{ "name": "CISO Marketplace Services", "url": "https://cisomarketplace.services/", "generated_at": "2026-10-07T03:30:16.930Z", "currency": "USD", "terms": "Prices are published starting prices (the lowest published tier). A written proposal fixes scope, tier and price before anything is signed. Timelines and staffing are set per engagement in the SOW; none are published here. There is no percentage member discount on services. Members get engagement coupons from the coupon book (setup-fee waivers, travel stipends, booking-rate codes), applied by code and capped per year. An AI agent may quote indicatively through the MCP servers or the hub agent API; guardrails are enforced server-side, every agent quote is indicative, and agents never set or change a price.", "count": 182, "services": [ { "slug": "devsecops-pipeline-testing", "title": "DevSecOps Pipeline Testing", "url": "https://cisomarketplace.services/services/devsecops-pipeline-testing", "md_url": "https://cisomarketplace.services/services/devsecops-pipeline-testing.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Comprehensive security testing integrated into your development pipeline with regular assessments.", "from_price_usd": 12000, "price_cadence": "month", "tiers": [ { "id": "standard", "name": "Standard", "price_usd": 12000, "description": "Monthly subscription covering up to 10 repositories with their CI/CD pipelines and up to 25 developers: daily automated pipeline security checks and weekly container image scan findings. No manual code review.", "includes": [ "Up to 10 repositories and their pipelines", "Daily pipeline security report", "Weekly container scan findings", "Triage of scanner results to cut false positives" ], "excludes": [ "Bi-weekly manual code review", "Fixing findings in your code", "Penetration testing of deployed applications" ], "limits": { "repositories": 10, "developers": 25 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": 20000, "description": "Monthly subscription covering up to 25 repositories with their CI/CD pipelines and up to 75 developers: daily pipeline checks, weekly container scans, plus a manual security code review of changed code on a cadence agreed at kickoff.", "includes": [ "Up to 25 repositories and their pipelines", "Daily pipeline security report", "Weekly container scan findings", "Bi-weekly manual code review report", "Review call with engineering leads each cycle" ], "excludes": [ "Fixing findings in your code", "Penetration testing of deployed applications", "Scanner/tool licence costs" ], "limits": { "repositories": 25, "developers": 75 } } ], "scope": [ "CI/CD pipeline security", "Container security", "Code security" ], "deliverables": [ "Daily pipeline security reports", "Weekly container scan findings", "Bi-weekly code review reports" ], "scope_url": "https://cisomarketplace.services/scope?service=devsecops-pipeline-testing" }, { "slug": "blockchain-contact-analysis-service", "title": "Blockchain Contact Analysis Service", "url": "https://cisomarketplace.services/services/blockchain-contact-analysis-service", "md_url": "https://cisomarketplace.services/services/blockchain-contact-analysis-service.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "In-depth analysis of blockchain contacts and transactions to trace asset movement, identify patterns, and assess security risks in cryptocurrency operations.", "from_price_usd": 4200, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Contact Analysis", "price_usd": 4200, "description": "Up to 5 wallet addresses on a single chain: transaction history, direct counterparties, exchange relationships and a risk score per contact. Output is a contact risk report and flow diagram.", "includes": [ "Transaction history for up to 5 addresses on 1 chain", "Direct counterparty and exchange identification", "Risk score per contact", "Contact risk report with flow diagram" ], "excludes": [ "Cross-chain and bridge tracing", "Smart contract interaction analysis", "Sworn declarations or expert witness work", "Ongoing monitoring" ], "limits": { "wallets": 5 } }, { "id": "advanced", "name": "Advanced Contact Analysis", "price_usd": 8500, "description": "Up to 20 wallet addresses across up to 3 chains: everything in the basic tier, cross-chain and bridge tracing, smart contract interaction analysis, multi-hop counterparty mapping and scored risk with mitigation recommendations.", "includes": [ "Everything in the basic tier", "Cross-chain and bridge tracing on up to 3 chains", "Smart contract interaction analysis", "Multi-hop network visualization map", "Risk mitigation and compliance recommendations" ], "excludes": [ "Ongoing monitoring and alerting", "Mixer analysis", "Expert witness reports or testimony" ], "limits": { "wallets": 20 } }, { "id": "premium", "name": "Premium Contact Analysis", "price_usd": 15000, "description": "Full-scope analysis with custom monitoring tools and complete network mapping", "includes": [], "excludes": [ "Expert witness reports, depositions or testimony", "Asset recovery or legal action" ], "limits": { "wallets": 50 } } ], "scope": [ "Transaction history", "Contact relationships", "Risk scoring", "Asset flow patterns", "Cross-chain analysis", "Smart contract interactions", "Exchange relationships" ], "deliverables": [ "Contact risk report", "Transaction flow analysis", "Network visualization map", "Risk mitigation recommendations", "Security enhancement plan", "Monitoring strategy", "Compliance recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=blockchain-contact-analysis-service" }, { "slug": "cloud-security-monitoring", "title": "Cloud Security Monitoring", "url": "https://cisomarketplace.services/services/cloud-security-monitoring", "md_url": "https://cisomarketplace.services/services/cloud-security-monitoring.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Continuous monitoring and assessment of your cloud infrastructure security posture.", "from_price_usd": 10000, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Basic", "price_usd": 10000, "description": "Monthly subscription covering 1 cloud provider and up to 5 accounts/subscriptions: daily configuration-drift report and weekly IAM assessment findings. Findings are reported; your team remediates.", "includes": [ "1 cloud provider, up to 5 accounts/subscriptions", "Daily cloud configuration report", "Weekly IAM assessment findings", "Read-only access to your accounts" ], "excludes": [ "Monthly architecture review", "Remediation in your accounts", "24/7 alert response or incident handling", "Additional cloud providers" ], "limits": { "cloud_accounts": 5 } }, { "id": "advanced", "name": "Advanced", "price_usd": 18000, "description": "Monthly subscription covering up to 2 cloud providers and up to 15 accounts/subscriptions: daily configuration reports, weekly IAM findings, plus a monthly architecture review document with a review call.", "includes": [ "Up to 2 cloud providers, up to 15 accounts/subscriptions", "Daily cloud configuration report", "Weekly IAM assessment findings", "Monthly architecture review document and call" ], "excludes": [ "Remediation in your accounts", "24/7 alert response or incident handling", "CSPM platform licence costs" ], "limits": { "cloud_accounts": 15 } } ], "scope": [ "Cloud configuration", "IAM security", "Architecture security" ], "deliverables": [ "Daily cloud configuration reports", "Weekly IAM assessment findings", "Monthly architecture review documents" ], "scope_url": "https://cisomarketplace.services/scope?service=cloud-security-monitoring" }, { "slug": "cloud-security-posture-management", "title": "Cloud Security Posture Management", "url": "https://cisomarketplace.services/services/cloud-security-posture-management", "md_url": "https://cisomarketplace.services/services/cloud-security-posture-management.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Advanced cloud security assessment and continuous monitoring implementation across multi-cloud environments, focusing on compliance, cost optimization, and security automation.", "from_price_usd": 65000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core CSPM Assessment", "price_usd": 65000, "description": "CSPM baseline for 1 primary cloud provider, up to 10 accounts/subscriptions: security baseline report, gap analysis against 1 framework, identity review, cost-optimization review and up to 5 standard automation playbooks.", "includes": [ "1 cloud provider, up to 10 accounts/subscriptions", "Cloud security baseline report", "Compliance mapping to 1 framework", "Up to 5 standard automation playbooks", "Cost optimization recommendations" ], "excludes": [ "Second cloud provider", "Security dashboard build", "Custom-coded automation", "CSPM platform licence costs" ], "limits": { "cloud_accounts": 10, "frameworks": 1 } }, { "id": "advanced", "name": "Advanced CSPM Program", "price_usd": 95000, "description": "CSPM program across up to 2 cloud providers and up to 25 accounts/subscriptions: baseline, compliance mapping to up to 3 frameworks, up to 15 automation playbooks, incident response procedures and a security dashboard.", "includes": [ "Up to 2 cloud providers, up to 25 accounts/subscriptions", "Compliance mapping to up to 3 frameworks", "Up to 15 automation playbooks", "Security dashboard implementation", "Cloud incident response procedures" ], "excludes": [ "Custom automation beyond playbook templates", "Post-project monitoring operations", "CSPM platform licence costs" ], "limits": { "cloud_accounts": 25, "frameworks": 3 } }, { "id": "premium", "name": "Enterprise CSPM Solution", "price_usd": 150000, "description": "Full-scale CSPM implementation across all cloud environments with custom automation and continuous monitoring", "includes": [], "excludes": [ "CSPM platform licence costs", "Application penetration testing" ], "limits": { "frameworks": 5 } } ], "scope": [ "Multi-cloud security assessment", "Compliance gap analysis", "Security automation implementation", "Cost optimization review", "Identity management evaluation" ], "deliverables": [ "Cloud security baseline report", "Compliance mapping document", "Security automation playbooks", "Cost optimization recommendations", "Incident response procedures", "Security dashboard implementation" ], "scope_url": "https://cisomarketplace.services/scope?service=cloud-security-posture-management" }, { "slug": "continuous-attack-surface-monitoring", "title": "Continuous Attack Surface Monitoring", "url": "https://cisomarketplace.services/services/continuous-attack-surface-monitoring", "md_url": "https://cisomarketplace.services/services/continuous-attack-surface-monitoring.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive continuous monitoring of your external attack surface with regular assessments and testing.", "from_price_usd": 8000, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Basic", "price_usd": 8000, "description": "Monthly subscription covering up to 100 external IPs and up to 5 root domains: weekly external scans with a report each week, and a monthly analyst-reviewed vulnerability assessment report with prioritized fixes. No penetration testing.", "includes": [ "Weekly external scan reports", "Monthly analyst-reviewed vulnerability assessment report", "Asset and subdomain discovery for up to 5 root domains", "Prioritized remediation list each month" ], "excludes": [ "Quarterly penetration tests", "Internal network or authenticated application testing", "Remediation of findings", "24/7 alerting or incident response" ], "limits": { "external_ips": 100, "domains": 5 } }, { "id": "premium", "name": "Premium", "price_usd": 15000, "description": "Monthly subscription covering up to 250 external IPs and up to 15 root domains: weekly scans, monthly vulnerability assessment reports, plus a manual external penetration test every quarter (4 per year) with a findings report and one retest of fixed findings per test.", "includes": [ "Weekly external scan reports", "Monthly analyst-reviewed vulnerability assessment report", "Quarterly manual external penetration test (4 per year)", "Penetration test findings report each quarter", "One retest of fixed findings per quarterly test" ], "excludes": [ "Internal network testing", "Authenticated web application or API testing", "Social engineering", "Remediation of findings" ], "limits": { "external_ips": 250, "domains": 15 } } ], "scope": [ "External attack surface", "Vulnerability management", "Penetration testing" ], "deliverables": [ "Weekly external scan reports", "Monthly vulnerability assessment reports", "Quarterly penetration test findings" ], "scope_url": "https://cisomarketplace.services/scope?service=continuous-attack-surface-monitoring" }, { "slug": "quantumsafe-cryptography-readiness", "title": "Quantum-Safe Cryptography Readiness", "url": "https://cisomarketplace.services/services/quantumsafe-cryptography-readiness", "md_url": "https://cisomarketplace.services/services/quantumsafe-cryptography-readiness.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Future-proof your cryptographic infrastructure with quantum-safe algorithms and protocols. Includes assessment, migration planning, and implementation support.", "from_price_usd": 25000, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 25000, "description": "Cryptographic inventory for up to 100 in-scope systems: algorithm and certificate inventory delivered as a CBOM, quantum risk classification, and a short migration roadmap. Fixed scope, remote.", "includes": [ "Algorithm and certificate inventory for up to 100 systems", "Cryptographic bill of materials (CBOM)", "Quantum risk classification per asset", "Short migration roadmap", "Leadership readout" ], "excludes": [ "Key management review", "Migration strategy document", "Cryptographic policy updates", "More than 100 systems" ], "limits": { "internal_hosts": 100 } }, { "id": "basic", "name": "Core Quantum Readiness Assessment", "price_usd": 60000, "description": "Readiness assessment for up to 250 in-scope systems: current cryptographic assessment, quantum vulnerability analysis, key management review, quantum risk report, and a migration strategy with implementation roadmap.", "includes": [ "Cryptographic inventory for up to 250 systems", "Quantum vulnerability analysis", "Key management review", "Quantum risk assessment report", "Migration strategy document and implementation roadmap" ], "excludes": [ "Per-system algorithm replacement plans", "Standards compliance verification", "Cryptographic policy rewrite", "Implementation support and testing" ], "limits": { "internal_hosts": 250 } }, { "id": "advanced", "name": "Advanced Quantum Readiness Assessment", "price_usd": 85000, "description": "Readiness assessment for up to 500 in-scope systems. Adds algorithm replacement planning per system class, standards compliance verification against published post-quantum standards, updated cryptographic policies, and a sequenced implementation plan with dependencies.", "includes": [ "Everything in the Core tier, for up to 500 systems", "Algorithm replacement plan per system class", "Standards compliance verification", "Updated cryptographic policies", "Sequenced implementation plan with owners and dependencies" ], "excludes": [ "Hands-on implementation support", "Verification testing of migrated systems", "Staff training delivery" ], "limits": { "internal_hosts": 500 } }, { "id": "premium", "name": "Enterprise Quantum Readiness Program", "price_usd": 120000, "description": "Full-scope quantum-safe transformation including custom implementation support and ongoing verification", "includes": [], "excludes": [ "Full production migration of every system", "HSM, PKI or product licences", "More than 1,000 systems (scoped separately)" ], "limits": { "internal_hosts": 1000 } } ], "scope": [ "Current cryptographic assessment", "Quantum vulnerability analysis", "Algorithm replacement planning", "Key management review", "Standards compliance verification", "Post-quantum algorithm evaluation", "Migration pathway planning", "Key exchange and random number generator review" ], "deliverables": [ "Quantum risk assessment report", "Migration strategy document", "Implementation roadmap", "Updated cryptographic policies", "Verification and testing results", "Training documentation" ], "scope_url": "https://cisomarketplace.services/scope?service=quantumsafe-cryptography-readiness" }, { "slug": "banking-and-web3-redundancy-assessment", "title": "Banking and Web3 Redundancy Assessment", "url": "https://cisomarketplace.services/services/banking-and-web3-redundancy-assessment", "md_url": "https://cisomarketplace.services/services/banking-and-web3-redundancy-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Advanced assessment of banking and Web3 infrastructure focusing on redundancy, privacy, and security measures for cryptocurrency and traditional banking operations.", "from_price_usd": 7500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Redundancy Assessment", "price_usd": 7500, "description": "Review of up to 5 crypto wallets, up to 2 Web3 applications and the client's banking setup for single points of failure. Output is an assessment report with redundancy and backup recommendations. No implementation.", "includes": [ "Wallet custody, seed backup and recovery review for up to 5 wallets", "Banking relationship and access redundancy review", "Review of up to 2 Web3 applications in use", "Assessment report with redundancy recommendations" ], "excludes": [ "Privacy enhancement plan", "Implementation of backups or new wallets", "Incident response procedures", "Recovery testing" ], "limits": { "wallets": 5, "web_apps": 2 } }, { "id": "advanced", "name": "Advanced Redundancy Program", "price_usd": 15000, "description": "Up to 15 wallets and up to 5 Web3 applications: everything in the basic tier, a privacy enhancement plan, security architecture document, backup strategy and written incident response procedures. Guidance only; the client implements.", "includes": [ "Everything in the basic tier", "Privacy enhancement plan", "Security architecture document", "Backup strategy", "Incident response procedures" ], "excludes": [ "Hands-on implementation of backups and recovery", "Recovery drills", "Custom backup tooling" ], "limits": { "wallets": 15, "web_apps": 5 } }, { "id": "premium", "name": "Enterprise Redundancy Solution", "price_usd": 25000, "description": "Full-scope redundancy implementation with custom backup solutions and recovery procedures", "includes": [], "excludes": [ "Custody of client keys or funds", "Smart contract code audit", "Ongoing monitoring" ], "limits": { "wallets": 40, "web_apps": 10 } } ], "scope": [ "Banking infrastructure", "Cryptocurrency wallets", "Web3 applications", "Privacy measures", "Backup systems", "Recovery procedures" ], "deliverables": [ "Infrastructure assessment report", "Redundancy recommendations", "Privacy enhancement plan", "Security architecture document", "Backup strategy", "Incident response procedures" ], "scope_url": "https://cisomarketplace.services/scope?service=banking-and-web3-redundancy-assessment" }, { "slug": "red-team-subscription", "title": "Red Team Subscription", "url": "https://cisomarketplace.services/services/red-team-subscription", "md_url": "https://cisomarketplace.services/services/red-team-subscription.