechanism review, report with mitigations and roadmap. Limits: employees 100, vendors 5 Includes: - Data flow mapping for up to 5 processing activities - Privacy risk assessment with rated risks - Consent mechanism review - Third-party sharing analysis for up to 5 recipients - DPIA report, gap analysis and roadmap Excludes: - More than 5 processing activities - Implementing the recommended controls - Policy or notice drafting - Regulator consultation #### Medium Organization DPIA: $35K DPIA for up to 500 employees: up to 15 processing activities and up to 15 third-party data recipients. Same method as Small with workshops per business unit and a data protection controls evaluation per system. Limits: employees 500, vendors 15 Includes: - Data flow mapping for up to 15 processing activities - Workshops with each business unit in scope - Data protection controls evaluation per system - Third-party sharing analysis for up to 15 recipients - DPIA report, gap analysis and roadmap Excludes: - More than 15 processing activities - Implementing the recommended controls - Policy or notice drafting #### Large Organization DPIA: $55K DPIA for up to 2,500 employees: up to 40 processing activities and up to 40 third-party data recipients, including cross-border transfers. Larger estates are scoped separately. Limits: employees 2500, vendors 40 Includes: - Data flow mapping for up to 40 processing activities - Cross-border transfer analysis - Data protection controls evaluation per system - Third-party sharing analysis for up to 40 recipients - Consolidated DPIA report with per-activity annexes - Roadmap with owners Excludes: - Implementing the recommended controls - Full privacy program build (see Data Privacy Compliance Program) - Legal opinions ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=data-privacy-impact-assessment ## Employee Security Awareness Assessment > From $15K · Compliance & GRC · https://cisomarketplace.services/services/employee-security-awareness-assessment Comprehensive assessment of employee security awareness levels to identify training needs and security culture gaps. ### In scope - Security awareness surveys - Phishing simulation tests - Knowledge assessments - Behavior analysis - Culture evaluation ### Deliverables - Awareness assessment report - Training needs analysis - Culture improvement recommendations - Awareness program roadmap - Metrics and benchmarks ### Tiers #### Small Organization Assessment: $15K Awareness assessment for up to 100 employees at 1 location: 1 survey, 1 phishing simulation campaign, 1 knowledge assessment and up to 10 interviews. Report with training needs, benchmarks and a program roadmap. Limits: employees 100, locations 1, scenarios 1, participants 10 Includes: - Security awareness survey for all staff in scope - 1 phishing simulation campaign - Knowledge assessment - Up to 10 staff interviews - Assessment report, training needs analysis and roadmap Excludes: - Repeat phishing campaigns - Per-department breakdown - Training content or delivery - Ongoing phishing platform subscription #### Medium Organization Assessment: $25K Awareness assessment for up to 500 employees and up to 3 locations: survey, 2 phishing simulation campaigns of different difficulty, knowledge assessment and up to 25 interviews. Results broken down by department. Limits: employees 500, locations 3, scenarios 2, participants 25 Includes: - Survey and knowledge assessment for all staff in scope - 2 phishing simulation campaigns - Up to 25 staff interviews - Per-department results and benchmarks - Culture evaluation - Training needs analysis and roadmap Excludes: - Role-targeted campaigns (executives, finance, IT) - Training content or delivery - Ongoing phishing platform subscription #### Large Organization Assessment: $40K For more than 500 employees; no fixed cap on headcount and locations - scoped at kickoff. Survey, 3 phishing campaigns including one targeted at high-risk roles, knowledge assessment and up to 50 interviews. Results by department, site and role. Limits: scenarios 3, participants 50 Includes: - Survey and knowledge assessment for all staff in scope - 3 phishing campaigns, 1 targeted at executives, finance and IT - Up to 50 staff interviews and focus groups - Results by department, site and role - Culture evaluation with benchmarks - Multi-year awareness program roadmap Excludes: - Training content development - Training delivery - Ongoing phishing platform subscription - Vishing or physical social engineering ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=employee-security-awareness-assessment ## FTC Safeguards Rule & IRS WISP Compliance Package > From $1.5K / yr · Compliance & GRC · https://cisomarketplace.services/services/ftc-safeguards-irs-wisp-compliance-package The FTC Safeguards Rule and IRS Publication 4557 require tax preparers, auto dealers, mortgage brokers and other small financial institutions to keep a Written Information Security Program, name a qualified individual, assess risk and train staff. This annual package delivers a WISP that reflects your firm, the risk assessment behind it, staff training and the yearly review that keeps it valid — with a practitioner who can act as your qualified individual. ### In scope - Written Information Security Program (WISP) tailored to the firm - Risk assessment required by the Safeguards Rule - Qualified Individual designation support - Annual staff training - Yearly review, update and board or owner report ### Deliverables - WISP document - Risk assessment report - Training completion records - Annual compliance report ### Tiers #### Essential WISP Package: $1.5K / year Per year, firms up to 10 staff: WISP, risk assessment and annual training Limits: employees 10, locations 1 #### Advanced Safeguards Package: $3.5K / year Per year, up to 50 staff: adds vendor oversight, incident response plan and semi-annual review Limits: employees 50, locations 3 #### Enterprise Safeguards Program: $7.5K / year Per year, multi-office firms: adds outsourced Qualified Individual, penetration test coordination and annual report to the board Limits: employees 250, locations 10 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ftc-safeguards-irs-wisp-compliance-package ## FedRAMP Compliance Program > From $85K · Compliance & GRC · https://cisomarketplace.services/services/fedramp-compliance Specialized compliance program for cloud service providers seeking FedRAMP authorization, including readiness assessment, documentation preparation, and implementation support. ### In scope - FedRAMP control assessment - Security documentation review - Cloud architecture evaluation - Third-party integration analysis - Continuous monitoring planning ### Deliverables - FedRAMP readiness report - SSP development support - Security controls implementation guide - Continuous monitoring program - Authorization package preparation ### Tiers #### Core FedRAMP Readiness Assessment: $85K Readiness assessment for 1 cloud service offering at Low / Moderate baseline: up to 1 cloud account and up to 5 external services in the boundary. Control gap assessment, architecture and boundary review, review of existing documentation, readiness report. Limits: cloud accounts 1, vendors 5 Includes: - FedRAMP control gap assessment at the chosen baseline - Authorization boundary and cloud architecture evaluation - Review of existing security documentation - Third-party integration analysis for up to 5 services - FedRAMP readiness report with remediation plan Excludes: - Writing the SSP and attachments - Control implementation support - Continuous monitoring program - The independent 3PAO assessment #### Advanced FedRAMP Implementation Program: $150K Comprehensive program including complete documentation development and implementation support Limits: cloud accounts 3, vendors 15 Excludes: - Assembling and submitting the full authorization package - Operating continuous monitoring - High baseline systems - The independent 3PAO assessment #### Enterprise FedRAMP Authorization Solution: $250K Full-scope FedRAMP program with complete authorization package preparation and continuous monitoring setup Limits: cloud accounts 5, vendors 30 Excludes: - The independent 3PAO assessment and its fees - Operating continuous monitoring after hand-off - Finding an agency sponsor - Cloud infrastructure or tooling costs ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=fedramp-compliance ## Financial Services Compliance Program > From $55K · Compliance & GRC · https://cisomarketplace.services/services/financial-services-compliance Comprehensive compliance assessment and implementation program for financial institutions, covering SEC, FINRA, SOX, PCI-DSS, and banking regulations. ### In scope - SEC compliance review - FINRA requirements assessment - SOX controls evaluation - PCI-DSS assessment - Banking regulation analysis - Risk assessment frameworks ### Deliverables - Detailed compliance gap analysis - Control implementation roadmap - Policy documentation suite - Regulatory reporting templates - Training program materials - Audit preparation guide ### Tiers #### Core Financial Compliance Assessment: $55K Gap assessment against up to 2 regulatory regimes for a firm of up to 250 employees and up to 3 offices. Control evaluation, risk assessment, gap analysis, control implementation roadmap and an audit preparation guide. Limits: frameworks 2, employees 250, locations 3 Includes: - Gap assessment against up to 2 regimes (e.g. SEC and FINRA) - Risk assessment using the firm's framework - Compliance gap analysis - Control implementation roadmap - Audit preparation guide Excludes: - Policy documentation suite - Regulatory reporting templates - Training materials - Hands-on control implementation #### Advanced Financial Compliance Program: $95K Comprehensive program including detailed control implementation, policy development, and audit preparation Limits: frameworks 4, employees 1000, locations 10 Excludes: - Custom unified control framework - Recurring compliance validation - PCI DSS QSA assessment or SOX external audit #### Enterprise Financial Compliance Solution: $150K Full-scope financial compliance program with custom frameworks, automated monitoring, and continuous compliance validation Limits: frameworks 6, employees 5000 Excludes: - PCI DSS QSA assessment or SOX external audit - Legal advice or representation before regulators - Licences for GRC or monitoring software ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=financial-services-compliance ## GDPR Compliance Assessment > From $38K · Compliance & GRC · https://cisomarketplace.services/services/gdpr-compliance-assessment Comprehensive evaluation of your organization's compliance with the European Union's General Data Protection Regulation (GDPR). Our assessment examines data processing activities, privacy controls, and governance frameworks to identify compliance gaps and provide a detailed remediation roadmap for organizations handling EU resident data. ### In scope - Data protection impact assessment review - Processing activities register evaluation - Lawful basis determination - Privacy notice evaluation - Data subject rights implementation assessment - Consent management review - Cross-border data transfer mechanisms - Data protection officer requirements - Privacy by design implementation - Data breach notification procedures - Processor agreement review - Record keeping assessment ### Deliverables - GDPR compliance gap analysis report - Data processing inventory - Data protection enhancement plan - Privacy governance framework - Data subject rights procedures - Cross-border transfer recommendations - Breach notification process improvements - DPO requirement determination - Documentation framework - Implementation roadmap and timeline ### Tiers #### Essential GDPR Assessment: $38K GDPR gap assessment for up to 250 employees, 1 country of establishment and up to 10 processor agreements: processing register, lawful basis, notices, data subject rights, consent, breach notification and DPO requirement. Gap report, data inventory and roadmap. Limits: employees 250, locations 1, vendors 10 Includes: - Processing activities register evaluation - Lawful basis, privacy notice and consent review - Data subject rights and breach notification procedure review - Review of up to 10 processor agreements - Gap analysis report, data processing inventory and roadmap - DPO requirement determination Excludes: - Writing procedures, notices or DPIAs - Cross-border transfer strategy - Governance framework design - Implementation support #### Comprehensive GDPR Compliance Program: $70K For up to 1,000 employees, up to 3 countries and up to 30 processor agreements. Adds written data subject rights and breach procedures, a documentation framework, a privacy governance framework, transfer mechanism recommendations and step-by-step implementation guidance. Limits: employees 1000, locations 3, vendors 30 Includes: - Everything in the Essential assessment - Data subject rights and breach notification procedures written - Documentation framework and record-keeping templates - Privacy governance framework - Cross-border transfer recommendations - Review of up to 30 processor agreements Excludes: - Hands-on implementation support - Compliance maintenance after delivery - Acting as the appointed DPO - Legal opinions #### Enterprise EU Privacy Framework: $120K Advanced compliance program for complex multinational organizations with custom implementation support, cross-border strategies, and ongoing compliance maintenance Limits: locations 10, vendors 75 Excludes: - Acting as the appointed DPO or EU representative - Legal representation before supervisory authorities - Licences for privacy management software ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=gdpr-compliance-assessment ## HIPAA Security Risk Analysis — Small Practice > From $3.5K · Compliance & GRC · https://cisomarketplace.services/services/hipaa-security-risk-analysis-small-practice The Security Rule requires every covered entity and business associate to perform a security risk analysis. This engagement delivers exactly that for small and mid-sized practices: an asset and ePHI inventory, threat and vulnerability analysis, risk ratings, and a remediation plan you can show OCR, a payer or a cyber insurer. It is the entry point below the full HIPAA/HITECH Compliance Assessment. ### In scope - ePHI asset and data-flow inventory - Administrative, physical and technical safeguard review - Threat, vulnerability and risk rating per asset - Remediation plan with owners and dates - Policy and BAA gap check ### Deliverables - HIPAA security risk analysis report - Risk register - Remediation plan - Attestation summary for insurers and partners ### Tiers #### Essential Practice SRA: $3.5K Single-location practice with up to 25 staff: ePHI inventory, safeguard review, risk register and remediation plan. Limits: employees 25, locations 1 Excludes: - Technical vulnerability scanning - Policy authoring - More than one location #### Advanced Practice SRA: $6.5K Up to 100 staff AND up to 3 locations (exceeding either moves to the next tier): adds policy gap review, BAA review and a staff training session. Limits: employees 100, locations 3 Excludes: - Technical vulnerability scanning - EHR vendor review #### Enterprise Practice SRA: $12.5K Multi-location groups and business associates up to 500 staff and 10 locations: adds a technical vulnerability scan, EHR and vendor review and a 90-day remediation check. Larger organizations need the HIPAA/HITECH Compliance Assessment. Limits: employees 500, locations 10 Excludes: - Organizations above 500 staff — use the HIPAA/HITECH Compliance Assessment - Penetration testing ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=hipaa-security-risk-analysis-small-practice ## HIPAA/HITECH Compliance Assessment > From $36K · Compliance & GRC · https://cisomarketplace.services/services/hipaa-hitech-compliance-assessment Comprehensive evaluation of your organization's compliance with HIPAA and HITECH regulations, focusing on the protection of electronic protected health information (ePHI). Our assessment examines technical, administrative, and physical safeguards, providing a detailed gap analysis and remediation plan to achieve and maintain compliance while reducing the risk of breaches and penalties. ### In scope - HIPAA Security Rule assessment - HIPAA Privacy Rule evaluation - Breach notification process review - Business associate management assessment - Technical safeguards evaluation - Administrative safeguards review - Physical safeguards assessment - ePHI data flow analysis - Access control implementation review - Audit logging and monitoring evaluation - Risk analysis methodology assessment - Incident response capability review - HITECH compliance review - Patient data handling assessment ### Deliverables - HIPAA/HITECH compliance report - Gap analysis and findings - Technical safeguards enhancement plan - Administrative controls framework - Physical security recommendations - ePHI protection strategy - Business associate agreement review - Risk assessment methodology improvements - Breach response procedure updates - Compliance documentation recommendations - Remediation roadmap and timeline ### Tiers #### Essential HIPAA/HITECH Assessment: $36K HIPAA / HITECH gap assessment for up to 100 employees, 1 site and up to 10 business associates: Security Rule, Privacy Rule and breach notification review, ePHI data flow analysis, safeguards evaluation by interview and document review. Report and roadmap. Limits: employees 100, locations 1, vendors 10 Includes: - Security Rule, Privacy Rule and breach notification review - Administrative, physical and technical safeguards evaluation - ePHI data flow analysis - Business associate agreement review for up to 10 BAs - Compliance report, gap analysis and remediation roadmap Excludes: - Technical configuration review of access control and logging - Policy and documentation writing - Training - Implementation support #### Comprehensive HIPAA Compliance Program: $65K For up to 500 employees, up to 5 sites and up to 30 business associates. Adds configuration-level review of access control, audit logging and monitoring, an administrative controls framework, updated breach response procedures and compliance documentation. Limits: employees 500, locations 5, vendors 30 Includes: - Everything in the Essential assessment - Configuration review of access control, audit logging and monitoring - Technical safeguards enhancement plan - Administrative controls framework - Breach response procedures updated - Compliance documentation written Excludes: - Workforce training delivery - Hands-on implementation support - Governance framework - Penetration testing #### Enterprise Healthcare Compliance Framework: $110K Advanced compliance program for complex healthcare environments with custom implementation support, training, and governance framework Limits: employees 2500, locations 15, vendors 75, sessions 4 Excludes: - Ongoing program management (see Healthcare Compliance Program) - Penetration testing or vulnerability scanning - Legal representation in OCR matters ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=hipaa-hitech-compliance-assessment ## HITRUST e1 / i1 Readiness > From $30K · Compliance & GRC · https://cisomarketplace.services/services/hitrust-e1-i1-readiness Healthcare customers and payers increasingly require HITRUST. We scope the assessment, perform the readiness assessment against the e1 (44 requirements) or i1 (182 requirements) set, remediate gaps, build the evidence library in MyCSF terms and prepare you for the external assessor. We are the readiness partner, not the assessor. ### In scope - Assessment scoping and MyCSF object definition - Readiness assessment against e1 or i1 requirements - Gap remediation planning and oversight - Policy, procedure and evidence library build - External assessor preparation ### Deliverables - Readiness assessment report - Remediation plan - Evidence library mapped to requirements - Assessor-ready submission package ### Tiers #### Essential HITRUST e1 Readiness: $30K e1 (44 requirements), single system: readiness assessment, remediation plan and evidence library Limits: employees 250 Excludes: - i1 requirements - More than one in-scope system #### Advanced HITRUST i1 Readiness: $65K i1 (182 requirements), single system: adds policy authoring, remediation oversight and assessor liaison Limits: employees 1500 #### Enterprise HITRUST Program: $120K i1 across multiple systems or a path to r2: adds program management, internal audit and year-two rapid recertification planning Limits: employees 10000 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=hitrust-e1-i1-readiness ## ISO 27001 Certification Readiness Assessment > From $13K · Compliance & GRC · https://cisomarketplace.services/services/iso-27001-certification-readiness Comprehensive evaluation of your organization's readiness for ISO 27001 certification, examining your information security management system (ISMS) against the standard's requirements. Our assessment provides a detailed gap analysis and implementation roadmap to help you achieve certification efficiently and effectively. ### In scope - ISO 27001 gap analysis - ISMS documentation review - Control implementation assessment - Risk assessment methodology review - Statement of Applicability evaluation - Management review process assessment - Internal audit program evaluation - Security policy framework review - ISMS metrics assessment - Certification preparation guidance ### Deliverables - ISO 27001 gap analysis report - ISMS implementation roadmap - Documentation enhancement recommendations - Control remediation plan - Certification preparation checklist - Risk assessment framework enhancements - ISMS process improvements - Implementation timeline - Resource requirements - Certification strategy ### Tiers #### Entry — market-sized scope: $13K Gap analysis only: one ISMS scope, up to 50 employees and 1 location. Clauses 4-10 and the Annex A controls scored from document review and up to 6 interviews, run remotely. Output is a gap report and a prioritized action list. Limits: employees 50, locations 1, months 1 Includes: - Clause 4-10 and Annex A gap scoring - Review of existing ISMS documents - Up to 6 stakeholder interviews (remote) - Gap report with prioritized action list Excludes: - Implementation roadmap with timeline and resourcing - Risk methodology and Statement of Applicability review - Internal audit program evaluation - Writing any documentation #### Essential ISO 27001 Gap Analysis: $38K Gap analysis plus certification plan: up to 250 employees and up to 2 locations. Adds risk assessment methodology, Statement of Applicability, management review and internal audit program evaluation, with an implementation roadmap, resource estimate and certification checklist. Limits: employees 250, locations 2, months 2 Includes: - Full clause and Annex A gap analysis - Risk methodology and Statement of Applicability evaluation - Management review and internal audit program assessment - ISMS implementation roadmap with timeline and resource requirements - Certification preparation checklist and auditor-selection guidance Excludes: - Authoring policies, procedures or the SoA - Hands-on control implementation - Running the internal audit - Support during the certification audit #### Comprehensive ISO 27001 Preparation: $65K Complete certification preparation with detailed documentation development and implementation assistance Limits: employees 1000, locations 5 Excludes: - Hands-on technical control implementation - Conducting the internal audit - Attendance at Stage 1 and Stage 2 audits - The certification body's audit fees #### Enterprise ISO 27001 Implementation Program: $110K Full-service ISO 27001 implementation support including documentation development, control implementation, and certification guidance Limits: employees 2500, locations 10 Excludes: - The certification audit itself and certification body fees - Security tooling or licence costs - Post-certification surveillance-year support - Scopes above 2,500 employees (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=iso-27001-certification-readiness ## NIST CSF 2.0 Maturity Assessment > From $15K · Compliance & GRC · https://cisomarketplace.services/services/nist-csf-2-assessment A named, fixed-scope assessment against all six NIST Cybersecurity Framework 2.0 functions — Govern, Identify, Protect, Detect, Respond, Recover. Evidence-based interviews and document review produce a current-state maturity score per category, a target profile matched to your risk appetite, and a funded roadmap. The scorecard is built to be shown to a board, an acquirer or a cyber insurer. ### In scope - Current-profile assessment across all six CSF 2.0 functions - Evidence review and stakeholder interviews - Target profile and risk-based prioritization - Roadmap with effort and cost bands - Board and insurer-ready scorecard ### Deliverables - NIST CSF 2.0 maturity scorecard - Gap analysis by category and subcategory - 12-24 month prioritized roadmap - Board presentation ### Tiers #### Essential CSF Assessment: $15K Single business unit, up to 250 employees: maturity scorecard, gap analysis and roadmap Limits: employees 250, locations 3 #### Advanced CSF Assessment: $28K Up to 1,500 employees or regulated environments: adds control evidence sampling, target profile workshop and board presentation Limits: employees 1500, locations 10 #### Enterprise CSF Program: $55K Multi-entity or 1,500+ employees: adds per-entity