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "A standing offensive testing program in place of a once-a-year engagement. Each month our team runs a targeted assessment against an agreed part of your environment; each quarter a scenario-based attack tests how well your people and tooling detect and respond. The Premium tier adds two full red team engagements a year. Findings from every cycle feed one running improvement plan, so each round also checks whether the last round's fixes held. Targets, rules of engagement and testing windows are agreed at kickoff.", "from_price_usd": 15000, "price_cadence": "month", "tiers": [ { "id": "standard", "name": "Standard", "price_usd": 15000, "description": "Monthly targeted assessments and quarterly scenario-based attacks, each with a report and an updated improvement plan.", "includes": [ "Monthly targeted assessments", "Quarterly scenario-based attacks", "Monthly assessment reports and quarterly scenario findings", "Running improvement plan" ], "excludes": [ "Full-scope engagements — included only in Premium" ], "limits": { "scenarios": 4 } }, { "id": "premium", "name": "Premium", "price_usd": 25000, "description": "Everything in Standard, plus two full red team engagements a year, each with its own report.", "includes": [ "Everything in Standard", "Two full red team engagements a year", "Bi-annual red team reports" ], "excludes": [ "More than two full-scope engagements a year" ], "limits": { "scenarios": 6 } } ], "scope": [ "Kickoff: targets, rules of engagement and testing windows", "Monthly targeted assessment of an agreed area", "Quarterly scenario-based attack with a detection and response review", "Two full red team engagements a year (Premium tier)", "Running improvement plan updated after every cycle" ], "deliverables": [ "Monthly assessment reports", "Quarterly attack scenario findings", "Bi-annual red team reports" ], "scope_url": "https://cisomarketplace.services/scope?service=red-team-subscription" }, { "slug": "vip-digital-privacy-security-assessment", "title": "VIP Digital Privacy & Security Assessment", "url": "https://cisomarketplace.services/services/vip-digital-privacy-security-assessment", "md_url": "https://cisomarketplace.services/services/vip-digital-privacy-security-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive privacy and security assessment designed for high-profile individuals, celebrities, and public figures. Protects personal, financial, and digital assets while maintaining privacy across all aspects of life.", "from_price_usd": 50000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core VIP Security Package", "price_usd": 50000, "description": "One principal: digital footprint analysis, audit of up to 5 personal devices, financial account security audit, social media review and up to 2 crypto wallets. Privacy risk report, scorecard and enhancement roadmap.", "includes": [ "1 principal", "Digital footprint analysis", "Up to 5 personal devices audited", "Financial account security audit", "Up to 2 wallets assessed", "Privacy enhancement roadmap" ], "excludes": [ "Smart home and private network review", "Staff and insider threat assessment", "Family members", "Travel security and monitoring" ], "limits": { "subjects": 1, "devices": 5, "wallets": 2 } }, { "id": "advanced", "name": "Advanced VIP Protection", "price_usd": 85000, "description": "One principal and 1 residence: adds smart home, IoT and private network review, staff and insider threat assessment with training for up to 10 staff, personal business security review, up to 10 devices and up to 5 wallets, and an incident response playbook.", "includes": [ "1 principal, 1 residence", "Smart home and private network review", "Staff and insider threat assessment", "Staff training for up to 10 people", "Incident response playbook", "Secure communication protocols" ], "excludes": [ "Family member assessments", "Travel security protocols", "24/7 monitoring", "Additional residences" ], "limits": { "subjects": 1, "locations": 1, "devices": 10, "wallets": 5, "participants": 10 } }, { "id": "premium", "name": "Elite VIP Security Program", "price_usd": 150000, "description": "Complete security program including family protection, travel security, and 24/7 monitoring", "includes": [], "excludes": [ "Close protection or guard services", "Legal or reputation-management representation", "Hardware purchase and installation" ], "limits": { "subjects": 5, "locations": 3, "devices": 25, "wallets": 10, "participants": 25 } } ], "scope": [ "Personal digital footprint analysis", "Smart home and IoT security review", "Financial accounts security audit", "Cryptocurrency and Web3 wallet assessment", "Social media presence evaluation", "Personal business security review", "Staff and insider threat assessment", "Physical security integration review", "Travel security protocol assessment", "Family member security evaluation", "Personal device security audit", "Private network infrastructure review" ], "deliverables": [ "Comprehensive privacy risk assessment report", "Digital asset security scorecard", "Smart home security architecture review", "Personal security protocol handbook", "Staff security training program", "Digital privacy enhancement roadmap", "Incident response playbook", "Travel security guidelines", "Secure communication protocols", "Regular security monitoring recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=vip-digital-privacy-security-assessment" }, { "slug": "ai-agentic-red-team", "title": "AI & Agentic Red Team", "url": "https://cisomarketplace.services/services/ai-agentic-red-team", "md_url": "https://cisomarketplace.services/services/ai-agentic-red-team.md", "practice": "AI Security", "category_group": "Offensive Security", "description": "Offensive testing of LLMs and AI agents — prompt injection, jailbreaks, tool misuse, agent goal hijack, memory/context poisoning, model extraction, and agent identity abuse. Mapped to OWASP Top 10 for Agentic Applications, OWASP LLM Top 10, and MITRE ATLAS.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Adversarial testing of 1 AI application or agent.", "includes": [ "One AI application or agent", "Findings report", "Fix guidance" ], "excludes": [ "Tool and connector integrations beyond the first" ], "limits": { "ai_systems": 1 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "Up to 3 AI applications or agents, including their tool and data connections.", "includes": [ "Up to three systems", "Tool and data connections" ], "excludes": [ "Ongoing testing" ], "limits": { "ai_systems": 3 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Up to 8 systems, multi-agent workflows and a retest after fixes.", "includes": [ "Up to eight systems", "Multi-agent workflows", "Retest" ], "excludes": [ "Continuous testing — scoped as a subscription" ], "limits": { "ai_systems": 8 } } ], "scope": [ "Prompt injection & jailbreak testing", "Agent tool misuse & goal hijack", "Memory/context poisoning", "Model extraction & inference attacks", "Agent identity & privilege abuse", "MCP/tool-connection abuse", "OWASP Agentic + MITRE ATLAS mapping" ], "deliverables": [ "AI red team report", "OWASP/ATLAS-mapped findings", "Exploit chains & PoCs", "Guardrail & mitigation recommendations", "Re-test of fixes" ], "scope_url": "https://cisomarketplace.services/scope?service=ai-agentic-red-team" }, { "slug": "ai-ml-security-assessment", "title": "AI/ML Security Assessment", "url": "https://cisomarketplace.services/services/ai-ml-security-assessment", "md_url": "https://cisomarketplace.services/services/ai-ml-security-assessment.md", "practice": "AI Security", "category_group": "Offensive Security", "description": "Expert evaluation of artificial intelligence and machine learning systems security, from model development to deployment. Our assessment identifies vulnerabilities in AI/ML infrastructure, examines risks of data poisoning, adversarial attacks, and model manipulation while providing guidance for securing these advanced technologies.", "from_price_usd": 42000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential AI/ML Security Review", "price_usd": 42000, "description": "Security assessment of 1 AI system: model, data pipeline and hosting.", "includes": [ "One AI system", "Risk register", "Hardening plan" ], "excludes": [ "Adversarial testing of the model" ], "limits": { "ai_systems": 1 } }, { "id": "advanced", "name": "Advanced AI/ML Security Program", "price_usd": 75000, "description": "Up to 3 AI systems, including adversarial testing of one of them.", "includes": [ "Up to three AI systems", "Adversarial testing of one system" ], "excludes": [ "Ongoing monitoring" ], "limits": { "ai_systems": 3 } }, { "id": "enterprise", "name": "Enterprise AI/ML Security Framework", "price_usd": 120000, "description": "Up to 8 AI systems with an AI security standard for the organization.", "includes": [ "Up to eight AI systems", "Organization-wide AI security standard" ], "excludes": [ "Portfolios above eight systems — scoped" ], "limits": { "ai_systems": 8 } } ], "scope": [ "ML pipeline security review", "Training data integrity assessment", "Model vulnerability testing", "Adversarial attack simulation", "Model poisoning resistance evaluation", "Inference attack testing", "AI infrastructure security assessment", "Model governance review" ], "deliverables": [ "AI/ML security assessment report", "Vulnerability analysis", "Adversarial defense recommendations", "Security control framework", "Data poisoning protection strategy", "Model security architecture", "Secure AI/ML development practices", "Governance and compliance guidance" ], "scope_url": "https://cisomarketplace.services/scope?service=ai-ml-security-assessment" }, { "slug": "active-directory-assessment", "title": "Active Directory Security Assessment", "url": "https://cisomarketplace.services/services/active-directory-assessment", "md_url": "https://cisomarketplace.services/services/active-directory-assessment.md", "practice": "Offensive Security", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment of Active Directory infrastructure, focusing on privilege escalation, lateral movement, and domain compromise scenarios.", "from_price_usd": 40000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core AD Security Assessment", "price_usd": 40000, "description": "Assessment of 1 AD forest with 1 domain, up to 2,500 users: password and group policy review, privileged group analysis, and privilege-escalation testing from 1 standard-user starting point.", "includes": [ "1 forest, 1 domain, up to 2,500 users", "Password policy and GPO security review", "Privileged group and delegation analysis", "Privilege-escalation testing from 1 standard account", "Hardening guidelines" ], "excludes": [ "Trust relationship analysis", "Full attack-path mapping to domain compromise", "Cloud identity (hybrid) review", "Hardening implementation and retest" ], "limits": { "domains": 1, "users": 2500 } }, { "id": "advanced", "name": "Advanced AD Security Program", "price_usd": 70000, "description": "Assessment of up to 5 domains in up to 2 forests, up to 10,000 users: full attack-path mapping to domain compromise, trust relationship analysis, lateral movement testing and review of every GPO.", "includes": [ "Up to 5 domains, up to 2 forests, up to 10,000 users", "Attack-path mapping to domain compromise", "Trust relationship analysis", "Lateral movement testing", "Review of all group policies" ], "excludes": [ "Hardening implementation", "Retest after remediation", "Custom attack tooling", "Tiered administration redesign" ], "limits": { "domains": 5, "users": 10000 } }, { "id": "premium", "name": "Enterprise AD Security Solution", "price_usd": 110000, "description": "Multi-forest AD program; no fixed domain or user cap - scoped at kickoff. Adds custom attack tooling for your environment, tiered-administration design, hands-on hardening support and a full retest after remediation.", "includes": [ "All forests and domains, scoped at kickoff", "Custom attack tooling and scenarios", "Tiered administration and hardening design", "Hands-on hardening support", "Full retest after remediation" ], "excludes": [ "Ongoing AD monitoring", "Identity product licences", "Migration or domain consolidation work" ], "limits": {} } ], "scope": [ "Domain security assessment", "Trust relationship analysis", "Privilege escalation testing", "Password policy evaluation", "Group policy security review" ], "deliverables": [ "Domain security report", "Attack path analysis", "Privilege escalation findings", "Security policy recommendations", "Hardening guidelines" ], "scope_url": "https://cisomarketplace.services/scope?service=active-directory-assessment" }, { "slug": "agriculture-farming-security", "title": "Agriculture & Farming Security Assessment", "url": "https://cisomarketplace.services/services/agriculture-farming-security", "md_url": "https://cisomarketplace.services/services/agriculture-farming-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security assessment for modern agricultural operations utilizing precision farming technologies, connected equipment, and smart agriculture systems. Our comprehensive evaluation addresses the unique cybersecurity challenges of protecting agricultural data, autonomous farm equipment, sensor networks, and food safety systems while ensuring operational continuity throughout the growing season.", "from_price_usd": 36000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Agricultural Security Assessment", "price_usd": 36000, "description": "One farm operation: up to 1 site, up to 100 connected devices (equipment, sensors, irrigation controllers) and up to 100 staff. Reviews the farm management system, remote access and agronomic data handling. Remote with one site visit.", "includes": [ "Farm management system and remote access review", "Inventory and configuration review of connected equipment and sensors", "Irrigation controller exposure check", "Agronomic data protection review", "Report with prioritized roadmap" ], "excludes": [ "Hands-on testing of equipment telematics and sensor radio links", "Supply chain and food safety system review", "Livestock monitoring systems", "More than one site" ], "limits": { "locations": 1, "devices": 100, "employees": 100 } }, { "id": "advanced", "name": "Advanced Agricultural Security Program", "price_usd": 65000, "description": "Up to 3 sites, up to 500 connected devices and up to 500 staff. Adds hands-on testing of equipment connectivity, sensor networks and irrigation control, weather-data integrations, livestock monitoring and a connected-farm security architecture.", "includes": [ "Everything in the basic tier", "Hands-on testing of equipment connectivity and sensor networks", "Irrigation and weather-data integration assessment", "Livestock monitoring security review", "Connected-farm security architecture and sensor hardening guide" ], "excludes": [ "Supply chain partner and food safety system review", "Custom or in-house built farm systems", "More than 3 sites" ], "limits": { "locations": 3, "devices": 500, "employees": 500 } }, { "id": "enterprise", "name": "Enterprise Agricultural Security Framework", "price_usd": 95000, "description": "Multi-operation agribusiness: up to 10 sites, up to 2,500 connected devices and up to 2,500 staff. Adds custom and in-house systems, food safety systems, supply chain partner verification and a cross-site security framework. Larger estates are scoped separately.", "includes": [ "Everything in the advanced tier", "Custom and in-house system review", "Food safety system protection review", "Supply chain security verification for key partners", "Cross-site remote access framework and executive briefing" ], "excludes": [ "Remediation implementation", "Ongoing monitoring after delivery", "Processing-plant industrial control testing beyond farm systems" ], "limits": { "locations": 10, "devices": 2500, "employees": 2500 } } ], "scope": [ "Precision agriculture system security", "Farm equipment connectivity assessment", "Agricultural sensor network security", "Farm management system review", "Agronomic data protection", "Supply chain security verification", "Weather data integration security", "Irrigation control system assessment", "Livestock monitoring security", "Food safety system protection" ], "deliverables": [ "Agricultural technology security report", "Connected farm security architecture", "Data protection strategy", "Equipment security recommendations", "Sensor network hardening guide", "Remote access security framework", "Weather and irrigation system security plan", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=agriculture-farming-security" }, { "slug": "business-continuity-planning-assessment", "title": "Business Continuity Planning Assessment", "url": "https://cisomarketplace.services/services/business-continuity-planning-assessment", "md_url": "https://cisomarketplace.services/services/business-continuity-planning-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's business continuity capabilities and operational resilience through detailed Business Impact Analysis (BIA), risk assessment, and continuity planning. Our specialized approach combines regulatory compliance requirements with practical business resilience strategies to ensure your organization can maintain critical operations during disruptions and recover effectively from various business interruption scenarios.", "from_price_usd": 10800, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential BCP Assessment", "price_usd": 10800, "description": "70 consulting hours and up to 3 stakeholder workshops for 1 site and up to 10 critical processes: BIA, threat/risk assessment, review of the current plan, RTO/RPO definition and a continuity plan template.", "includes": [ "70 consulting hours, up to 3 workshops", "BIA for up to 10 critical processes", "Risk register and gap analysis", "RTO/RPO definitions", "BCP template and implementation roadmap" ], "excludes": [ "Multi-scenario recovery strategies", "Testing framework and schedule", "Supplier continuity evaluation", "Exercises or simulations" ], "limits": { "locations": 1, "hours": 70, "sessions": 3 } }, { "id": "comprehensive", "name": "Comprehensive BCP Program", "price_usd": 20300, "description": "130 consulting hours and up to 6 workshops for up to 2 sites and up to 25 critical processes: detailed BIA with dependency mapping, recovery strategies for up to 3 disruption scenarios, regulatory mapping and a BCP testing framework.", "includes": [ "130 consulting hours, up to 6 workshops", "BIA for up to 25 processes with dependency mapping", "Recovery strategies for up to 3 disruption scenarios", "Regulatory compliance mapping", "BCP testing framework and schedule" ], "excludes": [ "Facilitated crisis simulation exercise", "Supply chain continuity planning", "Ongoing program management" ], "limits": { "locations": 2, "hours": 130, "sessions": 6 } }, { "id": "enterprise", "name": "Enterprise Continuity Transformation", "price_usd": 36500, "description": "Advanced business continuity program with multi-site assessment, supply chain continuity planning, crisis simulation exercises, and ongoing program management support", "includes": [], "excludes": [ "IT disaster recovery implementation", "Alternate site contracts or costs", "BCM software licences" ], "limits": { "locations": 5, "sessions": 12, "scenarios": 2, "vendors": 15 } } ], "scope": [ "Business Impact Analysis (BIA) for critical processes (12 hours)", "Risk assessment and threat identification (8 hours)", "Current business continuity plan evaluation (6 hours)", "Critical business process mapping and dependencies (10 hours)", "Recovery time and point objectives definition (4 hours)", "Alternative site and workspace planning (6 hours)", "Communication and notification procedures assessment (4 hours)", "Supplier and vendor continuity evaluation (6 hours)", "Regulatory compliance requirements analysis (5 hours)", "Crisis management team structure review (3 hours)", "Business continuity testing methodology development (4 hours)", "Training and awareness program assessment (2 hours)" ], "deliverables": [ "Comprehensive business continuity assessment report (20-25 pages)", "Business Impact Analysis with critical process prioritization", "Risk register with threat scenarios and mitigation strategies", "Current state vs. desired state gap analysis", "Business continuity plan template and framework", "Recovery strategies for critical business functions", "Alternative site recommendations and workspace planning", "Communication and crisis management procedures", "Supplier continuity requirements and alternatives", "Regulatory compliance mapping and requirements", "BCP testing framework and schedule", "Training and awareness program recommendations", "Implementation roadmap with timeline and resource requirements" ], "scope_url": "https://cisomarketplace.services/scope?service=business-continuity-planning-assessment" }, { "slug": "cannabis-industry-security", "title": "Cannabis Industry Security Program", "url": "https://cisomarketplace.services/services/cannabis-industry-security", "md_url": "https://cisomarketplace.services/services/cannabis-industry-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment for cannabis operations, including cultivation facilities, retail operations, and supply chain compliance with state-specific regulations.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Cannabis Security Assessment", "price_usd": 45000, "description": "Security and state-compliance assessment for a single-state operator: up to 2 licensed facilities, up to 50 employees and up to 5 vendors. Reviews seed-to-sale tracking, payment handling and physical security integration; delivers a gap report and roadmap.", "includes": [ "Seed-to-sale / track-and-trace system security review", "Payment processing review for up to 2 sites", "On-site physical security walkthrough of each facility", "State compliance gap report for 1 state", "Prioritized remediation roadmap" ], "excludes": [ "Writing policies and employee procedures", "Hands-on control implementation", "Operations licensed in more than 1 state", "Penetration testing" ], "limits": { "locations": 2, "employees": 50, "vendors": 5 } }, { "id": "advanced", "name": "Advanced Cannabis Security Program", "price_usd": 75000, "description": "Assessment plus build-out for operators with up to 5 licensed facilities, up to 250 employees and up to 15 vendors, in up to 2 states. Adds written compliance documentation, employee security procedures, supply chain validation and guided control implementation.", "includes": [ "Everything in the Core assessment, for up to 5 facilities", "Compliance documentation set for up to 2 states", "Employee security procedures", "Supply chain and vendor validation for up to 15 vendors", "Guided implementation of priority controls", "Security architecture document" ], "excludes": [ "Ongoing program management after hand-off", "Recurring compliance monitoring", "More than 2 state jurisdictions" ], "limits": { "locations": 5, "employees": 250, "vendors": 15 } }, { "id": "premium", "name": "Enterprise Cannabis Security Solution", "price_usd": 120000, "description": "Full-scope cannabis security with custom compliance tools, continuous monitoring, and complete program management", "includes": [], "excludes": [ "Purchase or installation of cameras, access control or alarm hardware", "Legal representation before state regulators" ], "limits": { "locations": 15, "employees": 1000, "vendors": 40 } } ], "scope": [ "Seed-to-sale tracking security", "Payment processing compliance", "Cultivation facility security", "Retail operation protection", "Supply chain validation", "State compliance verification" ], "deliverables": [ "Cannabis security architecture", "Compliance documentation", "Track-and-trace security", "Payment system security framework", "Physical security integration plan", "Employee security procedures" ], "scope_url": "https://cisomarketplace.services/scope?service=cannabis-industry-security" }, { "slug": "comprehensive-container-security-assessment", "title": "Comprehensive Container Security Assessment", "url": "https://cisomarketplace.services/services/comprehensive-container-security-assessment", "md_url": "https://cisomarketplace.services/services/comprehensive-container-security-assessment.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Deep-dive security assessment of container environments, including infrastructure, images, runtime security, and orchestration platforms.", "from_price_usd": 15000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic", "price_usd": 15000, "description": "Point-in-time review of 1 Kubernetes/orchestration cluster in 1 cloud account and up to 10 container images: image vulnerability analysis, cluster configuration, secrets handling and registry settings. No CI/CD assessment.", "includes": [ "Up to 10 container images", "1 cluster, configuration-level orchestration review", "Secrets management and registry review", "Findings report and vulnerable container inventory", "Hardening guide" ], "excludes": [ "CI/CD pipeline security evaluation", "Runtime security assessment", "Custom scanning rules and policy-as-code", "More than 1 cluster" ], "limits": { "cloud_accounts": 1 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": 65000, "description": "No image cap and up to 5 clusters across up to 5 cloud accounts: infrastructure, image, runtime, orchestration, network and CI/CD pipeline review, custom policy-as-code and scanning rules, then a follow-up re-review.", "includes": [ "Unlimited images, up to 5 clusters", "Runtime and container network security assessment", "CI/CD pipeline security evaluation", "Custom policy-as-code, YAML templates and scanning rules", "Remediation scripts and roadmap", "Re-review at 6 months" ], "excludes": [ "Remediation implementation in your clusters", "Continuous runtime monitoring", "Application-layer penetration testing of containerized apps" ], "limits": { "cloud_accounts": 5, "months": 6 } } ], "scope": [ "Container infrastructure security review", "Image security analysis (up to 50 images)", "Runtime security assessment", "Kubernetes/orchestration platform review", "CI/CD pipeline security evaluation", "Container network security analysis", "Secrets management review", "Container registry security assessment" ], "deliverables": [ "Detailed findings report", "Custom scanning rules", "Vulnerable container inventory", "YAML security templates", "Policy-as-code examples", "Remediation scripts", "Security hardening guide", "Container security roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=comprehensive-container-security-assessment" }, { "slug": "construction-industry-security", "title": "Construction Industry Security Assessment", "url": "https://cisomarketplace.services/services/construction-industry-security", "md_url": "https://cisomarketplace.services/services/construction-industry-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment designed specifically for construction firms, addressing the unique challenges of securing building information modeling (BIM), project management systems, connected equipment, and site security technologies. Our specialized evaluation helps construction companies protect intellectual property, ensure project continuity, and secure increasingly digital construction operations.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Construction Security Assessment", "price_usd": 38000, "description": "Firms up to 100 staff and up to 2 active job sites: review of the project management platform, BIM access controls and data sharing, contractor access management and payment system controls. Remote, no site technology testing.", "includes": [ "Project management system assessment for up to 2 platforms", "BIM access control and data sharing review", "Contractor access management review", "Payment system and invoice fraud controls review", "Report with implementation roadmap" ], "excludes": [ "Site IoT and surveillance system testing", "Connected equipment and drone security", "Mobile application testing", "Supply chain verification" ], "limits": { "employees": 100, "locations": 2, "web_apps": 2 } }, { "id": "advanced", "name": "Advanced Construction Security Program", "price_usd": 70000, "description": "Up to 500 staff, up to 5 job sites and up to 250 site devices: everything in the basic tier, a BIM security framework, site IoT and surveillance assessment, connected equipment evaluation and testing of up to 1 mobile app. Includes site visits.", "includes": [ "Everything in the basic tier", "BIM security framework", "Site IoT and surveillance system assessment", "Connected equipment evaluation", "Mobile application security test for 1 app" ], "excludes": [ "Drone and autonomous equipment security", "Supply chain security verification", "More than 5 job sites" ], "limits": { "employees": 500, "locations": 5, "web_apps": 4, "devices": 250, "mobile_apps": 1 } }, { "id": "enterprise", "name": "Enterprise Construction Security Framework", "price_usd": 110000, "description": "Up to 2,500 staff, up to 15 job sites and up to 1,000 site devices: everything in the advanced tier, drone and autonomous equipment security, supply chain verification, contractor security requirements and up to 3 mobile apps. Larger firms are scoped separately.", "includes": [ "Everything in the advanced tier", "Drone and autonomous equipment security review", "Supply chain security verification", "Contractor security requirements standard", "Multi-site security framework" ], "excludes": [ "Remediation implementation", "Ongoing monitoring", "Physical guarding of sites" ], "limits": { "employees": 2500, "locations": 15, "web_apps": 8, "devices": 1000, "mobile_apps": 3 } } ], "scope": [ "Building Information Modeling (BIM) security", "Project management system assessment", "Construction site IoT security", "Connected equipment evaluation", "Drone and autonomous vehicle security", "Supply chain security verification", "Contractor access management", "Mobile application security", "Site surveillance system assessment", "Payment system security" ], "deliverables": [ "Construction security assessment report", "BIM security framework", "Project data protection strategy", "Site technology security recommendations", "Connected equipment security guide", "Contractor security requirements", "Mobile security enhancement plan", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=construction-industry-security" }, { "slug": "decentralized-identity-security", "title": "Decentralized Identity Security Assessment", "url": "https://cisomarketplace.services/services/decentralized-identity-security", "md_url": "https://cisomarketplace.services/services/decentralized-identity-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Expert evaluation of decentralized identity systems, focusing on security of DIDs, verifiable credentials, and identity protocols.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core DID Security Assessment", "price_usd": 35000, "description": "One DID implementation: up to 1 repository and 1 API. Review of DID method handling, key management and resolution, with a security assessment report.", "includes": [ "DID method and resolver security review", "Key management and rotation review", "Code review of 1 repository", "Security assessment report" ], "excludes": [ "Credential issuance and revocation review", "Verification protocol analysis", "Privacy evaluation", "Implementation support" ], "limits": { "repositories": 1, "apis": 1 } }, { "id": "advanced", "name": "Advanced DID Security Program", "price_usd": 60000, "description": "Up to 3 repositories and 3 APIs: everything in the basic tier, credential issuance and revocation security, verification protocol analysis, and a privacy evaluation covering correlation and selective disclosure.", "includes": [ "Everything in the basic tier", "Credential issuance and revocation security review", "Verification protocol analysis", "Privacy controls evaluation", "One fix-review round" ], "excludes": [ "Custom test tooling", "Implementation support hours", "On-chain contract audit beyond the 3 repositories" ], "limits": { "repositories": 3, "apis": 3 } }, { "id": "premium", "name": "Enterprise DID Security Solution", "price_usd": 95000, "description": "Full-scope DID security program including custom tool development and implementation support", "includes": [], "excludes": [ "Ongoing monitoring", "Standards body or certification submissions", "Building the identity system" ], "limits": { "repositories": 5, "apis": 5 } } ], "scope": [ "Assessment of DID implementations", "credential issuance systems", "verification protocols", "privacy controls" ], "deliverables": [ "Security assessment report", "protocol analysis", "privacy evaluation", "implementation recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=decentralized-identity-security" }, { "slug": "digital-twin-security", "title": "Digital Twin Security Assessment", "url": "https://cisomarketplace.services/services/digital-twin-security", "md_url": "https://cisomarketplace.services/services/digital-twin-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment of digital twin implementations, including IoT sensor networks, simulation environments, and data synchronization mechanisms.