profiles, cross-mapping to ISO 27001 / SOC 2 / CIS and a quarterly re-scoring plan Limits: employees 10000, locations 50 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=nist-csf-2-assessment ## PCI DSS Compliance Assessment > From $34K · Compliance & GRC · https://cisomarketplace.services/services/pci-dss-compliance-assessment Comprehensive evaluation of your organization's compliance with Payment Card Industry Data Security Standard (PCI DSS) requirements. Our assessment examines cardholder data environments, security controls, and processes to identify compliance gaps and provide a detailed remediation roadmap to achieve and maintain PCI DSS compliance while protecting sensitive payment information. ### In scope - PCI DSS requirements gap analysis - Cardholder data environment assessment - Network segmentation validation - Secure configuration review - Vulnerability management evaluation - Access control implementation assessment - Security monitoring and testing review - Information security policy evaluation - Encryption implementation review - Service provider management assessment - Self-assessment questionnaire preparation - Attestation of compliance guidance ### Deliverables - PCI DSS compliance report - Cardholder data flow mapping - Gap analysis and findings - Scope reduction recommendations - Security control enhancement plan - Vulnerability remediation strategy - Compliance documentation framework - SAQ preparation assistance - Remediation roadmap and timeline - PCI compliance maintenance strategy - Implementation prioritization ### Tiers #### Essential PCI DSS Assessment: $34K SAQ-eligible merchants: one cardholder data environment with up to 3 card-accepting locations, 1 e-commerce channel and up to 5 service providers. Data flow map, gap analysis against all 12 requirements, SAQ type selection and a remediation roadmap. Limits: locations 3, web apps 1, vendors 5 Includes: - Cardholder data flow mapping - Gap analysis against the 12 PCI DSS requirements - SAQ type selection and completion guidance - Scope reduction recommendations - Remediation roadmap with priorities Excludes: - Network segmentation validation testing - Writing policies and compliance documentation - ASV scans and penetration testing - Report on Compliance preparation #### Comprehensive PCI Compliance Program: $60K Up to 10 card-accepting locations, up to 3 e-commerce channels and up to 15 service providers. Adds segmentation design validation, secure configuration sampling, drafted PCI policies and procedures, and remediation guidance sessions with control owners. Limits: locations 10, web apps 3, vendors 15 Includes: - Everything in the SAQ-merchant tier - Network segmentation validation (design and rule review) - Secure configuration review on sampled systems - Drafted PCI policy and procedure set - Service provider management assessment Excludes: - Report on Compliance preparation - Hands-on remediation of systems - ASV scans and penetration testing - Post-project compliance maintenance support #### Enterprise Payment Security Framework: $95K Advanced compliance program for complex payment environments with custom implementation support, SAQ/ROC preparation, and ongoing compliance maintenance Limits: locations 25, web apps 5, vendors 30 Excludes: - The formal QSA validation audit and signed ROC - ASV scans and penetration testing - Security tooling costs - Environments above 25 locations (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=pci-dss-compliance-assessment ## SMB Compliance Readiness > From $6.5K · Compliance & GRC · https://cisomarketplace.services/services/smb-compliance-readiness Targeted assessment for SMBs preparing for compliance certification. ### In scope - HIPAA/PCI DSS gap analysis - Control framework mapping - Policy and procedure review - Technical controls assessment - Data flow analysis - Vendor security review - Incident response planning ### Deliverables - Compliance gap report - Control implementation matrix - Policy templates - 12-month compliance roadmap - 2-hour workshop session ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-compliance-readiness ## SOC 2 Readiness Assessment > From $15.5K · Compliance & GRC · https://cisomarketplace.services/services/soc2-readiness-assessment Comprehensive evaluation of your organization's readiness for SOC 2 compliance, examining your controls against the relevant Trust Services Criteria. Our assessment provides a detailed gap analysis and implementation roadmap to help you prepare for a successful SOC 2 audit. ### In scope - SOC 2 Type selection guidance - Trust Services Criteria gap analysis - Control documentation review - Evidence collection process assessment - Vendor management control review - Change management process evaluation - Risk assessment framework review - Security monitoring evaluation - Control testing preparation - Auditor selection guidance ### Deliverables - SOC 2 readiness report - Control gap analysis - Documentation enhancement plan - Evidence collection framework - Remediation roadmap - Control implementation guidance - Vendor assessment recommendations - Pre-audit preparation checklist - Type 1 vs. Type 2 strategy - Implementation timeline ### Tiers #### Entry — market-sized scope: $15.5K Type I readiness check: Security criterion only, 1 in-scope product, up to 50 employees. Controls compared to the criteria through document review and up to 6 remote interviews. Output is a gap list and a pre-audit checklist. Limits: employees 50, web apps 1, months 1 Includes: - Security (Common Criteria) gap analysis - Review of existing policies and control documentation - Up to 6 remote interviews - Gap list with owners and priorities - Pre-audit preparation checklist Excludes: - Additional criteria (Availability, Confidentiality, Processing Integrity, Privacy) - Type II evidence collection design - Remediation roadmap with timeline - Writing policies #### Essential SOC 2 Gap Analysis: $35K Up to 250 employees, up to 2 in-scope products and up to 3 Trust Services Criteria. Gap analysis, Type 1 vs Type 2 strategy, vendor, change management and risk assessment reviews, remediation roadmap with timeline and auditor selection guidance. Limits: employees 250, web apps 2, months 2 Includes: - Gap analysis for up to 3 Trust Services Criteria - Type 1 vs Type 2 strategy - Vendor, change management and risk assessment process reviews - Remediation roadmap and implementation timeline - Auditor selection guidance Excludes: - Evidence collection framework build - Per-control implementation guidance - Writing policies and procedures - Support during the audit #### Comprehensive SOC 2 Preparation: $60K Complete readiness assessment with detailed control implementation guidance and evidence collection framework Limits: employees 500, web apps 3 Excludes: - Writing the policy and procedure set - Hands-on control implementation - Liaison with the auditor during fieldwork - The CPA firm's audit fees #### Enterprise SOC 2 Implementation Program: $95K Full-service SOC 2 preparation including control implementation, documentation development, and audit support Limits: employees 1000, web apps 5 Excludes: - The SOC 2 audit and report (issued by a CPA firm) - Compliance automation platform licences - Penetration testing - Organizations above 1,000 employees (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=soc2-readiness-assessment ## State & Local Government Compliance Assessment > From $42K · Compliance & GRC · https://cisomarketplace.services/services/state-local-government-compliance Specialized compliance assessment for state and local government agencies addressing the unique regulatory requirements that apply to public sector entities. Our evaluation examines state-specific cybersecurity regulations, data protection laws, sunshine laws, records retention requirements, and security standards to help government entities achieve compliance and protect sensitive information. ### In scope - State-specific security regulation review - Data breach notification requirements - Public records management assessment - Critical infrastructure compliance review - State/local privacy law assessment - Data classification implementation - Criminal justice information systems compliance - Election systems security compliance - Emergency services data protection - Health data compliance - Financial data security standards - Educational records protection ### Deliverables - State & local compliance gap analysis - Jurisdiction-specific requirement mapping - Public records management framework - Data protection implementation plan - Data breach response procedures - Security control recommendations - Compliance documentation framework - Training recommendations - Implementation roadmap and timeline - Resource planning guidance ### Tiers #### Essential Government Compliance Assessment: $42K One agency, municipality or department of up to 250 employees, assessed against up to 3 regulatory domains chosen at kickoff (for example breach notification, public records, privacy). Requirement mapping, gap analysis, control recommendations and a roadmap. Limits: employees 250, frameworks 3 Includes: - Jurisdiction-specific requirement mapping for up to 3 domains - Compliance gap analysis - Data classification review - Security control recommendations - Implementation roadmap and timeline Excludes: - Writing compliance documentation and procedures - Training recommendations by role - Additional regulatory domains beyond 3 - Cross-agency coordination #### Comprehensive Government Compliance Program: $75K One entity of up to 1,000 employees, up to 6 regulatory domains. Adds a written compliance documentation framework, public records management framework, data breach response procedures, role-based training recommendations and resource planning. Limits: employees 1000, frameworks 6 Includes: - Everything in the single-agency tier - Compliance documentation framework written - Public records management framework - Data breach response procedures - Training recommendations and resource planning guidance Excludes: - Multi-agency or shared-services coordination - Hands-on implementation support - Ongoing compliance maintenance - Technical security testing #### Enterprise Government Compliance Framework: $125K Advanced compliance program for complex government entities with custom implementation support, cross-agency coordination, and ongoing compliance maintenance Limits: frameworks 12 Excludes: - Technical security testing and penetration testing - Formal authorization or audit by a regulator - Staff training delivery - Managed compliance services after handover ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=state-local-government-compliance ## Trifecta Security Assessment: Business Continuity, Disaster Recovery, and Incident Response > From $35K · Compliance & GRC · https://cisomarketplace.services/services/trifecta-security-assessment Comprehensive assessment covering three critical areas of organizational resilience - business continuity planning, disaster recovery strategies, and incident response capabilities. ### In scope - Business continuity planning review - Disaster recovery strategy assessment - Incident response capability evaluation - Recovery time objective analysis - Business impact analysis ### Deliverables - Comprehensive BC/DR/IR report - Gap analysis findings - Improvement roadmap - Policy and procedure templates - Testing and exercise plans - Training recommendations ### Tiers #### Small Organization Assessment: $35K Up to 100 employees and 1 site. Business continuity, disaster recovery and incident response reviewed together: BIA for up to 10 critical functions, RTO/RPO analysis, gap analysis, policy and procedure templates, exercise plan. Limits: employees 100, locations 1 Includes: - BC, DR and IR capability review - Business impact analysis for up to 10 critical functions - RTO/RPO analysis - Gap analysis and improvement roadmap - Policy templates plus testing and exercise plan Excludes: - Facilitating a tabletop exercise - Live recovery testing - Writing the full BC/DR/IR plans - Additional sites #### Medium Organization Assessment: $55K 101-500 employees and up to 3 sites. Same three-area assessment with a BIA for up to 25 critical functions, per-site recovery strategy review, training recommendations by role and an exercise plan covering all three disciplines. Limits: employees 500, locations 3 Includes: - BC, DR and IR capability review across up to 3 sites - Business impact analysis for up to 25 critical functions - RTO/RPO analysis per critical system - Gap analysis and improvement roadmap - Templates, exercise plans and training recommendations Excludes: - Facilitating tabletop exercises - Live recovery or failover testing - Writing the full BC/DR/IR plans - More than 3 sites #### Large Organization Assessment: $85K More than 500 employees, no fixed headcount cap - scoped at kickoff; up to 10 sites. BIA for up to 50 critical functions across business units, per-site DR review, IR capability review across teams, and an executive-level roadmap. Limits: locations 10 Includes: - BC, DR and IR capability review across business units - Business impact analysis for up to 50 critical functions - Per-site disaster recovery strategy review - Executive roadmap and briefing - Templates, exercise plans and training recommendations Excludes: - Facilitating tabletop exercises - Live recovery or failover testing - Writing the full BC/DR/IR plans - Crisis management retainer ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=trifecta-security-assessment ## Aviation & Aerospace Security Assessment > From $48K · Compliance & GRC · https://cisomarketplace.services/services/aviation-aerospace-security Specialized security assessment for aviation and aerospace organizations, addressing the critical security challenges of aircraft systems, airport infrastructure, flight operations, and aerospace manufacturing. Our assessment helps aviation organizations protect safety-critical systems, intellectual property, and operational technology while meeting strict regulatory requirements and ensuring passenger safety. ### In scope - Aircraft systems security assessment - Avionics security testing - Airport infrastructure security - Flight operations systems review - Air traffic management security - Maintenance system security - Supply chain security verification - Aviation regulatory compliance - Aerospace manufacturing security - Passenger data protection review ### Deliverables - Aviation security assessment report - Regulatory compliance gap analysis - Aircraft systems security recommendations - Operational technology protection strategy - Supply chain security framework - Aviation cybersecurity roadmap - Security architecture recommendations - Risk mitigation prioritization ### Tiers #### Essential Aviation Security Assessment: $48K Assessment of 1 site and up to 3 operational domains chosen from the 10 in scope (e.g. flight ops, maintenance, passenger data). Interview, document and configuration based; gap analysis against 1 regulatory framework. Limits: locations 1, frameworks 1 Includes: - 1 site, up to 3 operational domains - Interview, document and configuration review - Gap analysis against 1 regulatory framework - Assessment report and risk prioritization Excludes: - Hands-on avionics testing - Supply chain security verification - OT network testing - Additional sites #### Comprehensive Aviation Security Program: $85K Assessment of up to 3 sites across all 10 scope domains, with hands-on bench testing of up to 3 avionics or aircraft-connected systems, OT review, verification of up to 10 suppliers and gap analysis against up to 2 frameworks. Limits: locations 3, frameworks 2, devices 3, vendors 10 Includes: - Up to 3 sites, all 10 scope domains - Bench testing of up to 3 avionics/connected systems - Operational technology protection strategy - Supply chain verification of up to 10 suppliers - Aviation cybersecurity roadmap Excludes: - In-flight or live-aircraft testing - Global multi-region supply chain program - Remediation implementation #### Enterprise Aerospace Security Framework: $140K Program for aerospace groups with operations and manufacturing: up to 10 sites, up to 10 systems bench-tested, up to 50 suppliers and up to 3 frameworks. Adds manufacturing security and security architecture. Delivered in phases. Limits: locations 10, frameworks 3, devices 10, vendors 50 Includes: - Up to 10 sites across regions - Bench testing of up to 10 systems - Aerospace manufacturing and IP protection review - Supply chain framework covering up to 50 suppliers - Security architecture recommendations Excludes: - In-flight or live-aircraft testing - Remediation implementation - Regulatory filings or certification fees ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=aviation-aerospace-security ## Defense Industry Security Program > From $12.5K · Compliance & GRC · https://cisomarketplace.services/services/defense-industry-security Comprehensive security assessment and compliance program for defense contractors and military industrial complex, focusing on CMMC, NIST 800-171, and classified information handling. ### In scope - CMMC compliance assessment - Classified information handling review - Supply chain security evaluation - Physical security assessment - Insider threat program evaluation ### Deliverables - Defense security architecture - CMMC readiness report - Classified data handling procedures - Supply chain risk analysis - Security program documentation ### Tiers #### Entry — market-sized scope: $12.5K CMMC Level 2 / NIST SP 800-171 gap assessment of 1 enclave at 1 location, up to 50 employees: all 110 requirements scored from interviews and document review, with a gap report and a draft plan of action. No documentation writing. Limits: employees 50, locations 1 Includes: - Assessment of the 110 NIST SP 800-171 requirements - Scoping of the CUI boundary for 1 enclave - Scored gap report - Draft plan of action and milestones - Readout call Excludes: - System Security Plan or policy writing - Supply chain, physical security and insider threat reviews - Control implementation - Level 3 preparation #### Core Defense Security Assessment: $85K CMMC Level 1-2 readiness for up to 250 employees, up to 2 locations and up to 10 suppliers: gap assessment, System Security Plan and policy set, review of classified / controlled information handling, physical security assessment of each site and supply chain risk analysis. Limits: employees 250, locations 2, vendors 10 Includes: - CMMC Level 1-2 gap assessment and readiness report - System Security Plan and policy documentation - Classified / controlled information handling procedures - Physical security assessment of up to 2 sites - Supply chain risk analysis for up to 10 suppliers Excludes: - CMMC Level 3 preparation - Insider threat program evaluation - Hands-on control implementation - The certification assessment itself #### Advanced Defense Security Program: $150K CMMC Level 2 with third-party (C3PAO) assessment preparation: remediation oversight, evidence library and a mock assessment, plus supply-chain flow-down review. Limits: employees 1000, locations 5, vendors 25 Excludes: - Program management of the full implementation - Mock assessment before certification - The certification assessment itself #### Enterprise Defense Security Solution: $250K CMMC Level 3 preparation (NIST SP 800-172 enhanced requirements, DIBCAC-assessed) and multi-enclave program management. CMMC 2.0 has three levels; there is no Level 4 or 5. Limits: employees 5000, locations 15, vendors 75 Excludes: - The certification assessment itself (performed by an independent assessor) - Facility clearance sponsorship - Purchase of security tooling - Managed security operations ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=defense-industry-security ## Digital Transformation Security Program > From $45K · Compliance & GRC · https://cisomarketplace.services/services/digital-transformation-security Comprehensive security assessment and framework designed specifically for organizations undergoing digital transformation initiatives. Our specialized program addresses the unique security challenges of rapid technological change, legacy system integration, new business models, and accelerated development cycles - ensuring security becomes an enabler rather than a barrier to digital innovation. ### In scope - Digital initiative security architecture review - Legacy-to-digital transition security - DevSecOps transformation assessment - Cloud migration security evaluation - API ecosystem security - Digital identity modernization - Data governance for digital initiatives - Security culture transformation - Automated security controls assessment - Digital risk quantification ### Deliverables - Digital transformation security framework - Security architecture blueprint - Technology risk assessment report - Legacy integration security strategy - DevSecOps implementation roadmap - Cloud security enhancement plan - API security governance model - Security automation recommendations - Security talent development plan ### Tiers #### Essential Digital Security Assessment: $45K Security assessment of 1 transformation initiative for up to 500 employees: up to 2 cloud accounts, up to 10 APIs and up to 25 developers. Architecture review, cloud migration and legacy-transition risks, technology risk report and roadmap. Limits: employees 500, cloud accounts 2, apis 10, developers 25 Includes: - Security architecture review of 1 initiative - Cloud migration security evaluation for up to 2 accounts - Legacy-to-digital transition risk review - API security review (design-level) for up to 10 APIs - Technology risk assessment report and roadmap Excludes: - DevSecOps transformation assessment - Digital identity modernization - Risk quantification model - Penetration testing or code review #### Comprehensive Digital Transformation Security: $85K Up to 3 initiatives for up to 2,500 employees: up to 5 cloud accounts, up to 30 APIs and up to 100 developers. Adds a security architecture blueprint, DevSecOps assessment and roadmap, API governance model, identity modernization review and data governance. Limits: employees 2500, cloud accounts 5, apis 30, developers 100 Includes: - Everything in Essential, for up to 3 initiatives - Security architecture blueprint - DevSecOps assessment and implementation roadmap - API security governance model - Digital identity modernization review - Cloud security enhancement plan Excludes: - Organization-wide governance model - Digital risk quantification - Security talent development plan - Hands-on implementation #### Enterprise Digital Security Transformation: $135K Organization-wide transformation: up to 15 cloud accounts, up to 100 APIs and up to 300 developers; no fixed cap on employees and initiatives - scoped at kickoff. Adds a quantified risk model, governance structure, security automation plan and talent development plan. Limits: cloud accounts 15, apis 100, developers 300 Includes: - Everything in Comprehensive, organization-wide - Digital risk quantification model - Security governance structure for digital initiatives - Security automation recommendations and control design - Security culture and talent development plan - Executive and board readout Excludes: - Building or operating the automation - Penetration testing or code review - Staffing the transformation program - Tool licences ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=digital-transformation-security ## Election Systems Security Assessment > From $65K · Compliance & GRC · https://cisomarketplace.services/services/election-systems-security Specialized security assessment for election systems and voting infrastructure, including hardware testing, software evaluation, and process validation. ### In scope - Voting machine security testing - Ballot processing system review - Election management software assessment - Results transmission security - Audit log validation ### Deliverables - Election system security report - Process validation documentation - Technical security analysis - Audit framework recommendations - Security enhancement roadmap ### Tiers #### Core Election Systems Assessment: $65K Assessment for 1 jurisdiction: up to 2 equipment models (limit 'devices' = distinct models), configuration review of the election management software, ballot processing review, audit log validation and process walkthroughs. No hardware teardown. Limits: devices 2, locations 1 Includes: - Security testing of up to 2 voting equipment models (external interfaces and configuration) - Election management software configuration review - Ballot processing system review - Audit log validation - Process validation documentation and security report Excludes: - Hardware teardown and firmware extraction - Results transmission testing - Custom test tooling - Additional jurisdictions #### Advanced Election Security Program: $110K Up to 5 equipment models and up to 3 jurisdictions. Adds hardware-level testing (ports, storage media, firmware extraction), results transmission security testing, and process validation of every stage from ballot definition to canvass. Limits: devices 5, locations 3 Includes: - Hardware-level testing of up to 5 equipment models - Results transmission security testing - Election management software assessment - End-to-end process validation for up to 3 jurisdictions - Audit framework recommendations - Security enhancement roadmap Excludes: - Custom test harnesses and tooling - Whole-system validation across all components - Certification testing under any federal or state program #### Enterprise Election Security Solution: $175K Up to 10 equipment models and up to 10 jurisdictions, e.g. a statewide system. Adds custom test tooling built for the equipment in scope and validation of the whole system as deployed, including integrations between components. Limits: devices 10, locations 10 Includes: - Everything in the Advanced program, for up to 10 models - Custom test tooling for the equipment in scope - Whole-system validation including component integrations - Audit framework design - Executive briefing for election officials Excludes: - Certification testing under any federal or state program - Election-day monitoring or incident response - Remediation by the equipment vendor - Public disclosure handling ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=election-systems-security ## Healthcare Device Manufacturing Security Program > From $75K · Compliance & GRC · https://cisomarketplace.services/services/healthcare-device-manufacturing Comprehensive security assessment for medical device manufacturers, covering FDA compliance, manufacturing processes, and device security throughout the development lifecycle. ### In scope - Manufacturing process security - FDA compliance review - Device firmware security - Supply chain validation - Quality control systems assessment - Development lifecycle security ### Deliverables - Manufacturing security architecture - FDA compliance documentation - Security controls matrix - Supply chain security framework - Device security guidelines - Secure SDLC implementation ### Tiers #### Core Manufacturing Security Assessment: $75K Assessment for 1 device product line, 1 manufacturing site and up to 10 suppliers: manufacturing process security review, FDA cybersecurity requirements gap review, firmware security design review, quality system and development lifecycle review. Report and controls matrix. Limits: devices 1, locations 1, vendors 10 Includes: - Manufacturing process security review of 1 site - FDA cybersecurity requirements gap review - Firmware security design review for 1 product line - Supply chain review for up to 10 suppliers - Security controls matrix and device security guidelines Excludes: - Hands-on firmware or device penetration testing - Writing FDA submission documentation - Secure SDLC implementation - Additional product lines or sites #### Advanced Manufacturing Security Program: $125K Comprehensive program including detailed process validation and complete security implementation Limits: devices 3, locations 2, vendors 25 Excludes: - Hands-on device penetration testing - Ongoing compliance management - Custom tooling #### Enterprise Manufacturing Security Solution: $200K Full-scope manufacturing security with custom tools, continuous monitoring, and complete compliance management Limits: devices 6, locations 5, vendors 60 Excludes: - Hands-on device penetration testing (separate service) - FDA submission filing or regulatory representation - Tool licences and production hardware ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=healthcare-device-manufacturing ## Pharmaceutical Industry Security Assessment > From $45K · Compliance & GRC · https://cisomarketplace.services/services/pharmaceutical-industry-security Comprehensive security assessment designed specifically for pharmaceutical organizations, addressing the unique security challenges of drug development, clinical trials, manufacturing, and distribution. Our specialized assessment examines intellectual property protection, research data security, regulatory compliance, and supply chain integrity to secure your most valuable assets and ensure compliance with industry regulations. ### In scope - IP protection controls assessment - Clinical trial data security - Lab environment security evaluation - Manufacturing system security - FDA compliance assessment - Supply chain integrity verification - Research collaboration security - Drug safety systems review - Third-party research partner assessment - Patient data protection review ### Deliverables - Pharmaceutical security assessment report - Regulatory compliance gap analysis - IP protection framework - Research data security roadmap - Manufacturing security enhancement plan - Clinical trial security procedures - Supply chain security recommendations - Remediation priority matrix ### Tiers #### Essential Pharmaceutical Security Assessment: $45K Research and compliance focus: up to 250 employees, 1 site and up to 5 research partners. Covers IP protection controls, research and clinical trial data security, patient data protection and a regulatory gap analysis. Interviews and document review. Limits: employees 250, locations 1, vendors 5 Includes: - IP protection controls assessment - Research and clinical trial data security review - Patient data protection review - Regulatory compliance gap analysis - Assessment report with remediation priority matrix Excludes: - Manufacturing and lab system security evaluation - Supply chain integrity verification - Security architecture design - Penetration testing #### Comprehensive Pharmaceutical Security Program: $75K Up to 1,000 employees, up to 3 sites and up to 10 research partners. Adds lab environment and manufacturing system security, drug safety systems, research collaboration security and supply chain integrity, with clinical trial security procedures. Limits: employees 1000, locations 3, vendors 10 Includes: - Everything in the research and compliance tier - Lab and manufacturing system security evaluation - Supply chain integrity verification - Third-party research partner assessments (up to 10) - Clinical trial security procedures and manufacturing enhancement plan Excludes: - Multi-country operations assessment - Target security architecture design - Integrated compliance framework across regulations - Penetration testing of plant or lab networks #### Enterprise Pharmaceutical Security Framework: $120K Up to 2,500 employees, up to 10 sites across countries and up to 25 research partners. Adds a global operations assessment, a target security architecture for research, clinical and manufacturing environments, and one integrated compliance framework. Limits: employees 2500, locations 10, vendors 25 Includes: - Everything in the comprehensive tier - Global, multi-site operations assessment - Target security architecture document - Integrated compliance framework mapping all applicable requirements - Executive and board-level briefing Excludes: - Implementation of the architecture - Penetration testing and red teaming - Ongoing compliance monitoring - Organizations above 2,500 employees (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=pharmaceutical-industry-security ## Startup Security Readiness Assessment > From $18K · Compliance & GRC · https://cisomarketplace.services/services/startup-security-readiness-assessment Specialized security assessment designed for startups at every growth stage, from angel funding through Series A and beyond. Our tailored approach addresses the unique security challenges of rapidly evolving startups, balancing innovation speed with essential security controls. We help founders and startup teams build security foundations that enable growth, satisfy investor expectations, and prepare for enterprise customer requirements without slowing down product development. ### In scope - Security architecture foundations review - DevSecOps implementation assessment - Cloud infrastructure security evaluation - Authentication and identity strategy review - Data protection controls assessment - Security policy framework development - Customer security requirements readiness - Security questionnaire preparation - Compliance roadmap planning - Technical debt evaluation - Security resource planning - Investor due diligence preparation ### Deliverables - Startup security roadmap - Growth-stage security framework - Security control priorities by funding stage - DevSecOps implementation guidance - Cloud security configuration templates - Lightweight security policy templates - Enterprise customer security readiness report - Security questionnaire response templates - Compliance preparation checklist - Security hiring and resource planning ### Tiers #### Angel/Pre-Seed Security Foundations: $18K Pre-seed teams: up to 10 employees, up to 5 developers and 1 cloud account. Review of cloud configuration, authentication, data protection and code pipeline basics, with a prioritized 90-day security roadmap and a lightweight policy template set. Limits: employees 10, developers 5, cloud accounts 1 Includes: - Cloud infrastructure security review (1 account) - Authentication and identity strategy review - Data protection controls check - Lightweight security policy templates - Prioritized 90-day security roadmap Excludes: - Security questionnaire response templates - Enterprise customer readiness report - Compliance roadmap - Penetration testing #### Seed Stage Security Program: $30K Seed-stage: up to 25 employees, up to 15 developers and up to 2 cloud accounts. Adds DevSecOps pipeline assessment, customer security requirements readiness, security questionnaire response templates and cloud configuration templates. Limits: employees 25, developers 15, cloud accounts 2 Includes: - Everything in the pre-seed tier - DevSecOps implementation assessment and guidance - Security questionnaire response templates - Customer security readiness report - Cloud security configuration templates Excludes: - Compliance framework preparation (SOC 2, ISO 27001) - Security hiring and resource plan - Investor due diligence package - Penetration testing #### Series A Security Scaling Program: $45K Series A: up to 100 employees, up to 40 developers and up to 5 cloud accounts. Adds a compliance roadmap and preparation checklist for 1 framework, technical debt evaluation, investor due diligence preparation and a security hiring and resource plan. Limits: employees 100, developers 40, cloud accounts 5 Includes: - Everything in the seed tier - Compliance roadmap and preparation checklist for 1 framework - Technical debt evaluation - Investor due diligence preparation - Security hiring and resource plan Excludes: - The compliance readiness project or audit itself - Penetration testing - Ongoing vCISO support - Companies above 100 employees (use the general assessments) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=startup-security-readiness-assessment ## Compliance Assessment > From $10K · Compliance & GRC · https://cisomarketplace.services/services/compliance-assessment Evaluate and achieve compliance with major security frameworks ### In scope - Security Architecture Review - Controls Assessment - Risk Analysis - Compliance Mapping - Security Program Evaluation ### Deliverables - Detailed Assessment Report - Executive Summary - Recommendations Document - Implementation Roadmap - Follow-up Consultation ### Tiers #### Core Compliance Assessment: $10K Essential compliance assessment covering primary frameworks, basic controls evaluation, and fundamental gap analysis Limits: frameworks 1, employees 100, locations 1 Excludes: - Second or additional frameworks - Cross-framework control mapping - Policy writing or remediation work - Technical testing (scans, penetration tests) #### Advanced Compliance Program: $18K Comprehensive assessment including multiple frameworks, detailed controls mapping, and implementation planning Limits: frameworks 3, employees 500, locations 3 Excludes: - Custom or merged control framework - Progress reviews after delivery - Remediation and policy writing - Technical testing #### Enterprise Compliance Solution: $35K Full-scope compliance program with custom framework adaptation, continuous monitoring, and automated compliance tracking Limits: frameworks 5, employees 2500, locations 10 Excludes: - Certification or attestation audit itself - Hands-on remediation of controls - Licences for GRC or monitoring software - Technical testing ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=compliance-assessment ## Cyber Insurance Readiness Assessment > From $25K · Compliance & GRC · https://cisomarketplace.services/services/cyber-insurance-readiness Prepare your organization for cyber insurance applications and renewals by evaluating compliance with insurer requirements, identifying control gaps, and implementing documentation to support favorable coverage terms and rates. ### In scope - Insurance requirement analysis - Cyber control mapping - Security documentation review - Policy compliance assessment - Incident response capability - Risk management evaluation - Security governance review ### Deliverables - Insurance readiness report - Control gap analysis - Documentation enhancement plan - Insurance application support - Premium reduction recommendations - Underwriter response preparation ### Tiers #### Basic Insurance Readiness: $25K Readiness assessment for up to 250 employees at 1 location against 1 carrier questionnaire (new application / renewal): control mapping to insurer requirements, evidence check of existing documents, incident response capability review, readiness report and gap analysis. Limits: employees 250, locations 1 Includes: - Insurer requirement analysis for 1 application - Control mapping and validation against that questionnaire - Review of existing security documentation - Incident response capability review - Insurance readiness report and control gap analysis Excludes: - Writing missing policies or evidence - Remediation guidance beyond the gap list - Underwriter calls or responses - More than 1 carrier application #### Standard Insurance Preparation Program: $45K For up to 1,000 employees and up to 3 locations, covering up to 3 carrier applications. Adds a documentation enhancement plan with drafted policies and evidence, completed application answers, and a remediation plan for gaps that affect insurability. Limits: employees 1000, locations 3 Includes: - Everything in Basic, for up to 3 carrier applications - Drafted policies and evidence for missing documentation - Completed application / questionnaire answers - Gap remediation plan with priorities and owners - Governance and risk management review Excludes: - Attending underwriter or broker calls - Coverage strategy and premium reduction plan - Hands-on technical remediation #### Premium Coverage Optimization: $75K For organizations beyond the Standard limits on employees and locations; no fixed cap - scoped at kickoff. Adds a coverage strategy, underwriter response preparation with attendance on underwriter and broker calls, and a premium reduction plan tied to specific controls. Includes: - Everything in Standard - Coverage strategy across carriers and limits - Underwriter response preparation and call attendance - Broker coordination through quote stage - Premium reduction plan tied to specific controls Excludes: - Acting as the insurance broker or binding coverage - Legal review of policy wording - Hands-on technical remediation - Any guarantee of coverage terms or premium ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=cyber-insurance-readiness ## Remote Work Security Assessment > From $30K · Compliance & GRC · https://cisomarketplace.services/services/remote-work-security-assessment Comprehensive evaluation of your organization's remote work security posture in today's hybrid workplace environment. Our assessment examines remote access infrastructure, endpoint security, home network risks, secure communications, data protection measures, and policy effectiveness for distributed workforces, providing a roadmap to secure your modern workplace. ### In scope - Remote access security evaluation - Home network risk assessment - Endpoint protection review - Mobile device management analysis - Data loss prevention for remote workers - Secure collaboration tool assessment - Remote work policy review - Authentication and identity controls - Cloud access security - Remote support security ### Deliverables - Remote work security report - Risk assessment findings - Remote access architecture recommendations - Endpoint security enhancement plan - Secure collaboration framework - Policy and procedure updates - Home office security guidelines - Remote security awareness materials - Implementation roadmap ### Tiers #### Essential Remote Work Security Review: $30K Up to 250 remote users. Review of remote access (VPN/ZTNA), authentication and identity controls, endpoint protection and MDM settings, cloud access and the remote work policy, by configuration review and interviews. Findings report and roadmap. Limits: users 250 Includes: - Remote access and authentication configuration review - Endpoint protection and MDM review - Cloud access security review - Remote work policy review - Risk findings report and implementation roadmap Excludes: - Writing new policies and procedures - Collaboration tool and DLP deep-dive - Security awareness materials - Physical assessment of shared offices #### Shared Office & Coworking Space Security Assessment: $45K For teams in shared offices: up to 250 users across up to 3 coworking sites. On-site review at each site of physical access, shared network isolation, visual and acoustic privacy, printing and device handling, plus the remote access and policy review from the base tier. Limits: users 250, locations 3 Includes: - On-site assessment of up to 3 shared office sites - Shared network isolation and Wi-Fi review - Visual privacy, clean desk and device handling review - Remote access, authentication and policy review - Shared-workspace security guidelines for staff Excludes: - Endpoint strategy and collaboration framework development - Full policy rewrite - Testing of the coworking operator's own infrastructure - More than 3 sites #### Comprehensive Remote Workforce Security Program: $55K Up to 1,000 remote users. Adds DLP for remote workers, collaboration tool assessment, remote support security and home network risk, and we write the deliverables: endpoint strategy, collaboration framework, updated policies, home office guidelines and awareness materials. Limits: users 1000 Includes: - Everything in the review tier - Endpoint protection strategy and remote access architecture recommendations - Secure collaboration framework - Written policy and procedure updates - Home office security guidelines and awareness materials Excludes: - On-site assessment of coworking spaces - Deployment of tools or configuration changes - Penetration testing of remote access - Workforces above 1,000 remote users (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=remote-work-security-assessment ## Vendor & Third-Party Security Risk Assessment > From $38K · Compliance & GRC · https://cisomarketplace.services/services/vendor-third-party-risk-assessment Comprehensive evaluation of your organization's third-party risk management program and vendor security assessment practices. Our assessment examines your vendor security evaluation processes, contractual security requirements, ongoing monitoring capabilities, and supply chain security controls to identify vulnerabilities in your extended enterprise and provide a roadmap for enhanced third-party risk management. ### In scope - Vendor security assessment methodology review - Third-party risk tiering evaluation - Supply chain attack surface analysis - Vendor security questionnaire assessment - Third-party contract security requirements - Vendor access management review - Vendor incident response coordination - Continuous monitoring capabilities - Fourth-party risk visibility - Cloud service provider security assessment - Strategic vendor security oversight - Third-party risk governance ### Deliverables - Third-party risk program assessment report - Vendor security framework recommendations - Risk-based assessment methodology - Vendor tiering model - Contract security requirements template - Continuous monitoring strategy - Supply chain risk mitigation plan - Critical vendor management playbook - Vendor incident response procedures - Implementation roadmap and timeline ### Tiers #### Essential Third-Party Risk Assessment: $38K Program review for a vendor inventory of up to 100. Assesses methodology, risk tiering, questionnaires, contract security terms and vendor access management, sampling up to 5 completed vendor assessments. Program assessment report and roadmap. Limits: vendors 100 Includes: - TPRM methodology and governance review - Risk tiering evaluation - Questionnaire and contract security requirements review - Sample review of up to 5 completed vendor assessments - Program assessment report and roadmap Excludes: - Building a new assessment methodology or tiering model - Continuous monitoring strategy - Assessing individual vendors on the client's behalf - Fourth-party and supply chain analysis #### Comprehensive Vendor Security Program: $70K Vendor inventory of up to 500, sampling up to 15 assessments. We build the risk-based assessment methodology, tiering model, contract security requirements template, continuous monitoring strategy, critical vendor playbook and vendor incident response procedures. Limits: vendors 500 Includes: - Everything in the program review tier - Risk-based assessment methodology written - Vendor tiering model - Contract security requirements template - Continuous monitoring strategy and vendor incident procedures Excludes: - Custom assessment tooling - Supply chain risk quantification - Rollout support and training - Performing vendor assessments or onsite vendor audits #### Enterprise Supply Chain Security Framework: $110K Vendor inventory of up to 2,500, sampling up to 30 assessments. Adds supply chain attack surface and fourth-party analysis, risk quantification for the top 25 critical vendors, custom questionnaires and scoring workbooks, and rollout support with the vendor management team. Limits: vendors 2500 Includes: - Everything in the advanced tier - Supply chain and fourth-party risk analysis - Risk quantification for up to 25 critical vendors - Custom questionnaires and scoring workbooks - Implementation support and team training Excludes: - Onsite audits of individual vendors - Operating the vendor assessment queue as a managed service - TPRM platform licences - Inventories above 2,500 vendors (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=vendor-third-party-risk-assessment --- # Practice: Specialized & Industry Sector-specific assessments and OSINT, from energy and maritime to executive protection and M&A due diligence. ## Blockchain Contact Analysis Service > From $4,200 · Specialized & Industry · https://cisomarketplace.services/services/blockchain-contact-analysis-service In-depth analysis of blockchain contacts and transactions to trace asset movement, identify patterns, and assess security risks in cryptocurrency operations. ### In scope - Transaction history - Contact relationships - Risk scoring - Asset flow patterns - Cross-chain analysis - Smart contract interactions - Exchange relationships ### Deliverables - Contact risk report - Transaction flow analysis - Network visualization map - Risk mitigation recommendations - Security enhancement plan - Monitoring strategy - Compliance recommendations ### Tiers #### Core Contact Analysis: $4,200 Up to 5 wallet addresses on a single chain: transaction history, direct counterparties, exchange relationships and a risk score per contact. Output is a contact risk report and flow diagram. Limits: wallets 5 Includes: - Transaction history for up to 5 addresses on 1 chain - Direct counterparty and exchange identification - Risk score per contact - Contact risk report with flow diagram Excludes: - Cross-chain and bridge tracing - Smart contract interaction analysis - Sworn declarations or expert witness work - Ongoing monitoring #### Advanced Contact Analysis: $8.5K Up to 20 wallet addresses across up to 3 chains: everything in the basic tier, cross-chain and bridge tracing, smart contract interaction analysis, multi-hop counterparty mapping and scored risk with mitigation recommendations. Limits: wallets 20 Includes: - Everything in the basic tier - Cross-chain and bridge tracing on up to 3 chains - Smart contract interaction analysis - Multi-hop network visualization map - Risk mitigation and compliance recommendations Excludes: - Ongoing monitoring and alerting - Mixer analysis - Expert witness reports or testimony #### Premium Contact Analysis: $15K Full-scope analysis with custom monitoring tools and complete network mapping Limits: wallets 50 Excludes: - Expert witness reports, depositions or testimony - Asset recovery or legal action ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=blockchain-contact-analysis-service ## Quantum-Safe Cryptography Readiness > From $25K · Specialized & Industry · https://cisomarketplace.services/services/quantumsafe-cryptography-readiness Future-proof your cryptographic infrastructure with quantum-safe algorithms and protocols. Includes assessment, migration planning, and implementation support. ### In scope - Current cryptographic assessment - Quantum vulnerability analysis - Algorithm replacement planning - Key management review - Standards compliance verification - Post-quantum algorithm evaluation - Migration pathway planning - Key exchange and random number generator review ### Deliverables - Quantum risk assessment report - Migration strategy document - Implementation roadmap - Updated cryptographic policies - Verification and testing results - Training documentation ### Tiers #### Entry — market-sized scope: $25K Cryptographic inventory for up to 100 in-scope systems: algorithm and certificate inventory delivered as a CBOM, quantum risk classification, and a short migration