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Digital Twin Assessment", "price_usd": 45000, "description": "One digital twin: up to 25 sensor devices (sampled), 2 APIs and 1 cloud account. Architecture and data flow review, API testing and operational control review.", "includes": [ "Digital twin architecture and data flow review", "API integration testing for up to 2 APIs", "Cloud configuration review for 1 account", "Operational security control review", "Report with remediation roadmap" ], "excludes": [ "Simulation environment security testing", "Hands-on IoT device and firmware testing", "Data synchronization integrity testing", "Monitoring setup" ], "limits": { "devices": 25, "apis": 2, "cloud_accounts": 1 } }, { "id": "advanced", "name": "Advanced Digital Twin Security", "price_usd": 75000, "description": "Up to 100 sensor devices, 5 APIs and 2 cloud accounts: everything in the basic tier, simulation environment testing, sensor-to-twin data integrity and spoofing tests, and hands-on testing of up to 3 device types.", "includes": [ "Everything in the basic tier", "Simulation environment security testing", "Data synchronization integrity and spoofing tests", "Hands-on testing of up to 3 IoT device types", "One retest round" ], "excludes": [ "Custom test tooling", "Monitoring and detection setup", "Physical plant control system testing" ], "limits": { "devices": 100, "apis": 5, "cloud_accounts": 2 } }, { "id": "premium", "name": "Enterprise Digital Twin Program", "price_usd": 120000, "description": "Up to 500 sensor devices, 10 APIs and 5 cloud accounts: everything in the advanced tier, custom test tooling handed over, and monitoring and detection rules set up for the twin's data flows. Larger estates are scoped separately.", "includes": [ "Everything in the advanced tier", "Custom test tooling handed over", "Monitoring and detection rule setup with handover", "Multi-site twin architecture recommendations", "Two retest rounds" ], "excludes": [ "Operating the monitoring after handover", "Remediation engineering", "Safety certification work" ], "limits": { "devices": 500, "apis": 10, "cloud_accounts": 5 } } ], "scope": [ "Assessment covers digital twin infrastructure", "data flows", "API integrations", "operational security controls" ], "deliverables": [ "Detailed security assessment report", "vulnerability analysis", "architectural recommendations", "remediation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=digital-twin-security" }, { "slug": "educational-security", "title": "Educational Institution Security Program", "url": "https://cisomarketplace.services/services/educational-security", "md_url": "https://cisomarketplace.services/services/educational-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment for educational institutions, covering student data protection, campus infrastructure, and remote learning systems.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Education Security Assessment", "price_usd": 45000, "description": "Assessment for an institution of up to 2,500 students and staff on 1 campus: student data protection review, FERPA gap assessment, network architecture review, remote learning platform review and a physical security walkthrough. Report and recommendations.", "includes": [ "Student data protection review", "FERPA compliance gap assessment", "Campus network architecture review (document and config based)", "Remote learning platform security review", "Physical security walkthrough of 1 campus" ], "excludes": [ "Network vulnerability scanning or penetration testing", "Compliance documentation writing", "Implementation support", "Additional campuses" ], "limits": { "users": 2500, "locations": 1 } }, { "id": "advanced", "name": "Advanced Education Security Program", "price_usd": 75000, "description": "Up to 10,000 students and staff across up to 3 campuses. Adds vulnerability scanning of campus networks, a segment-by-segment infrastructure analysis, a complete FERPA compliance review with documentation, and a data protection strategy.", "includes": [ "Everything in the Core assessment, for up to 3 campuses", "Vulnerability scanning of campus networks", "Infrastructure analysis per network segment", "FERPA compliance documentation", "Data protection strategy", "Education security framework" ], "excludes": [ "Program implementation and project management", "Custom data-protection tooling or scripts", "Penetration testing", "Staff and student training delivery" ], "limits": { "users": 10000, "locations": 3 } }, { "id": "premium", "name": "Enterprise Education Security Solution", "price_usd": 120000, "description": "Full-scope education security with custom protection tools and complete program implementation", "includes": [], "excludes": [ "Purchase of hardware or software licences", "Physical security equipment installation" ], "limits": { "locations": 10 } } ], "scope": [ "Student data protection review", "Campus network assessment", "Remote learning security evaluation", "Physical security analysis", "FERPA compliance assessment" ], "deliverables": [ "Education security framework", "Data protection strategy", "Network security analysis", "Physical security recommendations", "Compliance documentation" ], "scope_url": "https://cisomarketplace.services/scope?service=educational-security" }, { "slug": "event-venue-festival-security", "title": "Event Venue and Festival Security Program", "url": "https://cisomarketplace.services/services/event-venue-festival-security", "md_url": "https://cisomarketplace.services/services/event-venue-festival-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment for event venues and festivals, including crowd management, access control, and emergency response planning.", "from_price_usd": 40000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Event Security Assessment", "price_usd": 40000, "description": "Essential event and festival security covering basic venue protection and crowd management", "includes": [], "excludes": [], "limits": {} }, { "id": "advanced", "name": "Advanced Event Security Program", "price_usd": 70000, "description": "Comprehensive program including detailed crowd analysis and complete security implementation", "includes": [], "excludes": [], "limits": {} }, { "id": "premium", "name": "Enterprise Event Security Solution", "price_usd": 110000, "description": "Full-scope event security with custom tools, real-time monitoring, and complete program management", "includes": [], "excludes": [], "limits": {} } ], "scope": [ "Venue infrastructure assessment", "Crowd flow analysis", "Access control systems", "Emergency response planning", "Vendor security review", "Communication systems security" ], "deliverables": [ "Event security architecture", "Crowd management plan", "Access control framework", "Emergency procedures", "Staff training materials", "Communication protocols" ], "scope_url": "https://cisomarketplace.services/scope?service=event-venue-festival-security" }, { "slug": "executive-travel-privacy-security-assessment", "title": "Executive Travel Privacy & Security Assessment", "url": "https://cisomarketplace.services/services/executive-travel-privacy-security-assessment", "md_url": "https://cisomarketplace.services/services/executive-travel-privacy-security-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive international travel security and privacy assessment for executives, high-net-worth individuals, and VIPs. Ensures secure and private travel across borders while protecting digital assets, communications, and financial transactions.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Executive Travel Security", "price_usd": 35000, "description": "Travel security assessment for 1 principal, up to 3 destination countries and up to 3 devices: travel risk assessment, communications and mobile device security, itinerary privacy, border-crossing data protection and hotel security checklist.", "includes": [ "Travel risk assessment for up to 3 destination countries", "Secure travel communications playbook", "Mobile device and SIM security guidance for up to 3 devices", "Itinerary privacy and border-crossing data protection", "Hotel security checklist and emergency procedures" ], "excludes": [ "Private aviation security review", "Cross-border payment and banking security", "Hands-on device configuration", "Support while travelling" ], "limits": { "subjects": 1, "devices": 3 } }, { "id": "advanced", "name": "Advanced Executive Travel Protection", "price_usd": 60000, "description": "Up to 3 principals (executive plus family and staff), up to 6 destination countries and up to 10 devices. Adds private aviation security review, hands-on setup of secure communications and travel apps, cross-border payment, banking and digital currency security.", "includes": [ "Everything in Core, for up to 3 principals and 6 countries", "Private aviation security protocols", "Hands-on secure communications and travel app configuration", "Cross-border payment, banking and digital currency security guide", "Ground transportation security review", "Travel security incident response plan" ], "excludes": [ "24/7 incident response line", "Custom travel kit hardware", "Support beyond the engagement", "Physical protection or security drivers" ], "limits": { "subjects": 3, "devices": 10 } }, { "id": "premium", "name": "Elite Executive Travel Security", "price_usd": 95000, "description": "Full-scope travel security program with dedicated support, custom secure travel kit, and 24/7 global incident response", "includes": [], "excludes": [ "Physical close protection, security drivers or armed personnel", "Medical evacuation or insurance", "Cost of travel kit hardware beyond the initial kits", "Travel booking" ], "limits": { "subjects": 6, "devices": 20 } } ], "scope": [ "International travel risk assessment", "Private aviation security review", "Hotel and accommodation security audit", "Cross-border payment security", "International mobile device security", "Travel communication protocols", "Digital currency usage abroad", "International SIM card security", "Ground transportation security", "Travel itinerary privacy", "Border crossing data protection", "International banking security" ], "deliverables": [ "Travel security risk assessment report", "Secure travel communications playbook", "International payment security guide", "Hotel security checklist", "Private aviation security protocols", "Digital security travel kit", "Emergency response procedures", "Secure travel apps configuration guide", "International privacy compliance guide", "Travel security incident response plan" ], "scope_url": "https://cisomarketplace.services/scope?service=executive-travel-privacy-security-assessment" }, { "slug": "gaming-platform-security", "title": "Gaming Platform Security Assessment", "url": "https://cisomarketplace.services/services/gaming-platform-security", "md_url": "https://cisomarketplace.services/services/gaming-platform-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment for gaming platforms, focusing on anti-cheat systems, player data protection, microtransaction security, and game engine vulnerabilities.", "from_price_usd": 22500, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 22500, "description": "External penetration test of the platform's public footprint: up to 25 external IPs, 1 web app (player portal or store) and 1 API. No game client, game engine or anti-cheat work.", "includes": [ "External network penetration test of up to 25 IPs", "Security test of 1 web app", "Security test of 1 API", "Player authentication review on the tested app", "Findings report with one retest round" ], "excludes": [ "Anti-cheat system evaluation", "Game client and game engine analysis", "Microtransaction logic testing", "Player data security framework" ], "limits": { "external_ips": 25, "web_apps": 1, "apis": 1 } }, { "id": "basic", "name": "Core Gaming Security Assessment", "price_usd": 45000, "description": "One game title on one client platform: up to 25 external IPs, 2 web apps and 2 APIs, plus anti-cheat design review, player authentication review and player data protection review.", "includes": [ "Everything in the entry tier", "Anti-cheat architecture and configuration review", "Player authentication and account takeover review", "Player data protection review", "Platform security report" ], "excludes": [ "Hands-on anti-cheat bypass testing", "Microtransaction and in-game economy testing", "Game client reverse engineering", "Game engine security testing" ], "limits": { "external_ips": 25, "web_apps": 2, "apis": 2 } }, { "id": "advanced", "name": "Advanced Gaming Security Program", "price_usd": 75000, "description": "One game title on up to 2 client platforms: up to 100 external IPs, 3 web apps and 5 APIs. Everything in the basic tier, hands-on anti-cheat bypass testing, game client analysis, and microtransaction and in-game economy abuse testing.", "includes": [ "Everything in the basic tier", "Hands-on anti-cheat bypass testing", "Game client security analysis and tamper testing", "Microtransaction and in-game economy abuse testing", "Client-side protection strategy" ], "excludes": [ "Custom anti-cheat detection tooling", "Game engine source-level review", "Additional game titles" ], "limits": { "external_ips": 100, "web_apps": 3, "apis": 5 } }, { "id": "premium", "name": "Enterprise Gaming Security Solution", "price_usd": 120000, "description": "Up to 3 game titles: up to 250 external IPs, 5 web apps and 10 APIs. Everything in the advanced tier, game engine security testing, custom anti-cheat detection tooling handed over, backend and cloud infrastructure testing and two retest rounds.", "includes": [ "Everything in the advanced tier", "Game engine security testing", "Custom anti-cheat detection tooling handed over", "Backend and cloud infrastructure testing", "Two retest rounds" ], "excludes": [ "Operating anti-cheat or fraud monitoring", "Remediation engineering", "Console platform certification work" ], "limits": { "external_ips": 250, "web_apps": 5, "apis": 10 } } ], "scope": [ "Anti-cheat system evaluation", "Game engine security testing", "Player authentication review", "Microtransaction security assessment", "Game client security analysis" ], "deliverables": [ "Platform security report", "Anti-cheat recommendations", "Transaction security analysis", "Client-side protection strategy", "Player data security framework" ], "scope_url": "https://cisomarketplace.services/scope?service=gaming-platform-security" }, { "slug": "generative-ai-security-assessment", "title": "Generative AI Security Assessment", "url": "https://cisomarketplace.services/services/generative-ai-security-assessment", "md_url": "https://cisomarketplace.services/services/generative-ai-security-assessment.md", "practice": "AI Security", "category_group": "Specialized", "description": "Comprehensive security assessment for organizations implementing or developing generative AI systems. Our specialized evaluation examines unique security risks of large language models, generative image systems, and other AI tools, including prompt injection vulnerabilities, training data poisoning, model security, and output filtering controls to ensure the safe deployment of this transformative technology.", "from_price_usd": 48000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential GenAI Security Assessment", "price_usd": 48000, "description": "Security assessment of up to 2 GenAI applications built on third-party models (e.g. a chatbot and a copilot). Prompt injection and output-filter testing, access control review, integration review and a governance gap check.", "includes": [ "Prompt injection and jailbreak testing against up to 2 applications", "Output filtering and safety control review", "Authentication and access control review of the GenAI integration", "AI governance policy gap check", "Findings report and risk mitigation roadmap" ], "excludes": [ "RAG pipeline and agent/tool-use layer testing", "Training data and fine-tuning pipeline review", "Assessment of self-hosted or custom-trained models", "Retest after remediation" ], "limits": { "ai_systems": 2 } }, { "id": "advanced", "name": "Advanced GenAI Security Program", "price_usd": 85000, "description": "Assessment of up to 5 GenAI systems across application, RAG and agent layers. Custom prompt injection test cases per system, adversarial attack simulation, hallucination analysis, training/fine-tuning data handling review, and one retest.", "includes": [ "Everything in the Essential tier, for up to 5 systems", "RAG data store and agent/tool-use abuse testing", "Custom prompt injection test suite per system", "Training and fine-tuning data security review", "Deployment security architecture recommendations", "One retest within 30 days of remediation" ], "excludes": [ "Security architecture for custom-trained foundation models", "Model theft / IP extraction testing of self-hosted models", "Organization-wide GenAI governance framework build-out" ], "limits": { "ai_systems": 5 } }, { "id": "enterprise", "name": "Enterprise GenAI Security Framework", "price_usd": 135000, "description": "For organizations training or hosting their own models: up to 10 GenAI systems, model supply chain and training data poisoning review, model extraction/IP protection testing, model security architecture, and a written GenAI governance framework.", "includes": [ "Everything in the Advanced tier, for up to 10 systems", "Training data poisoning and model supply chain review", "Model extraction and intellectual property protection testing", "Model hosting and deployment security architecture", "GenAI security governance framework with roles and review gates", "Executive briefing and one retest" ], "excludes": [ "Ongoing / continuous AI red teaming after the engagement", "Remediation engineering or guardrail implementation", "More than 10 systems (scoped separately)" ], "limits": { "ai_systems": 10 } } ], "scope": [ "Prompt injection vulnerability testing", "AI model security assessment", "Training data security evaluation", "Output filtering and safety controls", "Adversarial attack simulation", "Model hallucination analysis", "Intellectual property protection", "GenAI integration security", "Authentication and access controls", "AI governance framework review" ], "deliverables": [ "GenAI security assessment report", "Prompt injection vulnerability findings", "Model security recommendations", "Training data protection framework", "Output safety control enhancements", "Deployment security architecture", "Integration security guidelines", "GenAI security governance recommendations", "Risk mitigation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=generative-ai-security-assessment" }, { "slug": "green-energy-security", "title": "Green Energy Infrastructure Security", "url": "https://cisomarketplace.services/services/green-energy-security", "md_url": "https://cisomarketplace.services/services/green-energy-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment for renewable energy infrastructure including smart grids, solar farms, and wind energy systems.", "from_price_usd": 65000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Green Energy Assessment", "price_usd": 65000, "description": "Security assessment of 1 renewable generation site (solar, wind or storage) and its control system: architecture review, passive network capture, control system and energy management platform configuration review, and a findings report.", "includes": [ "On-site assessment of 1 generation site", "Control system and energy management platform configuration review", "Passive OT network traffic capture and asset inventory", "Remote access and vendor connection review", "Vulnerability analysis and findings report" ], "excludes": [ "Smart grid / utility interconnect and DER aggregation analysis", "Control-by-control compliance mapping", "Additional sites", "Monitoring deployment or remediation support" ], "limits": { "locations": 1 } }, { "id": "advanced", "name": "Advanced Green Energy Security", "price_usd": 110000, "description": "Assessment of up to 3 sites plus the central control / operations center. Adds smart grid and interconnect analysis, corporate IT-to-OT boundary review, control-by-control compliance mapping to one named standard, and security architecture recommendations.", "includes": [ "Everything in the Core tier, for up to 3 sites", "Central control / operations center assessment", "Smart grid, interconnect and DER communication path analysis", "IT/OT boundary and segmentation review", "Compliance mapping to 1 standard chosen by the client", "Security architecture recommendations" ], "excludes": [ "OT monitoring design and deployment", "Hands-on remediation and implementation support", "More than 3 sites" ], "limits": { "locations": 3, "frameworks": 1 } }, { "id": "premium", "name": "Enterprise Green Energy Program", "price_usd": 180000, "description": "Full-scope renewable energy security program including custom monitoring and implementation support", "includes": [], "excludes": [ "Monitoring product licences and hardware", "Fleets above 5 sites (scoped separately)" ], "limits": { "locations": 5, "frameworks": 2 } } ], "scope": [ "Assessment of renewable energy systems", "smart grid infrastructure", "control systems", "energy management platforms" ], "deliverables": [ "Detailed security assessment report", "vulnerability analysis", "compliance mapping", "security architecture recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=green-energy-security" }, { "slug": "hospitality-sector-security", "title": "Hospitality Sector Security Program", "url": "https://cisomarketplace.services/services/hospitality-sector-security", "md_url": "https://cisomarketplace.services/services/hospitality-sector-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Specialized security assessment for hotels, resorts, restaurants, and hospitality organizations, addressing the unique challenges of securing guest data, payment systems, property management systems, and physical-digital security convergence. Our assessment helps hospitality businesses protect guest privacy, ensure PCI compliance, and maintain operational continuity while delivering exceptional guest experiences.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Hospitality Security Assessment", "price_usd": 35000, "description": "One property (hotel, resort, restaurant site): property management system, payment card environment and guest data handling reviewed by interview, configuration review and one site walkthrough. Up to 5 vendors reviewed. PCI DSS gap analysis and roadmap.", "includes": [ "PMS and reservation system security review", "Payment card environment review with PCI DSS gap analysis", "Guest data protection assessment", "One on-site walkthrough", "Assessment report and implementation roadmap" ], "excludes": [ "Smart room/IoT and physical-digital integration review", "Loyalty program and mobile app/kiosk review", "Penetration testing", "Formal PCI validation (SAQ sign-off, ROC)" ], "limits": { "locations": 1, "vendors": 5 } }, { "id": "standard", "name": "Comprehensive Hospitality Security Program", "price_usd": 65000, "description": "Up to 3 properties and up to 15 vendors. Adds smart room/IoT, physical-digital integration (locks, cameras, access control), loyalty program data, staff awareness evaluation and 1 guest mobile app plus kiosks. Delivers staff procedures and a vendor management framework.", "includes": [ "Everything in the single-property tier, across up to 3 properties", "Smart room/IoT security review", "Physical-digital security integration plan", "Loyalty program data protection review", "Staff security procedures and vendor security management framework" ], "excludes": [ "VIP guest protection and privacy procedures", "Brand protection strategy", "Penetration testing of apps, kiosks and networks", "Remediation work" ], "limits": { "locations": 3, "vendors": 15, "mobile_apps": 1 } }, { "id": "luxury", "name": "Luxury Hospitality Security Framework", "price_usd": 95000, "description": "Up to 10 properties under one brand, up to 25 vendors and up to 2 guest apps. All standard-tier work plus VIP guest protection procedures, privacy controls for high-profile guests (records access, staff handling, discretion) and a brand protection plan.", "includes": [ "All standard-tier assessment areas across up to 10 properties", "VIP guest protection and privacy procedures", "Guest-record access and privacy control design", "Brand protection plan (impersonation, fraud, leak scenarios)", "Executive briefing for brand and property leadership" ], "excludes": [ "Executive protection or physical guarding services", "Penetration testing", "Ongoing monitoring or managed services", "Portfolios above 10 properties (scoped separately)" ], "limits": { "locations": 10, "vendors": 25, "mobile_apps": 2 } } ], "scope": [ "Property management system security", "Payment card environment review", "Guest data protection assessment", "Physical security integration", "Smart room/IoT security", "Reservation system security", "Loyalty program data protection", "Third-party vendor assessment", "Staff security awareness evaluation", "Mobile app and kiosk security" ], "deliverables": [ "Hospitality security assessment report", "PCI DSS compliance gap analysis", "Guest data protection framework", "Property management system security recommendations", "Physical-digital security integration plan", "Staff security procedures", "Vendor security management framework", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=hospitality-sector-security" }, { "slug": "incident-response-readiness-tabletop-exercise", "title": "Incident Response Readiness & Tabletop Exercise", "url": "https://cisomarketplace.services/services/incident-response-readiness-tabletop-exercise", "md_url": "https://cisomarketplace.services/services/incident-response-readiness-tabletop-exercise.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive incident response assessment and tabletop exercise designed to validate your organization's IR preparedness through focused policy review, stakeholder coordination validation, and scenario-based team exercises. Our specialized approach combines industry-standard IR maturity assessment with practical tabletop simulations to enhance your incident response capabilities, team coordination, and regulatory compliance readiness.", "from_price_usd": 25000, "price_cadence": "engagement", "tiers": [ { "id": "essential", "name": "Essential IR Assessment & Tabletop", "price_usd": 25000, "description": "IR policy review and maturity rating, insurance and legal contact validation, then one 3-4 hour tabletop with up to 2 scenarios for up to 15 participants. 45 consulting hours, after-action report and priority recommendations.", "includes": [ "IR policy gap analysis and maturity rating", "Insurance carrier and legal coordination check", "One 3-4 hour facilitated tabletop", "Validated contact sheet and escalation procedures", "After-action report with priority matrix" ], "excludes": [ "Stakeholder interviews beyond the core IR team", "Full-day exercise", "Regulatory reporting requirements mapping", "Follow-up review after the report" ], "limits": { "participants": 15, "scenarios": 2, "sessions": 1, "hours": 45 } }, { "id": "comprehensive", "name": "Comprehensive IR Readiness Program", "price_usd": 42500, "description": "Adds up to 10 stakeholder interviews, one full-day tabletop with up to 3 scenarios for up to 30 participants, a 15-20 page after-action report, regulatory reporting requirements mapping, and a 90-day follow-up review. 80 consulting hours.", "includes": [ "Everything in the Essential tier", "Up to 10 stakeholder interviews", "Full-day immersive tabletop", "Regulatory reporting requirements mapping", "Communication template library", "90-day follow-up review session" ], "excludes": [ "Separate executive-only exercise", "Crisis simulation gaming platform access", "Recurring quarterly assessments" ], "limits": { "participants": 30, "scenarios": 3, "sessions": 2, "hours": 80, "months": 3 } }, { "id": "enterprise", "name": "Enterprise IR Transformation", "price_usd": 67500, "description": "Advanced incident response program with multi-scenario exercises, crisis simulation gaming platform access, executive briefings, custom scenario development, and quarterly maturity assessments", "includes": [], "excludes": [ "Incident response retainer or live incident handling", "Rewriting the full IR plan", "Technical attack simulation against production systems" ], "limits": { "participants": 50, "scenarios": 5, "sessions": 5 } } ], "scope": [ "Comprehensive IR policy review and gap analysis against industry standards (6 hours)", "Current incident response capability maturity assessment (4 hours)", "Insurance and legal coordination validation with carrier requirements (4 hours)", "Threat landscape analysis and scenario development (6 hours)", "Multi-scenario tabletop exercise facilitation (4 hours)", "Team readiness discussion and role validation session (3 hours)", "Interactive Q&A on IR procedures and decision-making (2 hours)", "OSINT research on insurance claims history and provider ecosystem (3 hours)", "Process walkthrough using developed scenarios with timing analysis (4 hours)", "Communication and escalation pathway validation (2 hours)", "Technical response capability assessment (4 hours)", "Post-exercise analysis and improvement recommendations (3 hours)" ], "deliverables": [ "Comprehensive IR readiness assessment report (15-20 pages)", "Current state vs. industry benchmark analysis", "Priority recommendations matrix with timeline and resource requirements", "Validated quick reference contact sheet and escalation procedures", "3-5 relevant walkthrough scenarios based on threat intelligence", "Detailed after-action report from tabletop exercise", "Process improvement recommendations with implementation roadmap", "Team readiness assessment with skills gap analysis", "Insurance and legal coordination optimization plan", "Communication template library for various incident types", "Regulatory compliance mapping and requirements", "Executive summary with board-ready metrics" ], "scope_url": "https://cisomarketplace.services/scope?service=incident-response-readiness-tabletop-exercise" }, { "slug": "industrial-control-system-ics-security-assessment", "title": "Industrial Control System (ICS) Security Assessment", "url": "https://cisomarketplace.services/services/industrial-control-system-ics-security-assessment", "md_url": "https://cisomarketplace.services/services/industrial-control-system-ics-security-assessment.md", "practice": "Offensive Security", "category_group": "Specialized", "description": "Specialized security assessment for industrial control systems, SCADA networks, and operational technology environments, focusing on both cyber and physical security aspects.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core ICS Security Assessment", "price_usd": 35000, "description": "Assessment of 1 site and one control system: ICS network architecture review, passive traffic capture, SCADA and HMI configuration review, a sample of up to 25 PLCs/RTUs/HMIs, and analysis of up to 2 industrial protocols. Includes a retest.", "includes": [ "ICS network architecture and segmentation review", "Passive traffic capture and asset inventory", "SCADA server and HMI configuration review", "Sample of up to 25 PLCs/RTUs/HMIs", "Analysis of up to 2 protocols (e.g. Modbus, DNP3)", "Report, remediation priority matrix, 90-day retest" ], "excludes": [ "Safety instrumented system review", "Active testing against controllers", "Physical security controls assessment", "Additional sites" ], "limits": { "locations": 1, "devices": 25 } }, { "id": "advanced", "name": "Advanced ICS Security Program", "price_usd": 60000, "description": "Assessment of up to 2 sites and up to 75 controllers/HMIs. Adds active protocol testing in a maintenance window or test bed, safety system security review, HMI application testing, and physical security controls assessment. Includes a retest.", "includes": [ "Everything in the Core tier, for up to 2 sites", "Active protocol and controller testing in an agreed window or test bed", "Safety system security review", "HMI and engineering workstation testing", "Physical security controls assessment", "90-day retest" ], "excludes": [ "IT/OT convergence assessment of the corporate network side", "OT monitoring design and setup", "Custom test tooling for proprietary protocols" ], "limits": { "locations": 2, "devices": 75 } }, { "id": "premium", "name": "Enterprise ICS Security Solution", "price_usd": 95000, "description": "Assessment of up to 4 sites and up to 200 controllers/HMIs. Adds IT/OT convergence testing from the corporate network into OT, custom test tooling for proprietary protocols, and OT monitoring setup with detection use cases. Includes a retest.", "includes": [ "Everything in the Advanced tier, for up to 4 sites", "IT-to-OT attack path testing across the corporate boundary", "Custom test tooling for proprietary or vendor-specific protocols", "OT monitoring setup with tuned detection use cases", "Network architecture recommendations per site", "90-day retest" ], "excludes": [ "Monitoring product licences and sensors", "Remediation engineering", "Multi-month security program build (see ICS Security Program)" ], "limits": { "locations": 4, "devices": 200 } } ], "scope": [ "ICS network architecture review", "SCADA system security testing", "PLC/RTU security assessment", "Protocol analysis (Modbus, DNP3, etc.)", "Safety system security review", "Human-Machine Interface (HMI) testing", "Physical security controls assessment" ], "deliverables": [ "Detailed ICS security report", "Network architecture recommendations", "Protocol security analysis", "Safety system findings", "Physical security recommendations", "Remediation priority matrix", "90-day retest period" ], "scope_url": "https://cisomarketplace.services/scope?service=industrial-control-system-ics-security-assessment" }, { "slug": "industrial-iot-security", "title": "Industrial IoT (IIoT) Security Assessment", "url": "https://cisomarketplace.services/services/industrial-iot-security", "md_url": "https://cisomarketplace.services/services/industrial-iot-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security assessment for industrial IoT environments where operational technology and information technology converge. Our comprehensive evaluation examines the security of connected industrial systems, sensors, gateways, and analytics platforms while addressing the unique challenges of securing industrial control systems connected to IoT networks in manufacturing, utilities, and critical infrastructure.", "from_price_usd": 42000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential IIoT Security Assessment", "price_usd": 42000, "description": "Assessment of 1 facility and up to 5 IIoT device models (sensors, gateways): device configuration and update review, industrial network evaluation, one IIoT platform review, and OT/IT gap analysis.", "includes": [ "Security assessment of up to 5 device models", "Industrial network and segmentation evaluation at 1 facility", "Review of 1 IIoT platform / cloud tenant", "OT/IT convergence gap analysis", "Report, risk prioritization matrix, remediation roadmap" ], "excludes": [ "Industrial protocol active testing", "Edge computing and supply chain verification", "Firmware reverse engineering", "Additional facilities" ], "limits": { "locations": 1, "devices": 5 } }, { "id": "advanced", "name": "Advanced IIoT Security Program", "price_usd": 75000, "description": "Assessment of up to 3 facilities and up to 15 device models. Adds industrial protocol security testing, edge computing review, IIoT data protection assessment, update management review, supply chain verification, and an OT/IT segmentation strategy.", "includes": [ "Everything in the Essential tier, for up to 3 facilities", "Industrial protocol security testing", "Edge node and gateway security review", "Supply chain and update management verification", "OT/IT segmentation strategy", "Device hardening guide" ], "excludes": [ "Custom security architecture for new deployments", "OT security monitoring design", "Governance framework" ], "limits": { "locations": 3, "devices": 15 } }, { "id": "enterprise", "name": "Enterprise IIoT Security Framework", "price_usd": 120000, "description": "Assessment of up to 5 facilities and up to 30 device models. Adds a reference security architecture and secure deployment framework for future rollouts, OT monitoring capability design, and IIoT security governance. Larger estates are scoped separately.", "includes": [ "Everything in the Advanced tier, for up to 5 facilities", "Reference IIoT security architecture", "Secure IIoT deployment framework for new sites and devices", "OT security monitoring design and use cases", "IIoT security governance model" ], "excludes": [ "Monitoring deployment and licences", "Remediation engineering", "Estates above 5 facilities (scoped separately)" ], "limits": { "locations": 5, "devices": 30 } } ], "scope": [ "IIoT device security assessment", "Industrial network security evaluation", "OT/IT convergence gap analysis", "Edge computing security review", "IIoT data protection assessment", "Industrial protocol security testing", "IIoT platform security review", "Supply chain security verification", "IIoT update management", "OT security monitoring capabilities" ], "deliverables": [ "IIoT security assessment report", "Risk prioritization matrix", "IIoT security architecture recommendations", "OT/IT segmentation strategy", "Device security hardening guide", "Secure IIoT deployment framework", "Industrial network protection plan", "Security monitoring recommendations", "Remediation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=industrial-iot-security" }, { "slug": "iot-security-hardening-program", "title": "IoT Security Hardening Program", "url": "https://cisomarketplace.services/services/iot-security-hardening-program", "md_url": "https://cisomarketplace.services/services/iot-security-hardening-program.