roadmap. Fixed scope, remote. Limits: internal hosts 100 Includes: - Algorithm and certificate inventory for up to 100 systems - Cryptographic bill of materials (CBOM) - Quantum risk classification per asset - Short migration roadmap - Leadership readout Excludes: - Key management review - Migration strategy document - Cryptographic policy updates - More than 100 systems #### Core Quantum Readiness Assessment: $60K Readiness assessment for up to 250 in-scope systems: current cryptographic assessment, quantum vulnerability analysis, key management review, quantum risk report, and a migration strategy with implementation roadmap. Limits: internal hosts 250 Includes: - Cryptographic inventory for up to 250 systems - Quantum vulnerability analysis - Key management review - Quantum risk assessment report - Migration strategy document and implementation roadmap Excludes: - Per-system algorithm replacement plans - Standards compliance verification - Cryptographic policy rewrite - Implementation support and testing #### Advanced Quantum Readiness Assessment: $85K Readiness assessment for up to 500 in-scope systems. Adds algorithm replacement planning per system class, standards compliance verification against published post-quantum standards, updated cryptographic policies, and a sequenced implementation plan with dependencies. Limits: internal hosts 500 Includes: - Everything in the Core tier, for up to 500 systems - Algorithm replacement plan per system class - Standards compliance verification - Updated cryptographic policies - Sequenced implementation plan with owners and dependencies Excludes: - Hands-on implementation support - Verification testing of migrated systems - Staff training delivery #### Enterprise Quantum Readiness Program: $120K Full-scope quantum-safe transformation including custom implementation support and ongoing verification Limits: internal hosts 1000 Excludes: - Full production migration of every system - HSM, PKI or product licences - More than 1,000 systems (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=quantumsafe-cryptography-readiness ## Banking and Web3 Redundancy Assessment > From $7.5K · Specialized & Industry · https://cisomarketplace.services/services/banking-and-web3-redundancy-assessment Advanced assessment of banking and Web3 infrastructure focusing on redundancy, privacy, and security measures for cryptocurrency and traditional banking operations. ### In scope - Banking infrastructure - Cryptocurrency wallets - Web3 applications - Privacy measures - Backup systems - Recovery procedures ### Deliverables - Infrastructure assessment report - Redundancy recommendations - Privacy enhancement plan - Security architecture document - Backup strategy - Incident response procedures ### Tiers #### Core Redundancy Assessment: $7.5K Review of up to 5 crypto wallets, up to 2 Web3 applications and the client's banking setup for single points of failure. Output is an assessment report with redundancy and backup recommendations. No implementation. Limits: wallets 5, web apps 2 Includes: - Wallet custody, seed backup and recovery review for up to 5 wallets - Banking relationship and access redundancy review - Review of up to 2 Web3 applications in use - Assessment report with redundancy recommendations Excludes: - Privacy enhancement plan - Implementation of backups or new wallets - Incident response procedures - Recovery testing #### Advanced Redundancy Program: $15K Up to 15 wallets and up to 5 Web3 applications: everything in the basic tier, a privacy enhancement plan, security architecture document, backup strategy and written incident response procedures. Guidance only; the client implements. Limits: wallets 15, web apps 5 Includes: - Everything in the basic tier - Privacy enhancement plan - Security architecture document - Backup strategy - Incident response procedures Excludes: - Hands-on implementation of backups and recovery - Recovery drills - Custom backup tooling #### Enterprise Redundancy Solution: $25K Full-scope redundancy implementation with custom backup solutions and recovery procedures Limits: wallets 40, web apps 10 Excludes: - Custody of client keys or funds - Smart contract code audit - Ongoing monitoring ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=banking-and-web3-redundancy-assessment ## VIP Digital Privacy & Security Assessment > From $50K · Specialized & Industry · https://cisomarketplace.services/services/vip-digital-privacy-security-assessment Comprehensive privacy and security assessment designed for high-profile individuals, celebrities, and public figures. Protects personal, financial, and digital assets while maintaining privacy across all aspects of life. ### In scope - Personal digital footprint analysis - Smart home and IoT security review - Financial accounts security audit - Cryptocurrency and Web3 wallet assessment - Social media presence evaluation - Personal business security review - Staff and insider threat assessment - Physical security integration review - Travel security protocol assessment - Family member security evaluation - Personal device security audit - Private network infrastructure review ### Deliverables - Comprehensive privacy risk assessment report - Digital asset security scorecard - Smart home security architecture review - Personal security protocol handbook - Staff security training program - Digital privacy enhancement roadmap - Incident response playbook - Travel security guidelines - Secure communication protocols - Regular security monitoring recommendations ### Tiers #### Core VIP Security Package: $50K One principal: digital footprint analysis, audit of up to 5 personal devices, financial account security audit, social media review and up to 2 crypto wallets. Privacy risk report, scorecard and enhancement roadmap. Limits: subjects 1, devices 5, wallets 2 Includes: - 1 principal - Digital footprint analysis - Up to 5 personal devices audited - Financial account security audit - Up to 2 wallets assessed - Privacy enhancement roadmap Excludes: - Smart home and private network review - Staff and insider threat assessment - Family members - Travel security and monitoring #### Advanced VIP Protection: $85K One principal and 1 residence: adds smart home, IoT and private network review, staff and insider threat assessment with training for up to 10 staff, personal business security review, up to 10 devices and up to 5 wallets, and an incident response playbook. Limits: subjects 1, locations 1, devices 10, wallets 5, participants 10 Includes: - 1 principal, 1 residence - Smart home and private network review - Staff and insider threat assessment - Staff training for up to 10 people - Incident response playbook - Secure communication protocols Excludes: - Family member assessments - Travel security protocols - 24/7 monitoring - Additional residences #### Elite VIP Security Program: $150K Complete security program including family protection, travel security, and 24/7 monitoring Limits: subjects 5, locations 3, devices 25, wallets 10, participants 25 Excludes: - Close protection or guard services - Legal or reputation-management representation - Hardware purchase and installation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=vip-digital-privacy-security-assessment ## Agriculture & Farming Security Assessment > From $36K · Specialized & Industry · https://cisomarketplace.services/services/agriculture-farming-security Specialized security assessment for modern agricultural operations utilizing precision farming technologies, connected equipment, and smart agriculture systems. Our comprehensive evaluation addresses the unique cybersecurity challenges of protecting agricultural data, autonomous farm equipment, sensor networks, and food safety systems while ensuring operational continuity throughout the growing season. ### In scope - Precision agriculture system security - Farm equipment connectivity assessment - Agricultural sensor network security - Farm management system review - Agronomic data protection - Supply chain security verification - Weather data integration security - Irrigation control system assessment - Livestock monitoring security - Food safety system protection ### Deliverables - Agricultural technology security report - Connected farm security architecture - Data protection strategy - Equipment security recommendations - Sensor network hardening guide - Remote access security framework - Weather and irrigation system security plan - Implementation roadmap ### Tiers #### Essential Agricultural Security Assessment: $36K One farm operation: up to 1 site, up to 100 connected devices (equipment, sensors, irrigation controllers) and up to 100 staff. Reviews the farm management system, remote access and agronomic data handling. Remote with one site visit. Limits: locations 1, devices 100, employees 100 Includes: - Farm management system and remote access review - Inventory and configuration review of connected equipment and sensors - Irrigation controller exposure check - Agronomic data protection review - Report with prioritized roadmap Excludes: - Hands-on testing of equipment telematics and sensor radio links - Supply chain and food safety system review - Livestock monitoring systems - More than one site #### Advanced Agricultural Security Program: $65K Up to 3 sites, up to 500 connected devices and up to 500 staff. Adds hands-on testing of equipment connectivity, sensor networks and irrigation control, weather-data integrations, livestock monitoring and a connected-farm security architecture. Limits: locations 3, devices 500, employees 500 Includes: - Everything in the basic tier - Hands-on testing of equipment connectivity and sensor networks - Irrigation and weather-data integration assessment - Livestock monitoring security review - Connected-farm security architecture and sensor hardening guide Excludes: - Supply chain partner and food safety system review - Custom or in-house built farm systems - More than 3 sites #### Enterprise Agricultural Security Framework: $95K Multi-operation agribusiness: up to 10 sites, up to 2,500 connected devices and up to 2,500 staff. Adds custom and in-house systems, food safety systems, supply chain partner verification and a cross-site security framework. Larger estates are scoped separately. Limits: locations 10, devices 2500, employees 2500 Includes: - Everything in the advanced tier - Custom and in-house system review - Food safety system protection review - Supply chain security verification for key partners - Cross-site remote access framework and executive briefing Excludes: - Remediation implementation - Ongoing monitoring after delivery - Processing-plant industrial control testing beyond farm systems ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=agriculture-farming-security ## Construction Industry Security Assessment > From $38K · Specialized & Industry · https://cisomarketplace.services/services/construction-industry-security Comprehensive security assessment designed specifically for construction firms, addressing the unique challenges of securing building information modeling (BIM), project management systems, connected equipment, and site security technologies. Our specialized evaluation helps construction companies protect intellectual property, ensure project continuity, and secure increasingly digital construction operations. ### In scope - Building Information Modeling (BIM) security - Project management system assessment - Construction site IoT security - Connected equipment evaluation - Drone and autonomous vehicle security - Supply chain security verification - Contractor access management - Mobile application security - Site surveillance system assessment - Payment system security ### Deliverables - Construction security assessment report - BIM security framework - Project data protection strategy - Site technology security recommendations - Connected equipment security guide - Contractor security requirements - Mobile security enhancement plan - Implementation roadmap ### Tiers #### Essential Construction Security Assessment: $38K Firms up to 100 staff and up to 2 active job sites: review of the project management platform, BIM access controls and data sharing, contractor access management and payment system controls. Remote, no site technology testing. Limits: employees 100, locations 2, web apps 2 Includes: - Project management system assessment for up to 2 platforms - BIM access control and data sharing review - Contractor access management review - Payment system and invoice fraud controls review - Report with implementation roadmap Excludes: - Site IoT and surveillance system testing - Connected equipment and drone security - Mobile application testing - Supply chain verification #### Advanced Construction Security Program: $70K Up to 500 staff, up to 5 job sites and up to 250 site devices: everything in the basic tier, a BIM security framework, site IoT and surveillance assessment, connected equipment evaluation and testing of up to 1 mobile app. Includes site visits. Limits: employees 500, locations 5, web apps 4, devices 250, mobile apps 1 Includes: - Everything in the basic tier - BIM security framework - Site IoT and surveillance system assessment - Connected equipment evaluation - Mobile application security test for 1 app Excludes: - Drone and autonomous equipment security - Supply chain security verification - More than 5 job sites #### Enterprise Construction Security Framework: $110K Up to 2,500 staff, up to 15 job sites and up to 1,000 site devices: everything in the advanced tier, drone and autonomous equipment security, supply chain verification, contractor security requirements and up to 3 mobile apps. Larger firms are scoped separately. Limits: employees 2500, locations 15, web apps 8, devices 1000, mobile apps 3 Includes: - Everything in the advanced tier - Drone and autonomous equipment security review - Supply chain security verification - Contractor security requirements standard - Multi-site security framework Excludes: - Remediation implementation - Ongoing monitoring - Physical guarding of sites ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=construction-industry-security ## Decentralized Identity Security Assessment > From $35K · Specialized & Industry · https://cisomarketplace.services/services/decentralized-identity-security Expert evaluation of decentralized identity systems, focusing on security of DIDs, verifiable credentials, and identity protocols. ### In scope - Assessment of DID implementations - credential issuance systems - verification protocols - privacy controls ### Deliverables - Security assessment report - protocol analysis - privacy evaluation - implementation recommendations ### Tiers #### Core DID Security Assessment: $35K One DID implementation: up to 1 repository and 1 API. Review of DID method handling, key management and resolution, with a security assessment report. Limits: repositories 1, apis 1 Includes: - DID method and resolver security review - Key management and rotation review - Code review of 1 repository - Security assessment report Excludes: - Credential issuance and revocation review - Verification protocol analysis - Privacy evaluation - Implementation support #### Advanced DID Security Program: $60K Up to 3 repositories and 3 APIs: everything in the basic tier, credential issuance and revocation security, verification protocol analysis, and a privacy evaluation covering correlation and selective disclosure. Limits: repositories 3, apis 3 Includes: - Everything in the basic tier - Credential issuance and revocation security review - Verification protocol analysis - Privacy controls evaluation - One fix-review round Excludes: - Custom test tooling - Implementation support hours - On-chain contract audit beyond the 3 repositories #### Enterprise DID Security Solution: $95K Full-scope DID security program including custom tool development and implementation support Limits: repositories 5, apis 5 Excludes: - Ongoing monitoring - Standards body or certification submissions - Building the identity system ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=decentralized-identity-security ## Digital Twin Security Assessment > From $45K · Specialized & Industry · https://cisomarketplace.services/services/digital-twin-security Comprehensive security assessment of digital twin implementations, including IoT sensor networks, simulation environments, and data synchronization mechanisms. ### In scope - Assessment covers digital twin infrastructure - data flows - API integrations - operational security controls ### Deliverables - Detailed security assessment report - vulnerability analysis - architectural recommendations - remediation roadmap ### Tiers #### Core Digital Twin Assessment: $45K One digital twin: up to 25 sensor devices (sampled), 2 APIs and 1 cloud account. Architecture and data flow review, API testing and operational control review. Limits: devices 25, apis 2, cloud accounts 1 Includes: - Digital twin architecture and data flow review - API integration testing for up to 2 APIs - Cloud configuration review for 1 account - Operational security control review - Report with remediation roadmap Excludes: - Simulation environment security testing - Hands-on IoT device and firmware testing - Data synchronization integrity testing - Monitoring setup #### Advanced Digital Twin Security: $75K Up to 100 sensor devices, 5 APIs and 2 cloud accounts: everything in the basic tier, simulation environment testing, sensor-to-twin data integrity and spoofing tests, and hands-on testing of up to 3 device types. Limits: devices 100, apis 5, cloud accounts 2 Includes: - Everything in the basic tier - Simulation environment security testing - Data synchronization integrity and spoofing tests - Hands-on testing of up to 3 IoT device types - One retest round Excludes: - Custom test tooling - Monitoring and detection setup - Physical plant control system testing #### Enterprise Digital Twin Program: $120K Up to 500 sensor devices, 10 APIs and 5 cloud accounts: everything in the advanced tier, custom test tooling handed over, and monitoring and detection rules set up for the twin's data flows. Larger estates are scoped separately. Limits: devices 500, apis 10, cloud accounts 5 Includes: - Everything in the advanced tier - Custom test tooling handed over - Monitoring and detection rule setup with handover - Multi-site twin architecture recommendations - Two retest rounds Excludes: - Operating the monitoring after handover - Remediation engineering - Safety certification work ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=digital-twin-security ## Event Venue and Festival Security Program > From $40K · Specialized & Industry · https://cisomarketplace.services/services/event-venue-festival-security Comprehensive security assessment for event venues and festivals, including crowd management, access control, and emergency response planning. ### In scope - Venue infrastructure assessment - Crowd flow analysis - Access control systems - Emergency response planning - Vendor security review - Communication systems security ### Deliverables - Event security architecture - Crowd management plan - Access control framework - Emergency procedures - Staff training materials - Communication protocols ### Tiers #### Core Event Security Assessment: $40K Essential event and festival security covering basic venue protection and crowd management #### Advanced Event Security Program: $70K Comprehensive program including detailed crowd analysis and complete security implementation #### Enterprise Event Security Solution: $110K Full-scope event security with custom tools, real-time monitoring, and complete program management ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=event-venue-festival-security ## Gaming Platform Security Assessment > From $22.5K · Specialized & Industry · https://cisomarketplace.services/services/gaming-platform-security Comprehensive security assessment for gaming platforms, focusing on anti-cheat systems, player data protection, microtransaction security, and game engine vulnerabilities. ### In scope - Anti-cheat system evaluation - Game engine security testing - Player authentication review - Microtransaction security assessment - Game client security analysis ### Deliverables - Platform security report - Anti-cheat recommendations - Transaction security analysis - Client-side protection strategy - Player data security framework ### Tiers #### Entry — market-sized scope: $22.5K External penetration test of the platform's public footprint: up to 25 external IPs, 1 web app (player portal or store) and 1 API. No game client, game engine or anti-cheat work. Limits: external ips 25, web apps 1, apis 1 Includes: - External network penetration test of up to 25 IPs - Security test of 1 web app - Security test of 1 API - Player authentication review on the tested app - Findings report with one retest round Excludes: - Anti-cheat system evaluation - Game client and game engine analysis - Microtransaction logic testing - Player data security framework #### Core Gaming Security Assessment: $45K One game title on one client platform: up to 25 external IPs, 2 web apps and 2 APIs, plus anti-cheat design review, player authentication review and player data protection review. Limits: external ips 25, web apps 2, apis 2 Includes: - Everything in the entry tier - Anti-cheat architecture and configuration review - Player authentication and account takeover review - Player data protection review - Platform security report Excludes: - Hands-on anti-cheat bypass testing - Microtransaction and in-game economy testing - Game client reverse engineering - Game engine security testing #### Advanced Gaming Security Program: $75K One game title on up to 2 client platforms: up to 100 external IPs, 3 web apps and 5 APIs. Everything in the basic tier, hands-on anti-cheat bypass testing, game client analysis, and microtransaction and in-game economy abuse testing. Limits: external ips 100, web apps 3, apis 5 Includes: - Everything in the basic tier - Hands-on anti-cheat bypass testing - Game client security analysis and tamper testing - Microtransaction and in-game economy abuse testing - Client-side protection strategy Excludes: - Custom anti-cheat detection tooling - Game engine source-level review - Additional game titles #### Enterprise Gaming Security Solution: $120K Up to 3 game titles: up to 250 external IPs, 5 web apps and 10 APIs. Everything in the advanced tier, game engine security testing, custom anti-cheat detection tooling handed over, backend and cloud infrastructure testing and two retest rounds. Limits: external ips 250, web apps 5, apis 10 Includes: - Everything in the advanced tier - Game engine security testing - Custom anti-cheat detection tooling handed over - Backend and cloud infrastructure testing - Two retest rounds Excludes: - Operating anti-cheat or fraud monitoring - Remediation engineering - Console platform certification work ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=gaming-platform-security ## Green Energy Infrastructure Security > From $65K · Specialized & Industry · https://cisomarketplace.services/services/green-energy-security Comprehensive security assessment for renewable energy infrastructure including smart grids, solar farms, and wind energy systems. ### In scope - Assessment of renewable energy systems - smart grid infrastructure - control systems - energy management platforms ### Deliverables - Detailed security assessment report - vulnerability analysis - compliance mapping - security architecture recommendations ### Tiers #### Core Green Energy Assessment: $65K Security assessment of 1 renewable generation site (solar, wind or storage) and its control system: architecture review, passive network capture, control system and energy management platform configuration review, and a findings report. Limits: locations 1 Includes: - On-site assessment of 1 generation site - Control system and energy management platform configuration review - Passive OT network traffic capture and asset inventory - Remote access and vendor connection review - Vulnerability analysis and findings report Excludes: - Smart grid / utility interconnect and DER aggregation analysis - Control-by-control compliance mapping - Additional sites - Monitoring deployment or remediation support #### Advanced Green Energy Security: $110K Assessment of up to 3 sites plus the central control / operations center. Adds smart grid and interconnect analysis, corporate IT-to-OT boundary review, control-by-control compliance mapping to one named standard, and security architecture recommendations. Limits: locations 3, frameworks 1 Includes: - Everything in the Core tier, for up to 3 sites - Central control / operations center assessment - Smart grid, interconnect and DER communication path analysis - IT/OT boundary and segmentation review - Compliance mapping to 1 standard chosen by the client - Security architecture recommendations Excludes: - OT monitoring design and deployment - Hands-on remediation and implementation support - More than 3 sites #### Enterprise Green Energy Program: $180K Full-scope renewable energy security program including custom monitoring and implementation support Limits: locations 5, frameworks 2 Excludes: - Monitoring product licences and hardware - Fleets above 5 sites (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=green-energy-security ## Industrial IoT (IIoT) Security Assessment > From $42K · Specialized & Industry · https://cisomarketplace.services/services/industrial-iot-security Specialized security assessment for industrial IoT environments where operational