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "End-to-end IoT device and infrastructure security assessment, hardening, and monitoring solution for manufacturing and industrial environments.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core IoT Security Hardening", "price_usd": 45000, "description": "Assess-and-harden program for 1 facility and up to 5 device models: device inventory, device assessment, hardening guidelines, segmentation review with recommendations, baseline monitoring setup on existing tooling, and training materials.", "includes": [ "IoT device inventory for 1 facility", "Assessment and hardening guidelines for up to 5 device models", "Network segmentation review and recommendations", "Baseline monitoring setup on the client's existing tooling", "Staff training materials" ], "excludes": [ "Firmware security testing", "Industrial protocol testing", "OT/IT convergence security", "Incident response procedures" ], "limits": { "locations": 1, "devices": 5 } }, { "id": "advanced", "name": "Advanced IoT Security Program", "price_usd": 75000, "description": "Program for up to 2 facilities and up to 15 device models. Adds firmware security testing, protocol security analysis and testing, OT/IT convergence security review, and IoT incident response procedures.", "includes": [ "Everything in the Core tier, for up to 2 facilities", "Firmware security testing", "Protocol security analysis and testing", "OT/IT convergence security review", "IoT incident response procedures" ], "excludes": [ "Custom hardening scripts and tooling", "Post-deployment monitoring tuning period", "Incident response exercises" ], "limits": { "locations": 2, "devices": 15 } }, { "id": "premium", "name": "Enterprise IoT Security Platform", "price_usd": 120000, "description": "Full-scope IoT security program with custom hardening tools, continuous monitoring, and advanced incident response capabilities", "includes": [], "excludes": [ "Monitoring licences and sensors", "More than 4 facilities (scoped separately)" ], "limits": { "locations": 4, "devices": 30, "scenarios": 1 } } ], "scope": [ "IoT device security assessment", "Network segmentation review", "Protocol security analysis", "Firmware security testing", "OT/IT convergence security" ], "deliverables": [ "IoT security assessment report", "Device hardening guidelines", "Network segmentation recommendations", "Security monitoring setup", "Incident response procedures", "Staff training materials" ], "scope_url": "https://cisomarketplace.services/scope?service=iot-security-hardening-program" }, { "slug": "ma-cybersecurity-due-diligence", "title": "M&A Cybersecurity Due Diligence", "url": "https://cisomarketplace.services/services/ma-cybersecurity-due-diligence", "md_url": "https://cisomarketplace.services/services/ma-cybersecurity-due-diligence.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive cybersecurity assessment and risk analysis for mergers, acquisitions, and investment decisions. Tailored for PE firms, VCs, and corporate buyers to evaluate cyber risks before completing transactions.", "from_price_usd": 25000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core M&A Security Assessment", "price_usd": 25000, "description": "Due diligence on 1 target of up to 250 employees: data-room document review, up to 5 stakeholder interviews, external attack surface scan, incident history and compliance review, and a red-flag report for the deal team. No system access needed.", "includes": [ "Data-room security documentation review", "Up to 5 stakeholder interviews", "External attack surface and breach-exposure scan", "Incident history and compliance review", "Executive summary and risk matrix for decision-makers" ], "excludes": [ "Authenticated technical analysis of cloud and infrastructure", "Remediation cost quantification", "Integration planning", "Penetration testing" ], "limits": { "subjects": 1, "employees": 250, "locations": 1, "cloud_accounts": 1, "vendors": 5 } }, { "id": "advanced", "name": "Advanced M&A Security Program", "price_usd": 45000, "description": "Due diligence on 1 target of up to 1,000 employees. Adds read-only technical analysis of up to 3 cloud accounts and core infrastructure, review of up to 15 key vendors, security team capability assessment, maturity scorecard, remediation cost estimates and integration risk.", "includes": [ "Everything in the Core tier", "Read-only configuration review of up to 3 cloud accounts and core infrastructure", "Third-party risk review of up to 15 key vendors", "Security maturity scorecard and team capability assessment", "Remediation cost analysis and technical debt quantification", "Integration risk assessment" ], "excludes": [ "Hands-on penetration testing", "Quantified risk modeling for deal pricing", "Post-close security strategy and 100-day plan" ], "limits": { "subjects": 1, "employees": 1000, "locations": 3, "cloud_accounts": 3, "vendors": 15 } }, { "id": "premium", "name": "Enterprise M&A Security Solution", "price_usd": 75000, "description": "Due diligence on 1 target of up to 2,500 employees. Adds targeted penetration testing and compromise assessment tooling, quantified loss modeling to support price and escrow terms, and a post-merger security strategy with a 100-day plan.", "includes": [ "Everything in the Advanced tier", "Targeted external and internal penetration testing", "Compromise assessment of the target environment", "Quantified risk and remediation cost model", "Post-acquisition security roadmap and 100-day integration plan", "Deal-team and board briefing" ], "excludes": [ "Execution of post-close remediation", "Legal or regulatory opinions", "More than 1 target entity (each scoped separately)" ], "limits": { "subjects": 1, "employees": 2500, "locations": 5, "cloud_accounts": 5, "vendors": 30 } } ], "scope": [ "Security posture evaluation", "Infrastructure and architecture review", "Compliance and regulatory assessment", "Security incident history analysis", "Third-party vendor risk assessment", "Technical debt evaluation", "Security team capability assessment", "Cloud infrastructure security review", "Data protection and privacy analysis", "Security roadmap evaluation" ], "deliverables": [ "Executive summary for investment decision-makers", "Detailed technical due diligence report", "Risk assessment matrix", "Security maturity scorecard", "Post-acquisition security roadmap", "Cost analysis for security improvements", "Integration risk assessment", "Compliance gap analysis", "Technical debt quantification", "Remediation priority recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=ma-cybersecurity-due-diligence" }, { "slug": "mcp-agent-tool-chain-security-assessment", "title": "MCP & Agent Tool-Chain Security Assessment", "url": "https://cisomarketplace.services/services/mcp-agent-tool-chain-security-assessment", "md_url": "https://cisomarketplace.services/services/mcp-agent-tool-chain-security-assessment.md", "practice": "AI Security", "category_group": "Cloud & AppSec", "description": "Assess the security of agent tool-chains: MCP servers, tool/function connections, inter-agent communication, and the authz/credential model behind agent actions.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Review of 1 agent system with up to 3 MCP servers and up to 15 tool/function connections: server configuration, tool authorization checks and credential/token scoping. Design and configuration review.", "includes": [ "1 agent system, up to 3 MCP servers", "Up to 15 tool/function connections", "Tool authz and credential scoping review", "Findings report and hardening guide" ], "excludes": [ "Inter-agent communication review", "Tool supply-chain analysis", "Hands-on abuse testing of tools", "Ongoing monitoring" ], "limits": { "ai_systems": 1 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "Assessment of up to 5 agent systems with up to 10 MCP servers and up to 50 tool connections: authz, credential scoping, inter-agent communication, tool supply chain, and hands-on abuse testing of tool calls.", "includes": [ "Up to 5 agent systems, up to 10 MCP servers", "Up to 50 tool/function connections", "Inter-agent communication security review", "Supply-chain review of third-party tools", "Hands-on tool-abuse and privilege testing" ], "excludes": [ "Ongoing monitoring of new tools and servers", "Remediation implementation", "Model-level red teaming (jailbreak/safety testing)" ], "limits": { "ai_systems": 5 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Continuous agent-supply-chain monitoring", "includes": [], "excludes": [ "Remediation implementation", "Model-level red teaming" ], "limits": {} } ], "scope": [ "MCP server security review", "Tool/function connection authz", "Inter-agent communication security", "Credential & token scoping for tools", "Supply-chain of agent tools" ], "deliverables": [ "MCP/tool-chain security report", "Authz & credential findings", "Inter-agent comms recommendations", "Hardening guide" ], "scope_url": "https://cisomarketplace.services/scope?service=mcp-agent-tool-chain-security-assessment" }, { "slug": "maritime-systems-security-assessment", "title": "Maritime Systems Security Assessment", "url": "https://cisomarketplace.services/services/maritime-systems-security-assessment", "md_url": "https://cisomarketplace.services/services/maritime-systems-security-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security testing for maritime technology, including navigation systems, vessel communication, and port infrastructure.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Maritime Systems Assessment", "price_usd": 38000, "description": "Assessment of 1 vessel or port facility (1 location): navigation system testing, AIS and ECDIS configuration review, vessel communications review, basic port/shore system evaluation, report and a follow-up review.", "includes": [ "Navigation system security testing on 1 vessel/facility", "AIS and ECDIS configuration review", "Vessel communication (satcom, radio) configuration review", "Shore/port system interface review", "Maritime security report and 90-day follow-up review" ], "excludes": [ "Active AIS/ECDIS spoofing and manipulation testing", "Radio frequency testing", "Vessel tracking system security", "Maritime IoT device testing" ], "limits": { "locations": 1 } }, { "id": "advanced", "name": "Advanced Maritime Security Program", "price_usd": 65000, "description": "Assessment of up to 3 vessels/port facilities. Adds active AIS and ECDIS testing, radio communication testing, vessel tracking security, and port system security evaluation. Includes a follow-up review.", "includes": [ "Everything in the Core tier, for up to 3 vessels/facilities", "Active AIS spoofing and ECDIS chart/update integrity testing", "Radio communication testing", "Vessel tracking security assessment", "Port system security evaluation" ], "excludes": [ "Maritime IoT device and sensor testing", "Custom test tooling", "Monitoring implementation" ], "limits": { "locations": 3 } }, { "id": "premium", "name": "Enterprise Maritime Security Solution", "price_usd": 95000, "description": "Assessment of up to 5 vessels/port facilities. Adds maritime IoT device testing (up to 15 device models), custom test tooling for proprietary bridge or cargo systems, and monitoring implementation with detection use cases. Larger fleets are scoped separately.", "includes": [ "Everything in the Advanced tier, for up to 5 vessels/facilities", "Maritime IoT device testing, up to 15 device models", "Custom test tooling for proprietary systems", "Monitoring implementation with maritime-specific detections", "Fleet-level security recommendations" ], "excludes": [ "Monitoring licences and onboard hardware", "24/7 monitoring operations", "Fleets above 5 vessels/facilities (scoped separately)" ], "limits": { "locations": 5, "devices": 15 } } ], "scope": [ "Navigation system testing", "AIS security assessment", "ECDIS security review", "Radio communication testing", "Port system security evaluation", "Vessel tracking security", "Maritime IoT device testing" ], "deliverables": [ "Maritime security report", "Navigation system analysis", "Communication security findings", "Port infrastructure recommendations", "Vessel tracking security guide", "Maritime IoT security assessment", "90-day follow-up review" ], "scope_url": "https://cisomarketplace.services/scope?service=maritime-systems-security-assessment" }, { "slug": "media-entertainment-security", "title": "Media & Entertainment Security Assessment", "url": "https://cisomarketplace.services/services/media-entertainment-security", "md_url": "https://cisomarketplace.services/services/media-entertainment-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment designed specifically for media and entertainment organizations, addressing the unique challenges of protecting intellectual property, pre-release content, production systems, and streaming platforms. Our specialized assessment helps studios, broadcasters, and content creators secure valuable digital assets, prevent piracy, and ensure operational continuity across production and distribution channels.", "from_price_usd": 42000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Media Security Assessment", "price_usd": 42000, "description": "Assessment for up to 250 employees and 1 production facility: pre-release content protection, production environment and content management system review, architecture review of 1 streaming platform, and up to 5 vendors.", "includes": [ "Pre-release content workflow and access review", "Production environment security review at 1 facility", "Content management system review", "Architecture review of 1 streaming platform", "Security review of up to 5 vendors", "Report and implementation roadmap" ], "excludes": [ "DRM assessment", "Anti-piracy measures evaluation", "Post-production and cloud production review", "Screening and distribution controls" ], "limits": { "employees": 250, "locations": 1, "vendors": 5, "web_apps": 1 } }, { "id": "standard", "name": "Comprehensive Media Security Program", "price_usd": 75000, "description": "Assessment for up to 1,000 employees, up to 3 facilities and up to 15 vendors. Adds digital rights management assessment, cloud-based and post-production security, screening and distribution controls, anti-piracy evaluation, and a content protection framework.", "includes": [ "Everything in the Essential tier, for up to 3 facilities", "Digital rights management assessment", "Cloud-based production and post-production security review", "Screening and distribution controls review", "Anti-piracy measures evaluation", "Content protection framework and third-party security requirements" ], "excludes": [ "Global, multi-region distribution network review", "IP protection strategy for the full catalogue", "More than 1 streaming platform" ], "limits": { "employees": 1000, "locations": 3, "vendors": 15, "web_apps": 1 } }, { "id": "premium", "name": "Premium Entertainment Security Framework", "price_usd": 120000, "description": "For studios with global operations: up to 10 facilities, up to 30 vendors and up to 3 streaming platforms; no fixed headcount cap - scoped. Adds distribution network review across regions, IP protection strategy, and title-level protection plans for high-value releases.", "includes": [ "Everything in the Comprehensive tier, for up to 10 facilities", "Global distribution network and partner delivery review", "IP protection strategy", "Protection plans for up to 3 high-value releases", "Streaming platform security enhancements for up to 3 platforms", "Executive briefing" ], "excludes": [ "Penetration testing of streaming platforms (separate service)", "Piracy takedown and monitoring operations", "Remediation implementation" ], "limits": { "locations": 10, "vendors": 30, "web_apps": 3 } } ], "scope": [ "Pre-release content protection", "Production environment security", "Digital rights management assessment", "Streaming platform security", "Content management system review", "Third-party vendor assessment", "Cloud-based production security", "Post-production security", "Screening and distribution controls", "Anti-piracy measures evaluation" ], "deliverables": [ "Media security assessment report", "Content protection framework", "IP protection strategy", "Production security recommendations", "Streaming platform security enhancements", "Third-party security requirements", "Digital rights management framework", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=media-entertainment-security" }, { "slug": "medical-device-security-assessment", "title": "Medical Device Security Assessment", "url": "https://cisomarketplace.services/services/medical-device-security-assessment", "md_url": "https://cisomarketplace.services/services/medical-device-security-assessment.md", "practice": "Offensive Security", "category_group": "Specialized", "description": "Specialized security