technology and information technology converge. Our comprehensive evaluation examines the security of connected industrial systems, sensors, gateways, and analytics platforms while addressing the unique challenges of securing industrial control systems connected to IoT networks in manufacturing, utilities, and critical infrastructure. ### In scope - IIoT device security assessment - Industrial network security evaluation - OT/IT convergence gap analysis - Edge computing security review - IIoT data protection assessment - Industrial protocol security testing - IIoT platform security review - Supply chain security verification - IIoT update management - OT security monitoring capabilities ### Deliverables - IIoT security assessment report - Risk prioritization matrix - IIoT security architecture recommendations - OT/IT segmentation strategy - Device security hardening guide - Secure IIoT deployment framework - Industrial network protection plan - Security monitoring recommendations - Remediation roadmap ### Tiers #### Essential IIoT Security Assessment: $42K Assessment of 1 facility and up to 5 IIoT device models (sensors, gateways): device configuration and update review, industrial network evaluation, one IIoT platform review, and OT/IT gap analysis. Limits: locations 1, devices 5 Includes: - Security assessment of up to 5 device models - Industrial network and segmentation evaluation at 1 facility - Review of 1 IIoT platform / cloud tenant - OT/IT convergence gap analysis - Report, risk prioritization matrix, remediation roadmap Excludes: - Industrial protocol active testing - Edge computing and supply chain verification - Firmware reverse engineering - Additional facilities #### Advanced IIoT Security Program: $75K Assessment of up to 3 facilities and up to 15 device models. Adds industrial protocol security testing, edge computing review, IIoT data protection assessment, update management review, supply chain verification, and an OT/IT segmentation strategy. Limits: locations 3, devices 15 Includes: - Everything in the Essential tier, for up to 3 facilities - Industrial protocol security testing - Edge node and gateway security review - Supply chain and update management verification - OT/IT segmentation strategy - Device hardening guide Excludes: - Custom security architecture for new deployments - OT security monitoring design - Governance framework #### Enterprise IIoT Security Framework: $120K Assessment of up to 5 facilities and up to 30 device models. Adds a reference security architecture and secure deployment framework for future rollouts, OT monitoring capability design, and IIoT security governance. Larger estates are scoped separately. Limits: locations 5, devices 30 Includes: - Everything in the Advanced tier, for up to 5 facilities - Reference IIoT security architecture - Secure IIoT deployment framework for new sites and devices - OT security monitoring design and use cases - IIoT security governance model Excludes: - Monitoring deployment and licences - Remediation engineering - Estates above 5 facilities (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=industrial-iot-security ## IoT Security Hardening Program > From $45K · Specialized & Industry · https://cisomarketplace.services/services/iot-security-hardening-program End-to-end IoT device and infrastructure security assessment, hardening, and monitoring solution for manufacturing and industrial environments. ### In scope - IoT device security assessment - Network segmentation review - Protocol security analysis - Firmware security testing - OT/IT convergence security ### Deliverables - IoT security assessment report - Device hardening guidelines - Network segmentation recommendations - Security monitoring setup - Incident response procedures - Staff training materials ### Tiers #### Core IoT Security Hardening: $45K Assess-and-harden program for 1 facility and up to 5 device models: device inventory, device assessment, hardening guidelines, segmentation review with recommendations, baseline monitoring setup on existing tooling, and training materials. Limits: locations 1, devices 5 Includes: - IoT device inventory for 1 facility - Assessment and hardening guidelines for up to 5 device models - Network segmentation review and recommendations - Baseline monitoring setup on the client's existing tooling - Staff training materials Excludes: - Firmware security testing - Industrial protocol testing - OT/IT convergence security - Incident response procedures #### Advanced IoT Security Program: $75K Program for up to 2 facilities and up to 15 device models. Adds firmware security testing, protocol security analysis and testing, OT/IT convergence security review, and IoT incident response procedures. Limits: locations 2, devices 15 Includes: - Everything in the Core tier, for up to 2 facilities - Firmware security testing - Protocol security analysis and testing - OT/IT convergence security review - IoT incident response procedures Excludes: - Custom hardening scripts and tooling - Post-deployment monitoring tuning period - Incident response exercises #### Enterprise IoT Security Platform: $120K Full-scope IoT security program with custom hardening tools, continuous monitoring, and advanced incident response capabilities Limits: locations 4, devices 30, scenarios 1 Excludes: - Monitoring licences and sensors - More than 4 facilities (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=iot-security-hardening-program ## M&A Cybersecurity Due Diligence > From $25K · Specialized & Industry · https://cisomarketplace.services/services/ma-cybersecurity-due-diligence Comprehensive cybersecurity assessment and risk analysis for mergers, acquisitions, and investment decisions. Tailored for PE firms, VCs, and corporate buyers to evaluate cyber risks before completing transactions. ### In scope - Security posture evaluation - Infrastructure and architecture review - Compliance and regulatory assessment - Security incident history analysis - Third-party vendor risk assessment - Technical debt evaluation - Security team capability assessment - Cloud infrastructure security review - Data protection and privacy analysis - Security roadmap evaluation ### Deliverables - Executive summary for investment decision-makers - Detailed technical due diligence report - Risk assessment matrix - Security maturity scorecard - Post-acquisition security roadmap - Cost analysis for security improvements - Integration risk assessment - Compliance gap analysis - Technical debt quantification - Remediation priority recommendations ### Tiers #### Core M&A Security Assessment: $25K Due diligence on 1 target of up to 250 employees: data-room document review, up to 5 stakeholder interviews, external attack surface scan, incident history and compliance review, and a red-flag report for the deal team. No system access needed. Limits: subjects 1, employees 250, locations 1, cloud accounts 1, vendors 5 Includes: - Data-room security documentation review - Up to 5 stakeholder interviews - External attack surface and breach-exposure scan - Incident history and compliance review - Executive summary and risk matrix for decision-makers Excludes: - Authenticated technical analysis of cloud and infrastructure - Remediation cost quantification - Integration planning - Penetration testing #### Advanced M&A Security Program: $45K Due diligence on 1 target of up to 1,000 employees. Adds read-only technical analysis of up to 3 cloud accounts and core infrastructure, review of up to 15 key vendors, security team capability assessment, maturity scorecard, remediation cost estimates and integration risk. Limits: subjects 1, employees 1000, locations 3, cloud accounts 3, vendors 15 Includes: - Everything in the Core tier - Read-only configuration review of up to 3 cloud accounts and core infrastructure - Third-party risk review of up to 15 key vendors - Security maturity scorecard and team capability assessment - Remediation cost analysis and technical debt quantification - Integration risk assessment Excludes: - Hands-on penetration testing - Quantified risk modeling for deal pricing - Post-close security strategy and 100-day plan #### Enterprise M&A Security Solution: $75K Due diligence on 1 target of up to 2,500 employees. Adds targeted penetration testing and compromise assessment tooling, quantified loss modeling to support price and escrow terms, and a post-merger security strategy with a 100-day plan. Limits: subjects 1, employees 2500, locations 5, cloud accounts 5, vendors 30 Includes: - Everything in the Advanced tier - Targeted external and internal penetration testing - Compromise assessment of the target environment - Quantified risk and remediation cost model - Post-acquisition security roadmap and 100-day integration plan - Deal-team and board briefing Excludes: - Execution of post-close remediation - Legal or regulatory opinions - More than 1 target entity (each scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=ma-cybersecurity-due-diligence ## Maritime Systems Security Assessment > From $38K · Specialized & Industry · https://cisomarketplace.services/services/maritime-systems-security-assessment Specialized security testing for maritime technology, including navigation systems, vessel communication, and port infrastructure. ### In scope - Navigation system testing - AIS security assessment - ECDIS security review - Radio communication testing - Port system security evaluation - Vessel tracking security - Maritime IoT device testing ### Deliverables - Maritime security report - Navigation system analysis - Communication security findings - Port infrastructure recommendations - Vessel tracking security guide - Maritime IoT security assessment - 90-day follow-up review ### Tiers #### Core Maritime Systems Assessment: $38K Assessment of 1 vessel or port facility (1 location): navigation system testing, AIS and ECDIS configuration review, vessel communications review, basic port/shore system evaluation, report and a follow-up review. Limits: locations 1 Includes: - Navigation system security testing on 1 vessel/facility - AIS and ECDIS configuration review - Vessel communication (satcom, radio) configuration review - Shore/port system interface review - Maritime security report and 90-day follow-up review Excludes: - Active AIS/ECDIS spoofing and manipulation testing - Radio frequency testing - Vessel tracking system security - Maritime IoT device testing #### Advanced Maritime Security Program: $65K Assessment of up to 3 vessels/port facilities. Adds active AIS and ECDIS testing, radio communication testing, vessel tracking security, and port system security evaluation. Includes a follow-up review. Limits: locations 3 Includes: - Everything in the Core tier, for up to 3 vessels/facilities - Active AIS spoofing and ECDIS chart/update integrity testing - Radio communication testing - Vessel tracking security assessment - Port system security evaluation Excludes: - Maritime IoT device and sensor testing - Custom test tooling - Monitoring implementation #### Enterprise Maritime Security Solution: $95K Assessment of up to 5 vessels/port facilities. Adds maritime IoT device testing (up to 15 device models), custom test tooling for proprietary bridge or cargo systems, and monitoring implementation with detection use cases. Larger fleets are scoped separately. Limits: locations 5, devices 15 Includes: - Everything in the Advanced tier, for up to 5 vessels/facilities - Maritime IoT device testing, up to 15 device models - Custom test tooling for proprietary systems - Monitoring implementation with maritime-specific detections - Fleet-level security recommendations Excludes: - Monitoring licences and onboard hardware - 24/7 monitoring operations - Fleets above 5 vessels/facilities (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=maritime-systems-security-assessment ## Media & Entertainment Security Assessment > From $42K · Specialized & Industry · https://cisomarketplace.services/services/media-entertainment-security Comprehensive security assessment designed specifically for media and entertainment organizations, addressing the unique challenges of protecting intellectual property, pre-release content, production systems, and streaming platforms. Our specialized assessment helps studios, broadcasters, and content creators secure valuable digital assets, prevent piracy, and ensure operational continuity across production and distribution channels. ### In scope - Pre-release content protection - Production environment security - Digital rights management assessment - Streaming platform security - Content management system review - Third-party vendor assessment - Cloud-based production security - Post-production security - Screening and distribution controls - Anti-piracy measures evaluation ### Deliverables - Media security assessment report - Content protection framework - IP protection strategy - Production security recommendations - Streaming platform security enhancements - Third-party security requirements - Digital rights management framework - Implementation roadmap ### Tiers #### Essential Media Security Assessment: $42K Assessment for up to 250 employees and 1 production facility: pre-release content protection, production environment and content management system review, architecture review of 1 streaming platform, and up to 5 vendors. Limits: employees 250, locations 1, vendors 5, web apps 1 Includes: - Pre-release content workflow and access review - Production environment security review at 1 facility - Content management system review - Architecture review of 1 streaming platform - Security review of up to 5 vendors - Report and implementation roadmap Excludes: - DRM assessment - Anti-piracy measures evaluation - Post-production and cloud production review - Screening and distribution controls #### Comprehensive Media Security Program: $75K Assessment for up to 1,000 employees, up to 3 facilities and up to 15 vendors. Adds digital rights management assessment, cloud-based and post-production security, screening and distribution controls, anti-piracy evaluation, and a content protection framework. Limits: employees 1000, locations 3, vendors 15, web apps 1 Includes: - Everything in the Essential tier, for up to 3 facilities - Digital rights management assessment - Cloud-based production and post-production security review - Screening and distribution controls review - Anti-piracy measures evaluation - Content protection framework and third-party security requirements Excludes: - Global, multi-region distribution network review - IP protection strategy for the full catalogue - More than 1 streaming platform #### Premium Entertainment Security Framework: $120K For studios with global operations: up to 10 facilities, up to 30 vendors and up to 3 streaming platforms; no fixed headcount cap - scoped. Adds distribution network review across regions, IP protection strategy, and title-level protection plans for high-value releases. Limits: locations 10, vendors 30, web apps 3 Includes: - Everything in the Comprehensive tier, for up to 10 facilities - Global distribution network and partner delivery review - IP protection strategy - Protection plans for up to 3 high-value releases - Streaming platform security enhancements for up to 3 platforms - Executive briefing Excludes: - Penetration testing of streaming platforms (separate service) - Piracy takedown and monitoring operations - Remediation implementation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=media-entertainment-security ## Privacy Engineering & Data Protection Program > From $45K · Specialized & Industry · https://cisomarketplace.services/services/privacy-engineering-program Comprehensive service to implement privacy by design principles and data protection controls throughout your organization's systems and processes. Our program helps you architect privacy-enhancing technologies, implement data minimization strategies, and establish technical privacy controls that align with regulatory requirements while enhancing user trust. ### In scope - Privacy by design implementation - Data flow analysis - Privacy impact assessment methodology - Privacy-enhancing technology evaluation - Data minimization strategy - Privacy control implementation - Cross-border data transfer assessment - Anonymization and pseudonymization techniques - Data subject rights technical implementation - Privacy monitoring framework ### Deliverables - Privacy engineering roadmap - Technical privacy controls framework - Data protection architecture - Privacy-enhanced system design recommendations - Data minimization implementation plan - Technical controls documentation - Privacy monitoring and metrics - Privacy governance framework - Data lifecycle management strategy ### Tiers #### Essential Privacy Engineering Assessment: $45K Privacy engineering review for up to 250 employees: data flow analysis of up to 3 systems, 1 regulation in scope, data minimization review, privacy-by-design recommendations, and implementation guidance for up to 5 priority controls. Limits: employees 250, frameworks 1 Includes: - Data flow analysis of up to 3 systems - Review against 1 privacy regulation - Data minimization strategy - Privacy-enhanced design recommendations - Implementation guidance for up to 5 technical controls - Privacy engineering roadmap Excludes: - PIA methodology and templates - Privacy-enhancing technology evaluation - Data subject rights automation - Monitoring and metrics #### Comprehensive Privacy Engineering Program: $75K Program for up to 1,000 employees: up to 8 systems and up to 2 regulations. Adds privacy impact assessment methodology, privacy-enhancing technology evaluation, anonymization/pseudonymization design, data subject rights technical implementation, and a privacy monitoring framework. Limits: employees 1000, frameworks 2 Includes: - Everything in the Essential tier, for up to 8 systems - Privacy impact assessment methodology and templates - Privacy-enhancing technology evaluation - Anonymization and pseudonymization design - Data subject rights technical implementation design - Privacy monitoring framework and metrics Excludes: - Organization-wide data protection architecture - Cross-border transfer assessment - Hands-on implementation support - Governance framework #### Enterprise Privacy Architecture Transformation: $120K Advanced privacy engineering program with comprehensive data protection architecture, implementation support, and governance framework Limits: frameworks 4 Excludes: - Legal advice and DPO services - Privacy tooling licences - More than 15 systems (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=privacy-engineering-program ## Real Estate & Property Management Security Assessment > From $38K · Specialized & Industry · https://cisomarketplace.services/services/real-estate-property-security Specialized security assessment for real estate firms, property managers, and building operators addressing the unique challenges of securing smart buildings, tenant management systems, and integrated building technologies. Our comprehensive evaluation helps protect property assets, tenant data, and emerging proptech applications. ### In scope - Building management system security - Smart building technology assessment - Access control system evaluation - Tenant data protection - Property management software security - IoT device security - Integrated security systems - Visitor management security - Maintenance management security - Video surveillance system review ### Deliverables - Real estate security assessment report - Smart building security framework - Tenant data protection strategy - Building system security recommendations - IoT security policies - Access control security enhancement plan - PropTech security guidelines - Security integration roadmap - Implementation priorities ### Tiers #### Essential Real Estate Security Assessment: $38K One building and one property management platform: review of property management software, tenant data handling, access control and BMS configuration, with up to 25 IoT/building devices sampled. Report with implementation priorities. Limits: locations 1, web apps 1, devices 25 Includes: - 1 building - Property management software security review - Tenant data protection review - Access control and BMS configuration review - Up to 25 devices sampled - Assessment report with priorities Excludes: - Video surveillance and visitor management review - Hands-on testing of smart building devices - PropTech application guidelines - More than 1 building #### Comprehensive Property Security Program: $65K Up to 3 buildings and up to 3 property/PropTech applications: all ten scope areas including video surveillance, visitor and maintenance management, with up to 100 devices tested. Adds the smart building framework, IoT policies and an access control enhancement plan. Limits: locations 3, web apps 3, devices 100 Includes: - Up to 3 buildings - All ten scope areas - Up to 100 IoT/building devices tested - Smart building security framework - IoT security policies - Access control enhancement plan Excludes: - Portfolio-wide governance model - Centralized monitoring design - More than 3 buildings #### Real Estate Portfolio Security Framework: $95K Portfolio engagement for up to 10 buildings and up to 5 applications, up to 250 devices tested: Advanced scope plus a portfolio control baseline, centralized monitoring design, governance model and a security integration roadmap. Larger portfolios are scoped separately. Limits: locations 10, web apps 5, devices 250 Includes: - Up to 10 buildings - Portfolio-wide control baseline - Centralized monitoring design - Governance model and roles - Security integration roadmap - Up to 250 devices tested Excludes: - Operating the monitoring service - Remediation or installation work - Physical guard-force review ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=real-estate-property-security ## Research Facility Security Program > From $55K · Specialized & Industry · https://cisomarketplace.services/services/research-facility-security Specialized security assessment for research facilities, focusing on intellectual property protection, laboratory security, and research data safeguarding. ### In scope - Intellectual property protection review - Laboratory security assessment - Research data handling evaluation - Access control analysis - Collaboration security review ### Deliverables - Research security architecture - IP protection framework - Data security strategy - Physical security recommendations - Collaboration security guidelines ### Tiers #### Core Research Security Assessment: $55K One research site with up to 250 staff and up to 5 labs: IP protection review, laboratory physical security walk-through, research data handling evaluation and access control analysis. Delivers findings plus an IP protection framework. Limits: locations 1, employees 250 Includes: - 1 research site, up to 5 labs - IP protection review - Laboratory security walk-through - Research data handling evaluation - Access control analysis - IP protection framework Excludes: - Collaboration and external partner security review - Research security architecture design - Multiple sites - Implementation of controls #### Advanced Research Security Program: $95K Up to 3 sites and up to 1,000 staff: all five scope areas including collaboration security with external partners, every lab assessed rather than sampled, plus the research security architecture, data security strategy and collaboration guidelines. Limits: locations 3, employees 1000 Includes: - Up to 3 sites, all labs assessed - Collaboration and partner security review - Research security architecture - Data security strategy - Physical security recommendations - Collaboration security guidelines Excludes: - Custom protection tooling - Program implementation and rollout - More than 3 sites #### Enterprise Research Security Solution: $150K Full-scope research security with custom protection tools and complete program implementation Excludes: - Software or hardware purchase costs - Physical security installation - Ongoing managed monitoring after the term ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=research-facility-security ## Smart City Infrastructure Assessment > From $45K · Specialized & Industry · https://cisomarketplace.services/services/smart-city-infrastructure-assessment Comprehensive security evaluation of smart city technologies, including traffic systems, surveillance networks, and municipal IoT deployments. ### In scope - Traffic control system testing - Smart lighting security review - Municipal IoT device assessment - Emergency response system testing - Public WiFi security evaluation - Surveillance system security review - Cross-system integration testing - Municipal service platform and data-integration security - Security architecture review (top tier) ### Deliverables - Smart city security report - Critical vulnerability assessment - Integration security analysis - Public safety impact analysis - Privacy protection recommendations - Remediation strategy guide - 120-day follow-up assessment ### Tiers #### Core Infrastructure Assessment: $45K Two system types - traffic control and emergency response - in 1 municipality: security testing of each with up to 25 field devices sampled, critical vulnerability assessment and public safety impact analysis. Includes a follow-up review. Limits: locations 1, devices 25 Includes: - Traffic control system testing - Emergency response system testing - Up to 25 field devices sampled - Public safety impact analysis - 120-day follow-up assessment Excludes: - Smart lighting, public WiFi and surveillance systems - Cross-system integration testing - Privacy impact analysis - Reassessments #### Comprehensive Infrastructure Assessment: $75K All six system types in 1 municipality with up to 100 devices sampled: adds smart lighting, municipal IoT, public WiFi and surveillance, cross-system integration testing and privacy impact analysis. Includes a follow-up review. Limits: locations 1, devices 100 Includes: - All six system types - Up to 100 devices sampled - Cross-system integration testing - Privacy impact analysis - Remediation strategy guide - 120-day follow-up assessment Excludes: - Quarterly reassessment - Monitoring after the assessment - Device samples above 100 #### Enterprise Infrastructure Assessment: $95K Complete smart city security program including all systems, extended monitoring, and quarterly reassessment Limits: locations 1, devices 250, sessions 4 Excludes: - Remediation work - Additional municipalities ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smart-city-infrastructure-assessment ## Software Supply Chain Security Assessment > From $36K · Specialized & Industry · https://cisomarketplace.services/services/software-supply-chain-security Comprehensive evaluation of your organization's software supply chain security posture, examining third-party dependencies, build processes, and deployment pipelines. Our assessment identifies vulnerabilities in your software supply chain and provides strategies to mitigate risks from compromised components, malicious packages, and insecure development practices. ### In scope - Third-party dependency review - Build pipeline security assessment - Code signing practices - Package repository security - Provenance verification - CI/CD security controls - Container image security - Dependency vulnerability management - SBOM generation and management - Artifact signing process evaluation - Container and base-image security analysis ### Deliverables - Software supply chain risk assessment report - Dependency security analysis - Build pipeline security recommendations - SBOM implementation strategy - Code signing framework - Repository security controls - Vulnerability management process - Regulatory compliance guidance ### Tiers #### Essential Supply Chain Security Review: $36K Up to 10 repositories, 1 CI/CD platform and up to 25 developers: third-party dependency review of critical applications, build pipeline and CI/CD control review, package repository settings, and code signing practices. Risk report. Limits: repositories 10, developers 25 Includes: - Up to 10 repositories - Dependency review of critical applications - Build pipeline and CI/CD control review - Package repository security review - Code signing practice review - Risk assessment report Excludes: - SBOM generation and implementation - Container image security - Provenance verification - Governance framework #### Comprehensive Supply Chain Security Program: $65K Up to 25 repositories, up to 3 CI/CD platforms and up to 100 developers: all nine scope areas including container images and provenance verification, SBOMs generated for in-scope applications, and a dependency vulnerability management process. Limits: repositories 25, developers 100 Includes: - Up to 25 repositories - All nine scope areas - SBOM generation and implementation strategy - Container image security - Provenance verification - Vulnerability management process Excludes: - Automated policy gates built into pipelines - Governance framework - Regulatory compliance mapping #### Enterprise Supply Chain Security Framework: $95K Up to 100 repositories and up to 250 developers: Standard scope plus automated controls (dependency, signing and SBOM gates) implemented in pipelines, a supply chain governance framework, and mapping to the customer's named regulatory requirements. Limits: repositories 100, developers 250 Includes: - Up to 100 repositories - Automated pipeline gates implemented - Governance framework - Code signing framework - Regulatory compliance guidance Excludes: - Tool licence costs - Ongoing managed monitoring - Application source code review for vulnerabilities ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=software-supply-chain-security ## Autonomous Vehicle Security Program > From $75K · Specialized & Industry · https://cisomarketplace.services/services/autonomous-vehicle-security Advanced security assessment and testing program for autonomous vehicle systems, focusing on AI/ML components, sensor networks, and vehicle communications. ### In scope - Assessment of autonomous systems - sensor networks - AI/ML models - V2X communications - safety systems ### Deliverables - Comprehensive security assessment report - threat model - vulnerability analysis - security architecture recommendations ### Tiers #### Core Autonomous Vehicle Assessment: $75K One vehicle platform: threat model, architecture review and security testing of the autonomy stack's sensor inputs and in-vehicle networks. No AI/ML model testing and no V2X testing. Limits: devices 1 Includes: - Threat model for 1 vehicle platform - Sensor network and in-vehicle network security testing - Safety system interface review - Vulnerability analysis and architecture recommendations Excludes: - AI/ML model adversarial testing - V2X communication testing - Backend and fleet management systems - Retest beyond one round #### Advanced Autonomous Security Program: $125K One vehicle platform plus up to 2 AI/ML models: everything in the basic tier, adversarial testing of perception and planning models, and V2X communication testing. Limits: devices 1, ai systems 2 Includes: - Everything in the basic tier - Adversarial-input testing of up to 2 AI/ML models - V2X protocol and message security testing - Safety system fault-injection review - One retest round Excludes: - Custom test tooling built for the client - Monitoring design and post-delivery support - Additional vehicle platforms #### Enterprise Autonomous Vehicle Solution: $200K Full-scope autonomous vehicle security program including custom tools and continuous monitoring Limits: devices 3, ai systems 5 Excludes: - Operating a monitoring service for the client - Safety certification or homologation work - Remediation engineering ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=autonomous-vehicle-security ## Aviation Systems Security Program > From $65K · Specialized & Industry · https://cisomarketplace.services/services/aviation-systems-security Comprehensive security assessment for aviation systems including avionics, ground control systems, and airport infrastructure security. ### In scope - Avionics system security testing - Ground control system assessment - Air traffic control security review - Airport infrastructure evaluation - Communication systems testing ### Deliverables - Aviation security architecture - Systems security analysis - Communication security framework - Infrastructure protection plan - Compliance documentation ### Tiers #### Core Aviation Security Assessment: $65K One facility and up to 3 systems (for example one ground control system, one communication system, one avionics unit on a test bench): architecture review, configuration review and non-intrusive testing. No air traffic control review. Limits: locations 1, devices 3 Includes: - Architecture and configuration review of up to 3 systems - Non-intrusive testing on bench or test environments - Airport or facility IT/OT network segmentation review - Infrastructure protection plan Excludes: - Air traffic control system review - Hands-on avionics testing beyond one bench unit - Custom test tooling - More than one facility #### Advanced Aviation Security Program: $110K Up to 2 facilities and up to 8 systems: everything in the basic tier, hands-on avionics and communication systems testing, air traffic control security review and airport infrastructure evaluation. Limits: locations 2, devices 8 Includes: - Everything in the basic tier - Hands-on avionics and communication systems testing - Air traffic control security review - Airport infrastructure evaluation - Communication security framework Excludes: - Custom test tooling built for the client - More than 2 facilities - Remediation implementation #### Enterprise Aviation Security Solution: $175K Up to 5 facilities; number of systems is not capped and is fixed in the statement of work. Everything in the advanced tier, plus test tooling built for the client's systems, a cross-facility security architecture and one retest round. Limits: locations 5 Includes: - Everything in the advanced tier - Custom test tooling for proprietary systems, handed over - Cross-facility aviation security architecture - Compliance documentation pack - One retest round Excludes: - Testing on in-service aircraft or live air traffic systems - Ongoing monitoring - Remediation implementation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=aviation-systems-security ## Breach Impact Assessment > From $38K · Specialized & Industry · https://cisomarketplace.services/services/breach-impact-assessment Strategic evaluation of your organization's potential business impact from various cybersecurity breach scenarios. Our assessment quantifies financial, reputational, operational, and regulatory consequences of different types of security incidents, providing crucial data to support security investment decisions and risk management strategies. ### In scope - Critical data identification - Breach scenario modeling - Financial impact analysis - Reputational impact assessment - Operational disruption analysis - Regulatory impact evaluation - Third-party breach impact - Customer/client impact assessment - Market valuation impact - Business resilience evaluation ### Deliverables - Breach impact assessment report - Financial impact quantification - Scenario-based risk analysis - Impact reduction recommendations - Security investment prioritization framework - Risk transfer strategies - Executive communication materials - Board presentation deck ### Tiers #### Essential Breach Impact Analysis: $38K Up to 3 breach scenarios modelled against the organization's critical data: financial and operational impact estimated in ranges, with impact reduction recommendations. One stakeholder workshop. Limits: scenarios 3, sessions 1 Includes: - Critical data identification - Up to 3 breach scenarios - Financial and operational impact ranges per scenario - One stakeholder workshop - Breach impact assessment report Excludes: - Reputational, regulatory and market valuation impact - Third-party breach scenarios - Security investment prioritization framework - Board presentation deck #### Comprehensive Impact Assessment Program: $65K Up to 6 scenarios including third-party breach: everything in the basic tier, scenario-level financial modelling, reputational, regulatory and customer impact analysis, and a security investment prioritization framework. Up to 3 workshops. Limits: scenarios 6, sessions 3 Includes: - Everything in the basic tier - Financial model per scenario with stated assumptions - Reputational, regulatory and customer impact analysis - Third-party breach scenario - Security investment prioritization framework Excludes: - Board presentation deck and board session - Market valuation impact - Risk transfer strategy - Risk management framework #### Executive Cyber Risk Program: $95K Up to 10 scenarios: everything in the standard tier, market valuation impact, risk transfer strategies, a cyber risk management framework, executive communication materials and a board deck presented in person. Up to 5 sessions including 1 board session. Limits: scenarios 10, sessions 5 Includes: - Everything in the standard tier - Market valuation impact and business resilience evaluation - Risk transfer strategies - Board presentation deck with one board session - Cyber risk management framework Excludes: - Technical penetration testing or control testing - Insurance brokerage or policy placement - Ongoing risk quantification after delivery ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=breach-impact-assessment ## Cryptocurrency Exchange Security Program > From $75K · Specialized & Industry · https://cisomarketplace.services/services/crypto-exchange-security Advanced security assessment and implementation program for cryptocurrency exchanges, focusing on wallet security, trading systems, and regulatory compliance. ### In scope - Hot wallet security assessment - Cold storage implementation review - Trading engine security testing - KYC/AML compliance evaluation - Smart contract security audit ### Deliverables - Exchange security architecture - Wallet security framework - Trading system analysis - Compliance documentation - Incident response playbooks ### Tiers #### Core Exchange Security Assessment: $75K One exchange platform: up to 3 wallet systems (hot and cold), 1 trading web app and 1 public API. Wallet architecture and key ceremony review plus trading engine security testing. Limits: wallets 3, web apps 1, apis 1 Includes: - Hot wallet security assessment - Cold storage procedure and key ceremony review - Trading engine and web app security testing - Public API security testing - Exchange security architecture report Excludes: - Smart contract audit - KYC/AML compliance evaluation - Mobile app testing - Incident response playbooks #### Advanced Exchange Security Program: $125K Up to 10 wallet systems, 2 web apps, 3 APIs, 1 mobile app and 1 smart contract repository: everything in the basic tier, wallet architecture redesign recommendations, KYC/AML control evaluation, smart contract audit and incident response playbooks. Limits: wallets 10, web apps 2, apis 3, mobile apps 1, repositories 1 Includes: - Everything in the basic tier - Wallet security framework including multi-signature and withdrawal controls - KYC/AML compliance evaluation - Smart contract audit for 1 repository - Incident response playbooks Excludes: - Custom security tooling - Internal corporate network testing - Ongoing monitoring #### Enterprise Exchange Security Solution: $200K Up to 25 wallet systems, 3 web apps, 5 APIs, 2 mobile apps and 3 contract repositories: everything in the advanced tier, corporate and cloud infrastructure testing, custom withdrawal-anomaly tooling handed over, and one retest round. Limits: wallets 25, web apps 3, apis 5, mobile apps 2, repositories 3 Includes: - Everything in the advanced tier - Corporate, cloud and production infrastructure testing - Custom detection tooling handed over - Red-team style withdrawal path exercise - One full retest round Excludes: - Operating a monitoring service - Licensing or regulatory filings - Custody of client keys ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=crypto-exchange-security ## Digital Banking Security Assessment > From $60K · Specialized & Industry · https://cisomarketplace.services/services/digital-banking-security Comprehensive security assessment for digital banking platforms, focusing on payment systems, mobile banking security, and financial transaction protection. ### In scope - Payment processing security - Mobile banking assessment - API security review - Transaction monitoring evaluation - Fraud prevention analysis ### Deliverables - Banking platform security report - Payment security analysis - Mobile security recommendations - API protection strategy - Fraud prevention framework ### Tiers #### Core Digital Banking Assessment: $60K One digital banking platform: 1 web app, 1 mobile app (one platform) and up to 2 APIs. Security testing of login, payments and account functions plus a payment processing security review. Limits: web apps 1, mobile apps 1, apis 2 Includes: - Web and mobile banking application security testing - Payment processing security review - API security review for up to 2 APIs - Banking platform security report - One retest round Excludes: - Transaction monitoring evaluation - Fraud prevention analysis - Second mobile platform - Custom tooling #### Advanced Digital Banking Program: $100K Up to 2 web apps, 2 mobile apps (iOS and Android) and 5 APIs: everything in the basic tier, transaction monitoring rule evaluation, fraud prevention analysis with abuse-case testing and an API protection strategy. Limits: web apps 2, mobile apps 2, apis 5 Includes: - Everything in the basic tier - Transaction monitoring evaluation - Fraud prevention analysis and abuse-case testing - API protection strategy - Fraud prevention framework Excludes: - Custom test and detection tooling - Core banking and internal network testing - Partner and open-banking integrations beyond 5 APIs #### Enterprise Digital Banking Solution: $165K Up to 3 web apps, 4 mobile apps and 10 APIs including partner integrations: everything in the advanced tier, supporting cloud and internal infrastructure testing, custom fraud-scenario test tooling handed over and two retest rounds. Limits: web apps 3, mobile apps 4, apis 10 Includes: - Everything in the advanced tier - Partner and open-banking API testing - Cloud and internal infrastructure supporting the platform - Custom fraud-scenario tooling handed over - Two retest rounds Excludes: - Operating fraud monitoring - Regulatory audit or attestation - Remediation engineering ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=digital-banking-security ## Energy Sector Security Program > From $95K · Specialized & Industry · https://cisomarketplace.services/services/energy-sector-security Comprehensive security assessment for energy sector infrastructure, including power generation, distribution systems, and grid security. ### In scope - Power generation security - Distribution system assessment - Smart grid protection - SCADA system testing - Nuclear facility security - Renewable energy systems ### Deliverables - Energy sector security architecture - Grid protection framework - SCADA security analysis - Regulatory compliance documentation - Emergency response procedures ### Tiers #### Core Energy Security Assessment: $95K One generation or distribution site with up to 250 OT/SCADA assets: architecture review, passive network assessment, SCADA configuration review and IT/OT segmentation testing. No active testing on live control systems. Limits: locations 1, internal hosts 250 Includes: - OT asset inventory and architecture review - Passive SCADA network assessment - IT/OT segmentation testing - SCADA configuration and remote access review - Emergency response procedure review Excludes: - Smart grid and distribution automation analysis - Active testing of control systems - Compliance documentation - Nuclear facilities #### Advanced Energy Security Program: $165K Up to 3 sites and up to 1,000 OT/SCADA assets: everything in the basic tier, distribution and smart grid analysis, active SCADA testing in maintenance windows or test environments, renewable systems review and a grid protection framework. Limits: locations 3, internal hosts 1000 Includes: - Everything in the basic tier - Distribution system and smart grid assessment - Active SCADA testing in agreed windows - Renewable energy system review - Grid protection framework and compliance documentation Excludes: - Custom tooling - Monitoring after delivery - Nuclear facilities - More than 3 sites #### Enterprise Energy Security Solution: $250K Full-scope energy security with custom tools, continuous monitoring, and complete compliance management Limits: locations 8 Excludes: - Remediation engineering or control system replacement - Physical security guarding ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=energy-sector-security ## Event-Specific Security Enhancement Program > From $150K · Specialized & Industry · https://cisomarketplace.services/services/event-specific-security Specialized security packages tailored for specific major events like the Super Bowl, World Series, Kentucky Derby, focusing on unique venue characteristics and event-specific requirements. ### In scope - Event-specific threat assessment - Historical incident analysis - Local coordination planning - Specialized venue security - Event-specific access control - Local threat intelligence - Cultural considerations - Regional security integration ### Deliverables - Event-specific security plan - Local coordination framework - Specialized venue protocols - Cultural sensitivity guidelines - Regional security matrix - Local threat analysis - Event-specific playbooks - After-action documentation ### Tiers #### Core Event Enhancement Package: $150K One named event at 1 venue: event-specific threat assessment, historical incident analysis, local threat intelligence and an event security plan with up to 3 playbooks. One coordination session with local agencies. Limits: locations 1, scenarios 3, sessions 1 Includes: - Event-specific threat assessment - Historical incident analysis - Local threat intelligence summary - Event security plan with up to 3 playbooks - One local coordination session Excludes: - Venue-specific access control design - On-site presence during the event - After-action documentation - Tabletop exercises #### Advanced Event Enhancement Program: $275K One event across up to 2 venues: everything in the basic tier, venue-specific protocols and access control design, a local coordination framework, regional security matrix, up to 6 playbooks and up to 3 sessions including 1 tabletop exercise. Limits: locations 2, scenarios 6, sessions 3 Includes: - Everything in the basic tier - Venue-specific security protocols and access control design - Local coordination framework and regional security matrix - Up to 6 playbooks - One tabletop exercise with local agencies Excludes: - On-site team during event days - Custom coordination tooling - After-action review #### Premium Event Enhancement Solution: $450K One event across up to 4 venues: everything in the advanced tier, custom coordination tooling for local partners, up to 10 playbooks, up to 6 sessions including 2 exercises, on-site advisory presence during event days and after-action documentation. Limits: locations 4, scenarios 10, sessions 6 Includes: - Everything in the advanced tier - Custom local coordination and reporting tooling - On-site advisory team during event days - Two exercises including one full rehearsal - After-action documentation Excludes: - Guard force or physical security staffing - Security equipment and screening hardware - A second event ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=event-specific-security ## Industrial Control Systems Security Program > From $85K · Specialized & Industry · https://cisomarketplace.services/services/industrial-control-systems-security-program End-to-end security program for industrial control systems and operational technology environments, including SCADA systems, PLCs, and industrial IoT devices. ### In scope - ICS network assessment - SCADA system security review - PLC security hardening - Industrial IoT evaluation - OT/IT convergence analysis ### Deliverables - OT security architecture - Network segmentation design - Security controls matrix - Incident response procedures - Compliance documentation - Training materials ### Tiers #### Core ICS Security Program: $85K Program for 1 site: ICS network assessment, SCADA security review, OT security architecture and segmentation design, security controls matrix, OT incident response procedures, and training materials. Monitoring is specified, not deployed. Limits: locations 1, months 4 Includes: - ICS network and SCADA security assessment of 1 site - OT security architecture and network segmentation design - Security controls matrix - OT incident response procedures - Monitoring requirements specification - Staff training materials Excludes: - PLC-level hardening work - Monitoring implementation - IT/OT convergence planning across the corporate network - Additional sites #### Advanced ICS Security Solution: $145K Program for up to 3 sites. Adds PLC configuration analysis and hardening baselines, industrial IoT evaluation, IT/OT convergence plan, OT monitoring implementation with detection use cases, and compliance documentation. Limits: locations 3, months 5 Includes: - Everything in the Core tier, for up to 3 sites - PLC configuration analysis and hardening baselines - Industrial IoT device evaluation - IT/OT convergence plan - OT monitoring implementation and tuning - Compliance documentation set Excludes: - Round-the-clock monitoring operations design - Custom tool development - OT incident response exercises #### Enterprise ICS Security Platform: $225K Program for up to 5 sites. Adds custom tooling for asset discovery or protocol inspection, design and stand-up of 24/7 OT monitoring processes, OT incident response playbooks with 2 exercises, and program governance. More sites are scoped separately. Limits: locations 5, months 6, scenarios 2 Includes: - Everything in the Advanced tier, for up to 5 sites - Custom tooling for asset discovery or protocol inspection - 24/7 OT monitoring process design and stand-up with the client's SOC or provider - OT incident response playbooks and 2 tabletop exercises - Program governance and metrics Excludes: - Staffing of the 24/7 monitoring function - Monitoring licences and hardware - More than 5 sites (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=industrial-control-systems-security-program ## Major International Events Security Program > From $250K · Specialized & Industry · https://cisomarketplace.services/services/major-international-events-security Comprehensive security program for high-profile international sporting events and championships, including multi-venue coordination, international threat intelligence, and large-scale access control systems. ### In scope - Multi-venue security