testing for medical devices and healthcare technology, focusing on patient safety, data security, and regulatory compliance.", "from_price_usd": 32000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Medical Device Assessment", "price_usd": 32000, "description": "Security test of 1 device model over 1 communication interface: firmware analysis, authentication testing, patient data security review, remote access check, and HIPAA-oriented compliance review. Includes a retest.", "includes": [ "Testing of 1 device model on 1 interface (e.g. Ethernet or USB)", "Firmware analysis", "Authentication mechanism testing", "Patient data security review", "HIPAA compliance analysis", "Report, remediation roadmap, 90-day retest period" ], "excludes": [ "Wireless protocol testing (BLE, Wi-Fi, proprietary RF)", "Third-party component / SBOM analysis", "Companion app and cloud service testing", "Additional device models" ], "limits": { "devices": 1 } }, { "id": "advanced", "name": "Advanced Medical Device Assessment", "price_usd": 48000, "description": "Security test of 1 device model across all its interfaces. Adds wireless protocol testing, remote access and update channel testing, third-party component analysis, patient safety risk assessment, and detailed regulatory compliance guidance. Includes a retest.", "includes": [ "Everything in the Core tier, across all device interfaces", "Wireless protocol testing", "Remote access and update channel security testing", "Third-party component analysis", "Patient safety risk assessment", "Regulatory compliance guidance" ], "excludes": [ "Additional device models or variants", "Retest beyond 90 days", "Regulatory submission document authoring" ], "limits": { "devices": 1 } }, { "id": "premium", "name": "Enterprise Medical Device Assessment", "price_usd": 65000, "description": "Security test of up to 3 device models or variants across all interfaces. Adds firmware reverse engineering and exploit development for confirmed findings, a cross-device platform review, and an extended retest period.", "includes": [ "Everything in the Advanced tier, for up to 3 device models", "Firmware reverse engineering and exploit proof-of-concepts", "Shared platform / component review across devices", "Retest period extended to 180 days", "Engineering team readout" ], "excludes": [ "Regulatory submission document authoring", "Hospital network deployment assessment", "More than 3 device models (scoped separately)" ], "limits": { "devices": 3 } } ], "scope": [ "Device firmware analysis", "Wireless protocol testing", "Patient data security review", "Authentication mechanism testing", "Remote access security", "Regulatory compliance check", "Third-party component analysis" ], "deliverables": [ "Medical device security report", "HIPAA compliance analysis", "Patient safety risk assessment", "Data security recommendations", "Regulatory compliance guidance", "Remediation roadmap", "90-day retest period" ], "scope_url": "https://cisomarketplace.services/scope?service=medical-device-security-assessment" }, { "slug": "non-human-machine-identity-security", "title": "Non-Human & Machine Identity Security", "url": "https://cisomarketplace.services/services/non-human-machine-identity-security", "md_url": "https://cisomarketplace.services/services/non-human-machine-identity-security.md", "practice": "AI Security", "category_group": "Advisory / vCISO", "description": "Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Point-in-time review for up to 3 cloud accounts and up to 25 repositories: inventory of secrets, API keys and service accounts, exposure and over-privilege findings, and a risk-ranked inventory with rotation recommendations.", "includes": [ "Secrets and API key inventory", "Service account privilege review", "Repository secret scanning", "Risk-ranked identity inventory", "Rotation recommendations" ], "excludes": [ "Workload identities (Kubernetes, CI/CD, cloud roles)", "AI agent identities", "Secrets governance plan and lifecycle policy", "Vault implementation" ], "limits": { "cloud_accounts": 3, "repositories": 25 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "Assessment for up to 10 cloud accounts and up to 100 repositories. Adds workload identities (CI/CD, Kubernetes, cloud roles) and AI agent identities and their privileges, a secrets governance plan, lifecycle and rotation policy, and least-privilege and vaulting design.", "includes": [ "Everything in Essential at the larger scope", "Workload identity review", "AI agent identity and privilege review", "Secrets governance plan", "Lifecycle and rotation policy", "Vaulting and least-privilege design" ], "excludes": [ "Ongoing inventory refresh", "Vault or secrets manager implementation", "Rotating credentials on the client's behalf" ], "limits": { "cloud_accounts": 10, "repositories": 100 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Continuous machine-identity governance program", "includes": [], "excludes": [ "Vault or secrets manager licences", "Rotating credentials on the client's behalf" ], "limits": {} } ], "scope": [ "Secrets & API key inventory", "Service & workload identity review", "AI agent identity & privilege", "Rotation & lifecycle governance", "Least-privilege & vaulting" ], "deliverables": [ "NHI security assessment report", "Identity inventory & risk ranking", "Secrets governance plan", "Lifecycle & rotation recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=non-human-machine-identity-security" }, { "slug": "privacy-engineering-program", "title": "Privacy Engineering & Data Protection Program", "url": "https://cisomarketplace.services/services/privacy-engineering-program", "md_url": "https://cisomarketplace.services/services/privacy-engineering-program.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive service to implement privacy by design principles and data protection controls throughout your organization's systems and processes. Our program helps you architect privacy-enhancing technologies, implement data minimization strategies, and establish technical privacy controls that align with regulatory requirements while enhancing user trust.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Privacy Engineering Assessment", "price_usd": 45000, "description": "Privacy engineering review for up to 250 employees: data flow analysis of up to 3 systems, 1 regulation in scope, data minimization review, privacy-by-design recommendations, and implementation guidance for up to 5 priority controls.", "includes": [ "Data flow analysis of up to 3 systems", "Review against 1 privacy regulation", "Data minimization strategy", "Privacy-enhanced design recommendations", "Implementation guidance for up to 5 technical controls", "Privacy engineering roadmap" ], "excludes": [ "PIA methodology and templates", "Privacy-enhancing technology evaluation", "Data subject rights automation", "Monitoring and metrics" ], "limits": { "employees": 250, "frameworks": 1 } }, { "id": "advanced", "name": "Comprehensive Privacy Engineering Program", "price_usd": 75000, "description": "Program for up to 1,000 employees: up to 8 systems and up to 2 regulations. Adds privacy impact assessment methodology, privacy-enhancing technology evaluation, anonymization/pseudonymization design, data subject rights technical implementation, and a privacy monitoring framework.", "includes": [ "Everything in the Essential tier, for up to 8 systems", "Privacy impact assessment methodology and templates", "Privacy-enhancing technology evaluation", "Anonymization and pseudonymization design", "Data subject rights technical implementation design", "Privacy monitoring framework and metrics" ], "excludes": [ "Organization-wide data protection architecture", "Cross-border transfer assessment", "Hands-on implementation support", "Governance framework" ], "limits": { "employees": 1000, "frameworks": 2 } }, { "id": "enterprise", "name": "Enterprise Privacy Architecture Transformation", "price_usd": 120000, "description": "Advanced privacy engineering program with comprehensive data protection architecture, implementation support, and governance framework", "includes": [], "excludes": [ "Legal advice and DPO services", "Privacy tooling licences", "More than 15 systems (scoped separately)" ], "limits": { "frameworks": 4 } } ], "scope": [ "Privacy by design implementation", "Data flow analysis", "Privacy impact assessment methodology", "Privacy-enhancing technology evaluation", "Data minimization strategy", "Privacy control implementation", "Cross-border data transfer assessment", "Anonymization and pseudonymization techniques", "Data subject rights technical implementation", "Privacy monitoring framework" ], "deliverables": [ "Privacy engineering roadmap", "Technical privacy controls framework", "Data protection architecture", "Privacy-enhanced system design recommendations", "Data minimization implementation plan", "Technical controls documentation", "Privacy monitoring and metrics", "Privacy governance framework", "Data lifecycle management strategy" ], "scope_url": "https://cisomarketplace.services/scope?service=privacy-engineering-program" }, { "slug": "purple-team-assessment", "title": "Purple Team Assessment Program", "url": "https://cisomarketplace.services/services/purple-team-assessment", "md_url": "https://cisomarketplace.services/services/purple-team-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Collaborative security assessment combining red team attacks with blue team defense to improve detection and response capabilities in real-time.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Purple Team Assessment", "price_usd": 45000, "description": "Up to 5 joint scenarios run with your defensive team, with detection gaps recorded for each.", "includes": [ "Up to five joint scenarios", "Detection gap analysis", "Tuning recommendations" ], "excludes": [ "Writing custom detection rules for you" ], "limits": { "scenarios": 5, "locations": 1 } }, { "id": "advanced", "name": "Advanced Purple Team Program", "price_usd": 75000, "description": "Up to 10 joint scenarios, with detection rules drafted for each gap found.", "includes": [ "Up to ten joint scenarios", "Drafted detection rules", "Re-run of failed scenarios" ], "excludes": [ "24/7 monitoring" ], "limits": { "scenarios": 10, "locations": 2 } }, { "id": "premium", "name": "Enterprise Purple Team Solution", "price_usd": 120000, "description": "Up to 20 joint scenarios across up to 3 sites, with a re-test after tuning and an executive readout.", "includes": [ "Up to twenty joint scenarios", "Re-test after tuning", "Executive readout" ], "excludes": [ "Ongoing exercises — scoped as a retainer" ], "limits": { "scenarios": 20, "locations": 3 } } ], "scope": [ "Real-time attack simulations", "Defense capability testing", "Detection engineering validation", "Response procedure assessment", "Tool effectiveness evaluation" ], "deliverables": [ "Detailed attack narratives", "Detection gap analysis", "Defense improvement recommendations", "Custom detection rules (Advanced and Enterprise tiers)", "Response playbooks", "Training materials" ], "scope_url": "https://cisomarketplace.services/scope?service=purple-team-assessment" }, { "slug": "real-estate-property-security", "title": "Real Estate & Property Management Security Assessment", "url": "https://cisomarketplace.services/services/real-estate-property-security", "md_url": "https://cisomarketplace.services/services/real-estate-property-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security assessment for real estate firms, property managers, and building operators addressing the unique challenges of securing smart buildings, tenant management systems, and integrated building technologies. Our comprehensive evaluation helps protect property assets, tenant data, and emerging proptech applications.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Real Estate Security Assessment", "price_usd": 38000, "description": "One building and one property management platform: review of property management software, tenant data handling, access control and BMS configuration, with up to 25 IoT/building devices sampled. Report with implementation priorities.", "includes": [ "1 building", "Property management software security review", "Tenant data protection review", "Access control and BMS configuration review", "Up to 25 devices sampled", "Assessment report with priorities" ], "excludes": [ "Video surveillance and visitor management review", "Hands-on testing of smart building devices", "PropTech application guidelines", "More than 1 building" ], "limits": { "locations": 1, "web_apps": 1, "devices": 25 } }, { "id": "advanced", "name": "Comprehensive Property Security Program", "price_usd": 65000, "description": "Up to 3 buildings and up to 3 property/PropTech applications: all ten scope areas including video surveillance, visitor and maintenance management, with up to 100 devices tested. Adds the smart building framework, IoT policies and an access control enhancement plan.", "includes": [ "Up to 3 buildings", "All ten scope areas", "Up to 100 IoT/building devices tested", "Smart building security framework", "IoT security policies", "Access control enhancement plan" ], "excludes": [ "Portfolio-wide governance model", "Centralized monitoring design", "More than 3 buildings" ], "limits": { "locations": 3, "web_apps": 3, "devices": 100 } }, { "id": "portfolio", "name": "Real Estate Portfolio Security Framework", "price_usd": 95000, "description": "Portfolio engagement for up to 10 buildings and up to 5 applications, up to 250 devices tested: Advanced scope plus a portfolio control baseline, centralized monitoring design, governance model and a security integration roadmap. Larger portfolios are scoped separately.", "includes": [ "Up to 10 buildings", "Portfolio-wide control baseline", "Centralized monitoring design", "Governance model and roles", "Security integration roadmap", "Up to 250 devices tested" ], "excludes": [ "Operating the monitoring service", "Remediation or installation work", "Physical guard-force review" ], "limits": { "locations": 10, "web_apps": 5, "devices": 250 } } ], "scope": [ "Building management system security", "Smart building technology assessment", "Access control system evaluation", "Tenant data protection", "Property management software security", "IoT device security", "Integrated security systems", "Visitor management security", "Maintenance management security", "Video surveillance system review" ], "deliverables": [ "Real estate security assessment report", "Smart building security framework", "Tenant data protection strategy", "Building system security recommendations", "IoT security policies", "Access control security enhancement plan", "PropTech security guidelines", "Security integration roadmap", "Implementation priorities" ], "scope_url": "https://cisomarketplace.services/scope?service=real-estate-property-security" }, { "slug": "research-facility-security", "title": "Research Facility Security Program", "url": "https://cisomarketplace.services/services/research-facility-security", "md_url": "https://cisomarketplace.services/services/research-facility-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security assessment for research facilities, focusing on intellectual property protection, laboratory security, and research data safeguarding.", "from_price_usd": 55000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Research Security Assessment", "price_usd": 55000, "description": "One research site with up to 250 staff and up to 5 labs: IP protection review, laboratory physical security walk-through, research data handling evaluation and access control analysis. Delivers findings plus an IP protection framework.", "includes": [ "1 research site, up to 5 labs", "IP protection review", "Laboratory security walk-through", "Research data handling evaluation", "Access control analysis", "IP protection framework" ], "excludes": [ "Collaboration and external partner security review", "Research security architecture design", "Multiple sites", "Implementation of controls" ], "limits": { "locations": 1, "employees": 250 } }, { "id": "advanced", "name": "Advanced Research Security Program", "price_usd": 95000, "description": "Up to 3 sites and up to 1,000 staff: all five scope areas including collaboration security with external partners, every lab assessed rather than sampled, plus the research security architecture, data security strategy and collaboration guidelines.", "includes": [ "Up to 3 sites, all labs assessed", "Collaboration and partner security review", "Research security architecture", "Data security strategy", "Physical security recommendations", "Collaboration security guidelines" ], "excludes": [ "Custom protection tooling", "Program implementation and rollout", "More than 3 sites" ], "limits": { "locations": 3, "employees": 1000 } }, { "id": "premium", "name": "Enterprise Research Security Solution", "price_usd": 150000, "description": "Full-scope research security with custom protection tools and complete program implementation", "includes": [], "excludes": [ "Software or hardware purchase costs", "Physical security installation", "Ongoing managed monitoring after the term" ], "limits": {} } ], "scope": [ "Intellectual property protection review", "Laboratory security assessment", "Research data handling evaluation", "Access control analysis", "Collaboration security review" ], "deliverables": [ "Research security architecture", "IP protection framework", "Data security strategy", "Physical security recommendations", "Collaboration security guidelines" ], "scope_url": "https://cisomarketplace.services/scope?service=research-facility-security" }, { "slug": "retail-ecommerce-security", "title": "Retail & E-commerce Security Assessment", "url": "https://cisomarketplace.services/services/retail-ecommerce-security", "md_url": "https://cisomarketplace.services/services/retail-ecommerce-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment designed specifically for retail and e-commerce organizations, addressing the complex challenges of securing omnichannel retail environments, payment processing systems, customer data, and inventory management. Our specialized assessment helps retailers protect their brand, customer trust, and operational continuity across physical and digital retail channels.