coordination - International threat intelligence integration - Cross-border security operations - VIP protection protocols - Media operations security - International broadcasting security - Transportation network protection - Accommodation security systems - Credentialing system security - Public safety integration - Counter-drone operations - Social media monitoring - Cyber threat detection - Infrastructure protection ### Deliverables - Comprehensive event security architecture - Multi-agency coordination framework - International security protocols - VIP protection strategies - Media security procedures - Broadcast protection systems - Transportation security matrix - Credentialing system design - Public safety integration plan - Counter-drone procedures - Social media monitoring framework - Cyber defense playbook - Infrastructure protection plan - After-action analysis ### Tiers #### Core International Event Security: $250K Essential security program for major events covering basic multi-venue coordination and international security protocols Limits: locations 3 Excludes: - Implementation and on-site delivery - Threat intelligence feeds and social media monitoring - VIP, media and broadcast protection plans - Event-time operations staffing #### Advanced International Event Security: $500K Comprehensive program including detailed threat intelligence, advanced VIP protection, and complete security implementation Limits: locations 8 Excludes: - Real-time monitoring during the event - Custom tooling - Overall security program management office #### Enterprise International Event Security: $1000K Full-scope international event security with custom tools, real-time monitoring, and complete program management for major global events Excludes: - Guard force, protective details and law enforcement functions - Counter-drone and screening equipment - Venue construction or physical works ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=major-international-events-security ## Oil & Gas Cybersecurity Assessment > From $52K · Specialized & Industry · https://cisomarketplace.services/services/oil-gas-cybersecurity-assessment Specialized security assessment for oil and gas operations, addressing the unique challenges of securing upstream, midstream, and downstream operations. Our comprehensive evaluation examines operational technology, SCADA systems, field devices, and IT/OT convergence points while ensuring compliance with industry regulations and standards. ### In scope - OT/ICS security assessment - SCADA system security evaluation - Field device security review - Pipeline monitoring system security - Refinery control system assessment - IT/OT convergence security - Physical security integration - Regulatory compliance verification - Third-party risk assessment - Incident response capability ### Deliverables - Oil & gas security assessment report - OT/ICS security recommendations - SCADA protection strategy - Field device security framework - IT/OT segmentation architecture - Regulatory compliance roadmap - Physical-cyber security integration plan - Critical infrastructure protection strategy - Implementation prioritization ### Tiers #### Essential Oil & Gas Security Assessment: $52K Assessment of 1 operating site in one segment: OT/ICS and SCADA security evaluation, field device review on a sample of up to 25 devices, IT/OT boundary review, incident response capability check, and review against 1 regulatory standard. Limits: locations 1, devices 25, frameworks 1 Includes: - OT/ICS and SCADA security evaluation at 1 site - Field device security review, sample of up to 25 devices - IT/OT convergence point review - Incident response capability check - Regulatory review against 1 standard - Report with implementation prioritization Excludes: - Pipeline monitoring and refinery control system deep-dives - IT/OT segmentation architecture design - Physical security integration - Third-party risk assessment #### Comprehensive Oil & Gas Security Program: $95K Assessment of up to 3 sites across up to 2 segments, up to 75 field devices sampled. Adds pipeline monitoring and refinery control system assessment, IT/OT segmentation architecture, SCADA protection strategy, physical security integration, third-party risk, and a compliance roadmap. Limits: locations 3, devices 75, frameworks 2, vendors 10 Includes: - Everything in the Essential tier, for up to 3 sites - Pipeline monitoring and refinery control system assessment - IT/OT segmentation architecture - SCADA protection strategy - Physical-cyber security integration plan - Third-party risk assessment of up to 10 vendors Excludes: - Implementation support - Security governance model - More than 3 sites #### Enterprise Energy Security Transformation: $150K Full-spectrum security program for large energy operations with custom architecture, implementation support, and governance Limits: locations 5, devices 200, frameworks 3, vendors 25 Excludes: - Remediation hardware and licences - Operations above 5 sites (scoped separately) ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=oil-gas-cybersecurity-assessment ## Satellite Communications Security Assessment > From $55K · Specialized & Industry · https://cisomarketplace.services/services/satellite-communications-security-assessment Advanced security testing for satellite communication systems, ground stations, and related space-based infrastructure. ### In scope - Ground station security testing - Satellite uplink/downlink analysis - Communication protocol review - Signal interference testing - Encryption implementation review - Control system security assessment - Emergency shutdown testing ### Deliverables - SATCOM security report - Signal vulnerability analysis - Protocol security findings - Encryption assessment results - Control system recommendations - Emergency response guidance - 90-day retest period ### Tiers #### Core SATCOM Security Assessment: $55K One ground station and up to 2 satellite links: ground station security testing, control system assessment, communication protocol review and encryption configuration review. SATCOM security report with a retest. Limits: locations 1, devices 10 Includes: - 1 ground station, up to 2 links - Up to 10 ground-segment devices tested - Control system security assessment - Communication protocol review - Encryption configuration review - 90-day retest Excludes: - Signal interference testing - Uplink/downlink RF analysis - Emergency shutdown testing - Additional ground stations #### Advanced SATCOM Security Program: $95K Up to 3 ground stations and up to 5 links: all seven scope items including uplink/downlink analysis, signal interference testing, encryption implementation review, protocol testing and emergency shutdown testing, with up to 25 devices. Limits: locations 3, devices 25 Includes: - Up to 3 ground stations, up to 5 links - Uplink/downlink analysis - Signal interference testing - Encryption implementation review - Emergency shutdown testing - 90-day retest Excludes: - Custom test tooling for proprietary protocols - Monitoring after the assessment - Emergency response support #### Enterprise SATCOM Security Solution: $150K Full-scope SATCOM security including custom testing tools, continuous monitoring, and emergency response Limits: locations 5, devices 50 Excludes: - Testing of on-orbit spacecraft buses - Transmission outside licensed or authorized test windows - Hardware replacement ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=satellite-communications-security-assessment ## Space Systems Security Assessment > From $85K · Specialized & Industry · https://cisomarketplace.services/services/space-systems-security Specialized security assessment for space systems including satellite control systems, ground stations, and space-based communications. ### In scope - Assessment of space system infrastructure - control systems - communication protocols - orbital asset security ### Deliverables - Comprehensive security assessment report - vulnerability analysis - orbital asset protection strategy - remediation plan ### Tiers #### Core Space Systems Assessment: $85K One ground station and 1 mission control system: infrastructure and control system security assessment, communication protocol design review, and threat analysis for orbital assets. Report and remediation plan. Limits: locations 1, devices 1 Includes: - 1 ground station - 1 mission or spacecraft control system - Control system security assessment - Communication protocol design review - Vulnerability analysis and remediation plan Excludes: - RF analysis of uplink and downlink - Hands-on protocol testing - Continuous monitoring - Additional ground stations #### Advanced Space Security Program: $150K Up to 3 ground stations and up to 3 mission control systems: adds RF analysis of uplink, downlink and telemetry links, hands-on command-and-control protocol testing, and an orbital asset protection strategy. Limits: locations 3, devices 3 Includes: - Up to 3 ground stations - Up to 3 mission control systems - RF analysis of command and telemetry links - Hands-on protocol testing - Orbital asset protection strategy Excludes: - Custom test tooling - Continuous monitoring - Constellation-wide coverage #### Enterprise Space Security Solution: $250K Full-scope space systems security program including custom tools and continuous monitoring Excludes: - Live testing against on-orbit assets without operator authorization - Launch vehicle security - Hardware replacement ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=space-systems-security ## Stadium and Sports Team Security Program > From $65K · Specialized & Industry · https://cisomarketplace.services/services/stadium-sports-security Advanced security assessment for sports venues and professional teams, covering facility infrastructure, game-day operations, and team asset protection. ### In scope - Stadium infrastructure security - Game-day operations protection - Team travel security - Player data protection - Fan engagement system security - Ticketing system security ### Deliverables - Venue security architecture - Game-day security procedures - Team security framework - Data protection strategy - Emergency response plans - Access control system design ### Tiers #### Core Stadium Security Assessment: $65K Essential stadium and team security covering basic infrastructure and game-day operations #### Advanced Stadium Security Program: $110K Comprehensive assessment including detailed venue analysis and complete security implementation #### Enterprise Stadium Security Solution: $175K Full-scope stadium and team security with custom tools, continuous monitoring, and complete program management ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=stadium-sports-security ## Telecommunications Infrastructure Security Program > From $85K · Specialized & Industry · https://cisomarketplace.services/services/telecommunications-infrastructure Advanced security assessment for telecommunications infrastructure, including 5G networks, fiber optics, and cellular systems. ### In scope - 5G network security assessment - Core network protection - Radio access network testing - Fiber infrastructure security - Cellular system hardening ### Deliverables - Telecom security architecture - Network protection strategy - Infrastructure security analysis - Monitoring framework - Emergency response procedures ### Tiers #### Core Telecom Security Assessment: $85K One core site and up to 50 network elements: core network security assessment, configuration review of 5G or cellular core functions, management-plane access review and fiber infrastructure review. Architecture and protection strategy. Limits: locations 1, internal hosts 50 Includes: - 1 core site, up to 50 network elements - Core network security assessment - Core function configuration review - Management-plane access review - Telecom security architecture Excludes: - Radio access network testing - Hands-on signalling and interconnect testing - Custom tooling - Hardening work #### Advanced Telecom Security Program: $145K Up to 3 sites and up to 250 network elements: all five scope areas including RAN testing at sampled cell sites, signalling and interconnect testing, fiber infrastructure security, plus the monitoring framework and emergency response procedures. Limits: locations 3, internal hosts 250 Includes: - Up to 3 sites, up to 250 network elements - Radio access network testing - Signalling and interconnect testing - Monitoring framework - Emergency response procedures Excludes: - Custom protection tooling - Hands-on hardening of network elements - Network-wide coverage #### Enterprise Telecom Security Solution: $225K No fixed cap on sites or network elements (scoped at kickoff): Advanced scope plus custom detection tooling for signalling and core traffic, hands-on hardening of cellular and core systems with the operator's engineers, and one retest. Includes: - Sites and elements scoped at kickoff - Custom detection tooling - Hands-on hardening with operator engineers - One retest - Everything in the Advanced tier Excludes: - Vendor equipment replacement - 24/7 monitoring operations - Lawful-intercept system review unless separately authorized ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=telecommunications-infrastructure ## Transportation Systems Security Program > From $70K · Specialized & Industry · https://cisomarketplace.services/services/transportation-systems Advanced security assessment for transportation infrastructure, including rail systems, traffic management, and logistics networks. ### In scope - Rail system security - Traffic management systems - Logistics network protection - Fleet management security - Signal system assessment ### Deliverables - Transportation security architecture - Network protection strategy - System security analysis - Safety integration framework - Emergency procedures ### Tiers #### Core Transportation Security Assessment: $70K One system type (e.g. traffic management) at 1 operations center: security assessment of control systems and supporting networks, up to 25 field devices sampled. Security architecture and network protection strategy. Limits: locations 1, devices 25 Includes: - 1 transport system type - 1 operations center - Up to 25 field devices sampled - Transportation security architecture - Network protection strategy Excludes: - Signal system assessment - Safety integration framework - Additional system types - Hardening work #### Advanced Transportation Security Program: $120K Up to 3 system types across up to 3 sites, up to 100 field devices sampled: adds signal system assessment, fleet and logistics network review, a safety integration framework and emergency procedures. Limits: locations 3, devices 100 Includes: - Up to 3 system types, up to 3 sites - Signal system assessment - Fleet and logistics network review - Safety integration framework - Emergency procedures Excludes: - Custom protection tooling - Hands-on hardening - Network-wide coverage #### Enterprise Transportation Security Solution: $185K All five scope areas with no fixed site or device cap (scoped at kickoff): Advanced scope plus custom detection tooling for control and signalling networks, hands-on hardening with the operator's engineers, and one retest. Includes: - All five system types - Sites and devices scoped at kickoff - Custom detection tooling - Hands-on hardening with operator engineers - One retest Excludes: - Safety certification of signalling systems - Equipment replacement - 24/7 monitoring operations ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=transportation-systems ## Dark Web & Credential Exposure Monitoring > From $500 / mo · Specialized & Industry · https://cisomarketplace.services/services/dark-web-credential-exposure-monitoring Stolen credentials and infostealer logs are the most common way in. We monitor breach corpuses, infostealer markets, paste sites and criminal forums for your domains, executives and key vendors, validate what we find, and tell you what to reset and why — analyst-reviewed alerts rather than a raw feed. ### In scope - Domain and email credential exposure monitoring - Infostealer log and session-cookie exposure - Executive and VIP personal-email monitoring - Criminal forum and marketplace mentions - Analyst validation and response guidance ### Deliverables - Validated exposure alerts - Monthly exposure report - Password-reset and session-revocation guidance - Quarterly threat briefing ### Tiers #### Essential Exposure Monitoring: $500 / month One primary domain: credential and breach monitoring with monthly report Limits: domains 1 #### Advanced Exposure Monitoring: $1.5K / month Up to 5 domains plus 10 executives: adds infostealer and session exposure, forum mentions and 24-hour alerting Limits: domains 5, subjects 10 #### Enterprise Exposure Monitoring: $4K / month Unlimited domains, key vendors and VIPs: adds takedown coordination, brand impersonation monitoring and analyst on call Limits: domains 50, subjects 50 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=dark-web-credential-exposure-monitoring ## Domain Profiler (OSINT) External > From $2.5K · Specialized & Industry · https://cisomarketplace.services/services/domain-profiler-osint Domain Profiler (OSINT) - External is a tool that provides a comprehensive footprint analysis of your domain, identifying exposed data and vulnerabilities across multiple public sources. ### In scope - Public DNS records discovery - Domain exposure footprint - Third-party data analysis - External asset mapping - Threat landscape snapshot ### Deliverables - OSINT Domain Footprint Report - Asset inventory list - Exposure findings summary - Remediation recommendations ### Tiers #### Basic Domain Profile: $2.5K Passive external footprint of 1 root domain and its subdomains: public DNS records, externally visible hosts and services from public sources, third-party data exposure, asset inventory and findings summary with remediation steps. Limits: domains 1 Includes: - DNS record and subdomain discovery for 1 root domain - External asset inventory list - Third-party and public source exposure findings - Threat landscape snapshot - Footprint report with remediation recommendations Excludes: - Active vulnerability scanning or penetration testing - Additional domains, brands or subsidiaries - Cross-domain correlation of shared infrastructure - Ongoing monitoring after delivery #### Premium Domain Profile: $5K Passive external footprint of up to 5 root domains with their subdomains, plus cross-domain correlation of shared infrastructure, lookalike domain check, per-domain findings and one consolidated asset inventory with a readout call. Limits: domains 5 Includes: - Everything in the basic tier for up to 5 root domains - Cross-domain correlation of shared hosts and providers - Lookalike and typosquat domain check - Consolidated asset inventory - One findings readout call Excludes: - Active vulnerability scanning or penetration testing - More than 5 root domains - Ongoing monitoring after delivery ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=domain-profiler-osint ## Healthcare & University OSINT Assessment > From $6.5K · Specialized & Industry · https://cisomarketplace.services/services/healthcare-university-osint Sector-specific OSINT assessment focused on healthcare institutions and universities, providing exposure analysis and external threat mapping. ### In scope - Healthcare data exposure review - University open-source intelligence scan - Research asset mapping - Public exposure snapshot - Sector-specific threat assessment ### Deliverables - Sector-Specific OSINT Report - Exposure findings - Risk mitigation strategies ### Tiers #### Healthcare Assessment: $6.5K Passive OSINT for one healthcare organization with up to 3 root domains and up to 5 facilities: exposed patient-data indicators, clinical and staff portal exposure, leaked staff credentials, vendor-related exposure, and healthcare threat actor activity. Limits: domains 3, locations 5 Includes: - Healthcare data exposure review - External asset and portal mapping for up to 3 root domains - Leaked staff credential search - Healthcare sector threat assessment - Sector-specific report with mitigation strategies Excludes: - Active scanning or penetration testing - Medical device security testing - Compliance assessment of any kind - Health systems with more than 5 facilities #### University Assessment: $6.5K Passive OSINT for one academic institution with up to 3 root domains and up to 5 campuses: research asset mapping, exposed student and faculty data, departmental shadow IT on subdomains, leaked credentials, and academic-sector threat activity. Limits: domains 3, locations 5 Includes: - University open-source intelligence scan - Research asset and lab exposure mapping - Departmental subdomain and shadow IT discovery - Leaked student and faculty credential search - Sector-specific report with mitigation strategies Excludes: - Active scanning or penetration testing - Assessment of individual researchers or executives - Compliance assessment of any kind - University systems with more than 5 campuses ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=healthcare-university-osint ## Mergers & Acquisitions OSINT Pre-Assessment > From $15K · Specialized & Industry · https://cisomarketplace.services/services/mergers-acquisitions-osint-assessment Provides critical pre-acquisition intelligence by assessing a target organizations public exposure, risks, and external footprint before finalizing M&A deals. ### In scope - Public exposure analysis - Reputation risk discovery - Corporate footprint mapping - Intellectual property exposure check - Third-party risk assessment ### Deliverables - M&A OSINT Pre-Assessment Report - Risk profile - Exposure overview - Remediation guidance ### Tiers #### Standard Pre-Assessment: $15K Outside-in OSINT on 1 target company with up to 5 root domains: public exposure, reputation risk, corporate footprint, IP exposure check and visible third-party risk. No access to target systems, staff or documents. Limits: subjects 1, domains 5 Includes: - Public exposure and external footprint analysis - Breach history and reputation risk discovery - Intellectual property exposure check - Visible third-party and supplier risk - Pre-assessment report with risk profile and remediation guidance Excludes: - Access to target systems, documents or data room - Stakeholder interviews - Active scanning or penetration testing - Remediation cost estimates #### Multi-Target Pre-Assessment: $40K Outside-in OSINT on up to 3 target companies with up to 15 root domains in total: a separate report per target plus a side-by-side risk comparison for the deal team. No access to target systems, staff or documents. Limits: subjects 3, domains 15 Includes: - Standard pre-assessment for up to 3 targets - Separate report and risk profile per target - Side-by-side risk comparison - One deal-team briefing Excludes: - Access to target systems, documents or data room - Stakeholder interviews - Active scanning or penetration testing - More than 3 targets ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=mergers-acquisitions-osint-assessment ## Name Your Price: OSINT Assessment > Scoped per engagement · Specialized & Industry · https://cisomarketplace.services/services/name-your-price-osint Custom OSINT assessment service where clients can define their needs and budget, allowing for a flexible and tailored open-source intelligence project. ### In scope - Flexible OSINT research - Customizable deliverables - Budget-aligned services - Client-specified focus areas ### Deliverables - Custom OSINT Report - Client-defined outputs ### Tiers #### Custom OSINT Service: scoped Buyer states the focus areas and budget; a written scope fixes the analyst hours, sources and deliverable before work starts. Passive open-source research only, by one OSINT consultant. No fixed cap - every limit is set at scoping. Includes: - Scoping call and written scope statement - Passive open-source research on client-specified focus areas - Custom OSINT report in the agreed format - Hours and deliverables matched to the agreed budget Excludes: - Active scanning, social engineering or any intrusive testing - Work outside the written scope statement - Ongoing monitoring unless written into the scope ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=name-your-price-osint ## Retail OSINT Assessment > From $4.5K · Specialized & Industry · https://cisomarketplace.services/services/retail-osint-assessment Security threat landscape analysis designed for retail organizations, identifying public exposure, risks, and digital vulnerabilities. ### In scope - Retail asset inventory - Customer data exposure check - Social media risk analysis - Publicly available threat identification - Competitor intelligence snapshot ### Deliverables - Retail OSINT Threat Report - Risk summary - Mitigation recommendations ### Tiers #### Single Store Assessment: $4.5K Passive OSINT for 1 store location under 1 brand and 1 root domain: retail asset inventory, customer data exposure check, social media risk analysis, public threat identification and a competitor snapshot. Limits: locations 1, domains 1 Includes: - Retail asset inventory for 1 location and 1 domain - Customer data exposure check - Social media risk analysis - Competitor intelligence snapshot - Threat report with mitigation recommendations Excludes: - Additional stores, brands or domains - Active scanning or penetration testing - Point-of-sale or in-store network testing - Ongoing brand monitoring #### Chain Assessment: $12K Passive OSINT for up to 25 store locations and up to 5 brands or root domains: per-brand asset inventory, customer data exposure, brand impersonation and social media risk across the chain, and a consolidated threat report. Larger chains are scoped separately. Limits: locations 25, domains 5 Includes: - Everything in the single tier across up to 25 locations - Per-brand asset inventory for up to 5 domains - Brand impersonation and fake storefront check - Consolidated risk summary with per-brand findings - One findings readout call Excludes: - Active scanning or penetration testing - Point-of-sale or in-store network testing - Ongoing brand monitoring - More than 25 locations ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=retail-osint-assessment ## Celebrity Complete Protection Assessment > From $125K · Specialized & Industry · https://cisomarketplace.services/services/celebrity-complete-protection-assessment Comprehensive 360° security assessment designed specifically for high-profile celebrities, public figures, and ultra-high-net-worth individuals. Our integrated approach addresses the unique vulnerabilities where personal, professional, and public lives intersect, providing holistic protection across digital, physical, and reputational domains to safeguard your privacy, safety, and public image. ### In scope - Residential security evaluation - Smart home technology security assessment - Personal digital device hardening - Family protection framework - Business entity security review - Production company IP protection - Wealth management security assessment - Social media and online presence hardening - Media relationship security protocols - Event security planning framework - Digital communications encryption - Transportation security protocols - Stalker and threat management - Personal staff security vetting - Location data privacy controls - Content protection strategies - Personal cloud security architecture - Crisis management planning - Travel security assessment - Global residence security integration ### Deliverables - Comprehensive security architecture blueprint - Domain-specific security vulnerability reports - Cross-domain threat modeling documentation - Visual security dashboard for all properties and platforms - Prioritized remediation roadmap - Security vendor selection recommendations - Technical implementation support plan - Staff and family security training materials - 90-day implementation verification process - Privacy-enhanced lifestyle design guide - Crisis management playbook - Security team integration framework - Technical and executive security summaries - Photographic documentation of physical vulnerabilities - Secure communications implementation guide ### Tiers #### Complete Protection Assessment: $125K One principal plus family, up to 5 people, up to 2 residences and up to 25 personal devices. Assessment across residence, smart home, devices, online presence, business entities, staff and travel, with a remediation roadmap. Includes a verification check afterwards. Limits: subjects 5, locations 2, devices 25 Includes: - On-site evaluation of up to 2 residences including smart home systems - Hardening plan for up to 25 personal devices and cloud accounts - Social media, location privacy and stalker threat review - Business entity and personal staff vetting review - Crisis management playbook and 90-day verification Excludes: - Hands-on implementation of remediation - Ongoing monitoring and threat intelligence - Global travel security operations - Reassessments #### Premium Protection Program: $175K Up to 8 people, up to 3 residences and up to 50 devices: everything in the standard tier, hands-on implementation support, integration with the existing security team, and 12 months of monitoring and threat intelligence during business hours. Limits: subjects 8, locations 3, devices 50, months 12 Includes: - Everything in the standard tier - Hands-on implementation support for the roadmap - Security team integration framework - 12 months of online monitoring and threat intelligence - Staff and family security training Excludes: - 24/7 monitoring by a dedicated operations center - Global travel security support - Quarterly reassessments - Physical protection personnel #### Elite Protection System: $250K Complete protection ecosystem with dedicated security operation center, 24/7 monitoring, global travel security, and quarterly reassessments Limits: subjects 10, locations 5, devices 100, sessions 4 Excludes: - Bodyguards or armed protection personnel - Security hardware and installation costs - Legal representation ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=celebrity-complete-protection-assessment ## Executive & Family Digital Protection Subscription > From $3.5K / yr · Specialized & Industry · https://cisomarketplace.services/services/executive-family-digital-protection-subscription Executives, founders and high-net-worth families are targeted through their personal lives, not the corporate network. This per-person annual subscription removes them from data brokers and people-search sites and keeps them removed, monitors the dark web and social platforms for exposure and impersonation, hardens personal devices and accounts, and gives the family a named specialist to call. It is the continuous form of the one-time executive OSINT and VIP assessments. ### In scope - Data-broker and people-search removal, re-checked continuously - Dark-web, breach and impersonation monitoring - Personal account and device hardening - Home network review - Named specialist for incidents and questions ### Deliverables - Initial exposure report - Quarterly removal and exposure report - Hardened accounts and devices checklist - Incident support when something surfaces ### Tiers #### Essential Protection: $3.5K / year Per person, per year: data-broker removal, breach and impersonation monitoring, account hardening Limits: subjects 1 #### Advanced Protection: $7.5K / year Per principal, per year, covering the principal plus up to 3 family members: adds device and home-network hardening and social media lock-down. Limits: subjects 4 #### Enterprise / Family Office Protection: $15K / year Per principal, per year: adds a full OSINT baseline, travel briefings, household staff guidance and priority incident response Limits: subjects 10 ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=executive-family-digital-protection-subscription ## Executive Management OSINT Risk Assessment > From $750 · Specialized & Industry · https://cisomarketplace.services/services/executive-management-osint-risk-assessment Detailed Open Source Intelligence (OSINT) assessment for executive teams and business leaders, identifying and analyzing public digital footprints and potential security risks. ### In scope - Public records - Social media presence - Corporate affiliations - Speaking engagements - Publications - Personal and family connections - Asset ownership - Online activities - Dark web and breach exposure search - Executive team roll-up report (when several executives are assessed) ### Deliverables - Executive risk profile - Digital exposure report - Privacy enhancement recommendations - Security posture assessment - Travel security guidelines - Family protection recommendations - Digital footprint reduction plan - Ongoing monitoring recommendations ### Tiers #### Rapid Exposure Assessment: $750 One executive, 1 analyst hour: a time-boxed search for immediately discoverable information (addresses, phones, emails, social accounts) delivered as a short exposure summary. No removal guidance beyond top findings. Limits: subjects 1, hours 1 Includes: - 1-hour time-boxed open-source search - Exposure summary of 1-2 pages - Top findings flagged by severity Excludes: - Public records and asset ownership research - Family members - Removal instructions per finding - Monitoring #### Basic Check: $2.5K One executive: home address, phone numbers, email accounts, social media, public records, affiliations and asset ownership, with a risk profile and step-by-step removal and protection instructions the client carries out. 12 analyst hours. Limits: subjects 1, hours 12 Includes: - Digital exposure report for 1 executive - Executive risk profile - Public records, affiliations and asset ownership research - Step-by-step removal and privacy instructions - Travel security guidelines Excludes: - Family members - Alerts for new exposures - Removal requests submitted on the client's behalf - Reassessment #### Family Shield: $4.5K One executive plus up to 4 family members: everything in Basic for each person, family protection recommendations, alerts for new information leaks, and guided protection steps for 3 months. 22 analyst hours. Limits: subjects 5, hours 22, months 3 Includes: - Everything in Basic - Exposure review for up to 4 family members - Family protection recommendations - New-exposure alerts for 3 months - Guided protection steps for 3 months Excludes: - Removal requests submitted on the client's behalf - Emergency response to new exposures - Quarterly reassessments #### Complete Protection: $7.5K One executive plus up to 4 family members for 12 months: removal requests submitted on the client's behalf, continuous monitoring, emergency response to new exposures, and 4 quarterly reassessments. 40 analyst hours. Limits: subjects 5, hours 40, months 12, sessions 4 Includes: - Everything in Family Shield - Removal and opt-out requests handled for the client - Continuous monitoring for 12 months - Emergency response to new exposures - 4 quarterly reassessments Excludes: - Physical security or executive protection staffing - Device hardening and home network work - Guaranteed removal from sources that refuse requests ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=executive-management-osint-risk-assessment ## High Net Worth Individual Assessment > From $5K · Specialized & Industry · https://cisomarketplace.services/services/high-net-worth-individual-assessment Tailored security assessment for high-net-worth individuals covering physical security, digital privacy, and personal cybersecurity measures to protect assets and maintain privacy. ### In scope - Digital footprint - Personal devices - Home network - Travel security - Asset protection - Family security ### Deliverables - Threat assessment report - Privacy protection plan - Security protocol documentation - Digital security guide - Travel security procedures - Emergency response plan ### Tiers #### Core HNWI Security Assessment: $5K Assessment for 1 principal: digital footprint and data-broker exposure review, up to 5 personal devices, 1 home network, account security review, and a written threat assessment with privacy protection plan. Limits: subjects 1, locations 1, devices 5 Includes: - Digital footprint and data-broker exposure report for 1 person - Security review of up to 5 personal devices - Home network review at 1 residence (remote) - Account, email and password-manager hardening guide - Threat assessment report and privacy protection plan Excludes: - Family members and household staff - Additional residences and on-site physical security walk-through - Travel security procedures - Ongoing monitoring #### Advanced HNWI Protection Program: $8.5K Covers the principal plus family, up to 4 people, up to 2 residences and up to 15 devices. Adds family member footprint reviews, on-site estate/home network and physical security assessment, data-broker removal requests, and an emergency response plan. Limits: subjects 4, locations 2, devices 15 Includes: - Everything in the Core tier, for up to 4 people - On-site network and physical security assessment of up to 2 residences - Data-broker opt-out and removal requests - Family security protocols, including minors' social media exposure - Emergency response plan Excludes: - Family office systems and staff - Travel security procedures and pre-trip briefings - Ongoing digital monitoring #### Elite HNWI Security Solution: $15K Full-scope security program including family office protection, travel security, and 24/7 digital monitoring Limits: subjects 8, locations 4, devices 30 Excludes: - Physical protective details / bodyguard services - Incident response retainer ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=high-net-worth-individual-assessment ## Smart Home Security Assessment > From $2.5K · Specialized & Industry · https://cisomarketplace.services/services/smart-home-security-assessment Comprehensive evaluation of your smart home ecosystem security, including IoT devices, network infrastructure, and automation systems to identify vulnerabilities and provide hardening recommendations. ### In scope - Smart home devices - Home automation systems - Network infrastructure - Security cameras - Smart locks - Voice assistants ### Deliverables - Detailed device inventory - Vulnerability assessment report - Network security analysis - Privacy impact assessment - Security recommendations - Implementation roadmap ### Tiers #### Core Smart Home Assessment: $2.5K One residence with up to 25 connected devices: device inventory, home network and WiFi review, configuration checks on cameras, locks, voice assistants and the automation hub, and a written report with recommendations. Limits: locations 1, devices 25 Includes: - 1 residence, up to 25 devices - Device inventory - Home network and WiFi security analysis - Camera, lock and hub configuration checks - Recommendations report Excludes: - Hands-on device vulnerability testing - Privacy impact assessment - Configuration changes made for you - Follow-up support #### Advanced Smart Home Security: $4.5K One residence with up to 50 devices: adds hands-on vulnerability testing of devices, network segmentation and secure configurations applied by the team, and a privacy impact assessment of cameras, voice assistants and vendor cloud accounts. Limits: locations 1, devices 50 Includes: - 1 residence, up to 50 devices - Hands-on device testing - Network segmentation configured - Privacy impact assessment - Implementation roadmap Excludes: - Monitoring setup - Support after handover - Second residence #### Premium Smart Home Protection: $7.5K Full-scope smart home security program with custom monitoring setup, advanced automation security, and ongoing support Limits: locations 2, devices 100 Excludes: - Hardware purchase - Personal digital footprint or account review ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smart-home-security-assessment ## Smart Office Security Assessment > From $8.5K · Specialized & Industry · https://cisomarketplace.services/services/smart-office-security-assessment Comprehensive security evaluation for modern smart offices, including shared spaces and multi-tenant buildings. Covers IoT devices, access control systems, and network infrastructure security. ### In scope - Physical access controls - Smart building systems - Shared infrastructure - IoT devices - Environmental controls - Surveillance systems - Visitor management systems - Emergency response systems ### Deliverables - Detailed security architecture review - IoT vulnerability assessment - Access control audit - Smart building systems security report - Multi-tenant security recommendations - Remediation roadmap - Security policy templates - Staff training guidelines ### Tiers #### Core Smart Office Assessment: $8.5K One office with up to 50 connected devices: physical access control audit, IoT configuration and network exposure review, and shared infrastructure review. Report, remediation roadmap and policy templates. Limits: locations 1, devices 50 Includes: - 1 office, up to 50 devices - Access control audit - IoT configuration review - Shared infrastructure review - Remediation roadmap - Security policy templates Excludes: - Hands-on IoT exploitation testing - Multi-tenant isolation testing - Emergency response and environmental controls - Re-validation #### Advanced Smart Office Security: $15K One office or multi-tenant floor plate with up to 100 devices: all eight scope areas, hands-on IoT testing, tenant isolation testing on shared networks, badge and visitor system analysis, and staff training guidelines. Limits: locations 1, devices 100 Includes: - 1 location, up to 100 devices - All eight scope areas - Hands-on IoT testing - Multi-tenant isolation testing - Visitor and badge system analysis - Staff training guidelines Excludes: - Building automation protocol testing - Monitoring setup - Re-validation after fixes - Additional locations #### Enterprise Smart Office Program: $25K Full-scope smart office security including custom monitoring, advanced building automation security, and continuous validation Limits: locations 3, devices 250, sessions 2 Excludes: - Corporate IT network penetration test - Hardware replacement ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smart-office-security-assessment ## Social Media Influencer Risk Assessment > From $3K · Specialized & Industry · https://cisomarketplace.services/services/social-media-influencer-risk-assessment Comprehensive security and privacy assessment for social media influencers, focusing on digital presence protection, reputation management, and personal security measures. ### In scope - Social media accounts - Personal brand assets - Digital communications - Content management systems - Collaboration platforms - Payment systems ### Deliverables - Digital presence audit report - Privacy enhancement plan - Account security recommendations - Crisis management playbook - Brand protection strategy - Security awareness training ### Tiers #### Core Influencer Protection: $3K Essential digital presence protection covering basic account security, privacy assessment, and brand monitoring #### Advanced Influencer Security: $5.5K Comprehensive protection including detailed privacy controls, crisis management planning, and advanced monitoring #### Premium Influencer Protection: $9K Full-scope protection program with 24/7 monitoring, complete brand protection, and custom security tools ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=social-media-influencer-risk-assessment ## Insider Threat Assessment > From $35K · Specialized & Industry · https://cisomarketplace.services/services/insider-threat-assessment Comprehensive evaluation of your organization's ability to prevent, detect, and respond to threats originating from within. Our assessment examines technical controls, behavioral indicators, access management, and organizational culture to identify and mitigate insider risks. ### In scope - Privileged access review - Data loss prevention assessment - User behavior analytics evaluation - Authorization control review - Separation of duties analysis - Logging and monitoring capabilities - Insider threat program evaluation - HR policy review ### Deliverables - Insider risk assessment report - Control gap analysis - Insider threat program roadmap - Behavioral indicator framework - Technical control recommendations - Policy enhancement guide - Insider threat detection playbook ### Tiers #### Essential Insider Risk Assessment: $35K Insider risk assessment for up to 500 employees: privileged access review, authorization and separation-of-duties analysis for up to 3 critical systems, logging and monitoring capability review, HR policy review, and a control gap report. Limits: employees 500 Includes: - Privileged access review - Authorization and separation-of-duties analysis for up to 3 critical systems - Logging and monitoring capability review - HR and offboarding policy review - Insider risk assessment report and control gap analysis Excludes: - DLP and user behavior analytics evaluation - Insider threat program design - Detection playbook - Culture assessment #### Comprehensive Insider Threat Program: $60K Insider risk assessment for up to 2,500 employees and up to 10 critical systems. Adds DLP assessment, user behavior analytics evaluation, existing program evaluation, behavioral indicator framework, program roadmap, and a detection playbook. Limits: employees 2500 Includes: - Everything in the Essential tier, for up to 10 critical systems - Data loss prevention assessment - User behavior analytics evaluation - Behavioral indicator framework - Insider threat program roadmap - Insider threat detection playbook Excludes: - Custom analytics and detection rule development - Integration of monitoring tools - Organizational culture assessment #### Enterprise Insider Risk Management: $95K No fixed headcount cap - scoped to the organization. Adds custom detection analytics (up to 15 use cases) in the client's SIEM/UBA, integration of HR, access and DLP signals into monitoring, and an organizational culture assessment with staff interviews. Includes: - Everything in the Comprehensive tier - Up to 15 custom insider detection use cases built in the client's tooling - Integration design for HR, identity and DLP signals - Organizational culture assessment with surveys and interviews - Governance model with legal, HR and security roles Excludes: - Monitoring tool licences - Ongoing insider threat analyst staffing - Individual employee investigations ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=insider-threat-assessment ## SMB Remote Workforce > From $4.5K · Specialized & Industry · https://cisomarketplace.services/services/smb-remote-workforce Security assessment focused on distributed workforce risks. ### In scope - VPN configuration review - MDM policy assessment - Cloud app security review - Remote access controls - Endpoint security check - Data loss prevention review - Remote worker security survey ### Deliverables - Remote security assessment report - MDM configuration guide - Cloud security checklist - Remote worker security guide - 1-hour findings review ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-remote-workforce ## SMB Security Starter > From $1.5K · Specialized & Industry · https://cisomarketplace.services/services/smb-security-starter Entry-level automated security assessment for micro-businesses and startups. ### In scope - External vulnerability scan (up to 128 IPs) - Automated web application scan (1 domain) - SSL/TLS configuration check - Basic DNS security review - Open source intelligence gathering ### Deliverables - PDF executive summary - Automated scan results - Basic remediation checklist - 15-minute findings review call ### Terms Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW. Scope this engagement: https://cisomarketplace.services/scope?service=smb-security-starter --- # AI services Fixed-price reports from our AI engine for small, well-defined jobs. You answer a short form or upload a document; the report appears on screen, in the member portal and by an emailed link. A failed run is refunded. A practitioner's review can be added to any report. Nothing here tests or touches your systems. ## Security Check: Personal & home Your accounts, devices, home network and family online. - Page: https://cisomarketplace.services/ai-services/security-check?topic=personal - Price: $29 per report, or 29 credits; included with membership ## Security Check: Compliance readiness Which frameworks apply, where you stand, and the path to a report. - Page: https://cisomarketplace.services/ai-services/security-check?topic=compliance - Price: $79 per report, or 79 credits; included with membership ## Security Check: AI governance How your AI system classifies under the frameworks that matter, and the gaps. - Page: https://cisomarketplace.services/ai-services/security-check?topic=ai-governance - Price: $99 per report, or 99 credits; included with membership ## Security Check: Vendor risk One vendor's access and assurance, and the terms to require. - Page: https://cisomarketplace.services/ai-services/security-check?topic=vendor-risk - Price: $49 per report, or 49 credits; included with membership ## Security Check: IoT & devices Cameras, controllers and connected devices: exposure and fixes. - Page: https://cisomarketplace.services/ai-services/security-check?topic=iot - Price: $49 per report, or 49 credits; included with membership ## SOW review Scope, pricing read, red flags and the questions to ask before you sign. - Page: https://cisomarketplace.services/ai-services/documents?item=sow - Price: $49 per report, or 49 credits; included with membership ## Contract review A vendor contract read for the buyer: risk, SLAs, lock-in and where to push back. - Page: https://cisomarketplace.services/ai-services/documents?item=contract - Price: $79 per report, or 79 credits; included with membership ## AI vendor due diligence How their AI is built, where it runs, what happens to your data, and what to ask. - Page: https://cisomarketplace.services/ai-services/documents?item=ai-vendor - Price: $99 per report, or 99 credits; included with membership ## Questionnaire answers Answers to a customer's security questionnaire, drawn only from your own material. - Page: https://cisomarketplace.services/ai-services/documents?item=questionnaire - Price: $99 per report, or 99 credits; included with membership ## Website documents check Which of privacy, terms, cookies, EULA, refunds, accessibility and security.txt you need. - Page: https://cisomarketplace.services/ai-services/policies?item=website - Price: $49 per report, or 49 credits; included with membership ## Policy draft One security policy, drafted for your size, industry and frameworks. - Page: https://cisomarketplace.services/ai-services/policies?item=policy - Price: $39 per report, or 39 credits; included with membership ## Board risk summary Your notes, turned into a board-ready cyber risk memo. - Page: https://cisomarketplace.services/ai-services/board-summary - Price: $79 per report, or 79 credits; included with membership