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Retail Security Assessment", "price_usd": 38000, "description": "Online-led retailers: 1 e-commerce platform and up to 5 store locations. E-commerce platform configuration, online payment flow, customer data protection and third-party integrations reviewed, POS reviewed at 1 representative store, with a PCI DSS gap analysis.", "includes": [ "E-commerce platform security review", "Online payment security and PCI DSS gap analysis", "Customer data protection review", "POS review at 1 representative store", "Third-party integrations review and roadmap" ], "excludes": [ "Mobile app security review", "Omnichannel, inventory and supply chain assessment", "Fraud prevention review", "Penetration testing of the storefront" ], "limits": { "web_apps": 1, "locations": 5 } }, { "id": "standard", "name": "Comprehensive Retail Security Program", "price_usd": 70000, "description": "Up to 3 e-commerce storefronts, up to 25 store locations and 1 customer mobile app. Adds omnichannel integration, inventory management, loyalty program data, in-store technology (POS sampled at 3 stores) and a fraud prevention control review.", "includes": [ "Everything in the online-led tier", "Omnichannel security strategy", "Mobile app security design review", "In-store technology and POS review at 3 sampled stores", "Fraud prevention and loyalty program control review" ], "excludes": [ "International operations and multi-country data handling", "Supply chain partner validation", "Penetration testing of apps or stores", "Remediation work" ], "limits": { "web_apps": 3, "locations": 25, "mobile_apps": 1 } }, { "id": "enterprise", "name": "Enterprise Retail Security Framework", "price_usd": 110000, "description": "Up to 5 storefronts, up to 100 store locations and up to 3 mobile apps, including international operations. Adds supply chain validation, multi-country customer data handling and POS review at 5 sampled stores per region.", "includes": [ "Everything in the standard tier", "Supply chain and logistics partner validation", "Multi-country customer data handling review", "Regional store sampling for in-store technology", "Executive briefing and phased implementation roadmap" ], "excludes": [ "Penetration testing and red teaming", "Formal PCI validation", "Managed fraud monitoring", "Chains above 100 locations (scoped separately)" ], "limits": { "web_apps": 5, "locations": 100, "mobile_apps": 3 } } ], "scope": [ "E-commerce platform security", "Point-of-sale system assessment", "Online payment security", "Customer data protection review", "Inventory management security", "Supply chain validation", "Omnichannel security integration", "Mobile application security", "In-store technology assessment", "Loyalty program data protection" ], "deliverables": [ "Retail security assessment report", "PCI DSS compliance gap analysis", "Customer data protection framework", "E-commerce security enhancement plan", "Point-of-sale security recommendations", "Omnichannel security strategy", "Third-party integrations review", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=retail-ecommerce-security" }, { "slug": "smb-advanced-tech", "title": "SMB Advanced Tech", "url": "https://cisomarketplace.services/services/smb-advanced-tech", "md_url": "https://cisomarketplace.services/services/smb-advanced-tech.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Modern tech stack security assessment for digital-first SMBs.", "from_price_usd": 7500, "price_cadence": "engagement", "tiers": [], "scope": [ "Container security review (up to 20 images)", "API security assessment (up to 3 APIs)", "Infrastructure-as-code review", "CI/CD pipeline security analysis", "Microservices architecture review", "Kubernetes security assessment", "DevSecOps maturity evaluation" ], "deliverables": [ "Technical findings report", "Security as code templates", "Pipeline security rules", "Container hardening guide", "API security specifications" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-advanced-tech" }, { "slug": "smb-security-complete", "title": "SMB Security Complete", "url": "https://cisomarketplace.services/services/smb-security-complete", "md_url": "https://cisomarketplace.services/services/smb-security-complete.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Full-spectrum security assessment covering all critical attack surfaces for established SMBs.", "from_price_usd": 8500, "price_cadence": "engagement", "tiers": [], "scope": [ "All Essentials components", "Wireless network security test", "Source code review (up to 10,000 LOC)", "Basic social engineering campaign", "30 days remediation support", "Policy and procedure review" ], "deliverables": [ "Comprehensive findings report", "Source code security analysis", "Wireless security assessment", "Social engineering metrics", "2-hour executive presentation", "90-day remediation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-security-complete" }, { "slug": "soc-maturity-incident-response-assessment", "title": "SOC Maturity & Incident Response Assessment", "url": "https://cisomarketplace.services/services/soc-maturity-incident-response-assessment", "md_url": "https://cisomarketplace.services/services/soc-maturity-incident-response-assessment.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive evaluation of your organization's Security Operations Center (SOC) capabilities and incident response readiness. Our assessment examines detection coverage, response procedures, team capabilities, and technology effectiveness to identify gaps in your security operations and provide a roadmap for enhanced threat detection and response capabilities.", "from_price_usd": 40000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential SOC & IR Assessment", "price_usd": 40000, "description": "One SOC site: maturity model scoring, IR procedure review, MITRE ATT&CK detection coverage analysis, alert triage and KPI evaluation, up to 6 analyst interviews. 180 consulting hours. IR procedures are walked through; no facilitated tabletop.", "includes": [ "SOC maturity model assessment", "IR procedure evaluation by walkthrough", "MITRE ATT&CK coverage analysis", "Alert triage and metrics evaluation", "Maturity report with prioritized recommendations" ], "excludes": [ "Facilitated tabletop exercise", "Detection engineering recommendations at rule level", "SOC team skills assessment", "Implementation support" ], "limits": { "locations": 1, "hours": 180 } }, { "id": "advanced", "name": "Comprehensive SOC Enhancement Program", "price_usd": 75000, "description": "Up to 2 SOC sites. Adds up to 2 IR tabletop scenarios for up to 20 participants, rule-level detection engineering recommendations, threat intelligence integration review, team skills assessment, and a sequenced roadmap. 330 consulting hours.", "includes": [ "Everything in the basic tier", "Up to 2 IR tabletop scenarios", "Rule-level detection engineering recommendations", "Threat hunting and threat intelligence integration review", "SOC team skills assessment", "Roadmap with timeline and prioritization" ], "excludes": [ "Writing and deploying the detections", "Hands-on technical incident simulation", "Implementation support after the roadmap" ], "limits": { "locations": 2, "scenarios": 2, "participants": 20, "hours": 330 } }, { "id": "enterprise", "name": "Enterprise Security Operations Transformation", "price_usd": 120000, "description": "Advanced SOC transformation with implementation support, custom detection engineering, and advanced incident simulation exercises", "includes": [], "excludes": [ "24x7 monitoring or staff augmentation", "Incident response retainer", "Tool licensing costs" ], "limits": { "scenarios": 4, "participants": 40 } } ], "scope": [ "SOC maturity model assessment", "Incident response procedure evaluation", "Detection coverage analysis", "Threat hunting capabilities review", "SOC technology stack assessment", "Analyst workflow evaluation", "Alert triage effectiveness", "Incident response tabletop exercise", "Metrics and KPI evaluation", "Threat intelligence integration", "MITRE ATT&CK coverage analysis", "SOC team skills assessment", "SIEM configuration analysis", "Detection rule coverage", "Alert triage process review" ], "deliverables": [ "SOC maturity assessment report", "Incident response capability analysis", "Detection gap recommendations", "SOC enhancement roadmap", "Tabletop exercise findings", "Technology optimization guidance", "Workflow improvement plan", "Metrics framework development", "Staffing and skills recommendations", "Implementation timeline and prioritization" ], "scope_url": "https://cisomarketplace.services/scope?service=soc-maturity-incident-response-assessment" }, { "slug": "security-architecture-review", "title": "Security Architecture Review", "url": "https://cisomarketplace.services/services/security-architecture-review", "md_url": "https://cisomarketplace.services/services/security-architecture-review.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive analysis of your organization's security architecture design, evaluating defense-in-depth strategies, security control effectiveness, and alignment with business objectives and threat models.", "from_price_usd": 40000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Architecture Assessment", "price_usd": 40000, "description": "One environment: up to 500 employees, up to 2 data centers/sites and up to 3 cloud accounts. Reviews segmentation, access control, identity architecture, data flows and security boundaries from diagrams, configs and workshops. One high-level threat model.", "includes": [ "Network segmentation and security boundary analysis", "Identity and authentication architecture review", "Data flow assessment for critical data", "One high-level threat model", "Control gap analysis and prioritized enhancement plan" ], "excludes": [ "Zero Trust implementation strategy", "Per-system threat models", "Reference architecture design", "Penetration testing or configuration scanning" ], "limits": { "employees": 500, "locations": 2, "cloud_accounts": 3 } }, { "id": "advanced", "name": "Advanced Architecture Program", "price_usd": 75000, "description": "Up to 2,500 employees, up to 5 sites and up to 10 cloud accounts. Adds documented threat models for up to 5 critical systems, a defense-in-depth control mapping and a phased Zero Trust implementation strategy.", "includes": [ "Everything in the core assessment", "Threat models for up to 5 critical systems", "Zero Trust compatibility assessment and phased strategy", "Defense-in-depth control mapping", "Risk mitigation roadmap" ], "excludes": [ "Target-state reference architecture", "Security governance framework", "Implementation or engineering work", "Penetration testing" ], "limits": { "employees": 2500, "locations": 5, "cloud_accounts": 10 } }, { "id": "enterprise", "name": "Enterprise Security Architecture Transformation", "price_usd": 125000, "description": "No fixed headcount cap - scoped. Up to 10 sites and up to 25 cloud accounts. Adds a target-state reference architecture, a multi-year modernization roadmap, threat models for up to 10 critical systems and an architecture governance framework (review board, standards, exceptions).", "includes": [ "Everything in the advanced tier", "Target-state reference architecture", "Multi-year modernization roadmap with sequencing", "Architecture governance framework", "Threat models for up to 10 critical systems" ], "excludes": [ "Building or deploying the target architecture", "Product selection RFPs", "Penetration testing", "Ongoing architecture review board participation" ], "limits": { "locations": 10, "cloud_accounts": 25 } } ], "scope": [ "Network segmentation analysis", "Access control frameworks", "Data flow assessment", "Security boundary evaluation", "Defense-in-depth review", "Zero Trust framework compatibility", "Identity and authentication architecture review" ], "deliverables": [ "Detailed architecture assessment report", "Security control gap analysis", "Reference architecture recommendations", "Risk mitigation roadmap", "Prioritized security enhancement plan", "Threat modeling documentation" ], "scope_url": "https://cisomarketplace.services/scope?service=security-architecture-review" }, { "slug": "smart-city-infrastructure-assessment", "title": "Smart City Infrastructure Assessment", "url": "https://cisomarketplace.services/services/smart-city-infrastructure-assessment", "md_url": "https://cisomarketplace.services/services/smart-city-infrastructure-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security evaluation of smart city technologies, including traffic systems, surveillance networks, and municipal IoT deployments.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Infrastructure Assessment", "price_usd": 45000, "description": "Two system types - traffic control and emergency response - in 1 municipality: security testing of each with up to 25 field devices sampled, critical vulnerability assessment and public safety impact analysis. Includes a follow-up review.", "includes": [ "Traffic control system testing", "Emergency response system testing", "Up to 25 field devices sampled", "Public safety impact analysis", "120-day follow-up assessment" ], "excludes": [ "Smart lighting, public WiFi and surveillance systems", "Cross-system integration testing", "Privacy impact analysis", "Reassessments" ], "limits": { "locations": 1, "devices": 25 } }, { "id": "advanced", "name": "Comprehensive Infrastructure Assessment", "price_usd": 75000, "description": "All six system types in 1 municipality with up to 100 devices sampled: adds smart lighting, municipal IoT, public WiFi and surveillance, cross-system integration testing and privacy impact analysis. Includes a follow-up review.", "includes": [ "All six system types", "Up to 100 devices sampled", "Cross-system integration testing", "Privacy impact analysis", "Remediation strategy guide", "120-day follow-up assessment" ], "excludes": [ "Quarterly reassessment", "Monitoring after the assessment", "Device samples above 100" ], "limits": { "locations": 1, "devices": 100 } }, { "id": "premium", "name": "Enterprise Infrastructure Assessment", "price_usd": 95000, "description": "Complete smart city security program including all systems, extended monitoring, and quarterly reassessment", "includes": [], "excludes": [ "Remediation work", "Additional municipalities" ], "limits": { "locations": 1, "devices": 250, "sessions": 4 } } ], "scope": [ "Traffic control system testing", "Smart lighting security review", "Municipal IoT device assessment", "Emergency response system testing", "Public WiFi security evaluation", "Surveillance system security review", "Cross-system integration testing", "Municipal service platform and data-integration security", "Security architecture review (top tier)" ], "deliverables": [ "Smart city security report", "Critical vulnerability assessment", "Integration security analysis", "Public safety impact analysis", "Privacy protection recommendations", "Remediation strategy guide", "120-day follow-up assessment" ], "scope_url": "https://cisomarketplace.services/scope?service=smart-city-infrastructure-assessment" }, { "slug": "social-engineering-assessment", "title": "Social Engineering Campaign Assessment", "url": "https://cisomarketplace.services/services/social-engineering-assessment", "md_url": "https://cisomarketplace.services/services/social-engineering-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive social engineering assessment including phishing campaigns, vishing attacks, physical security testing, and employee awareness evaluation.", "from_price_usd": 7500, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 7500, "description": "One email-only exercise for up to 100 staff with a results report. The smallest version of this work.", "includes": [ "One email exercise", "Results by department", "Awareness recommendations" ], "excludes": [ "Phone-based and on-site exercises", "Follow-up training" ], "limits": { "employees": 100, "scenarios": 1 } }, { "id": "basic", "name": "Core Social Engineering Assessment", "price_usd": 25000, "description": "Email exercises for up to 500 staff: 2 campaigns plus an awareness baseline.", "includes": [ "Two email campaigns", "Awareness baseline", "Executive summary" ], "excludes": [ "Phone-based and on-site exercises" ], "limits": { "employees": 500, "scenarios": 2 } }, { "id": "advanced", "name": "Advanced Social Engineering Program", "price_usd": 45000, "description": "Email and phone exercises for up to 2,000 staff, plus on-site testing at one location.", "includes": [ "Email and phone exercises", "On-site testing at one location", "Targeted coaching for repeat responders" ], "excludes": [ "More than one on-site location" ], "limits": { "employees": 2000, "scenarios": 4, "locations": 1 } }, { "id": "premium", "name": "Enterprise Social Engineering Solution", "price_usd": 75000, "description": "All channels for up to 5,000 staff, on-site testing at up to 3 locations and a follow-up awareness program.", "includes": [ "All channels", "Up to three on-site locations", "Follow-up awareness program" ], "excludes": [ "Ongoing monthly simulations — see Managed Security Awareness" ], "limits": { "employees": 5000, "scenarios": 8, "locations": 3 } } ], "scope": [ "Phishing campaign development", "Vishing attack scenarios", "Physical security tests", "Employee awareness evaluation", "Access control testing", "Removable-media and tailgating exercises (upper tiers)", "Training session for the groups that responded (upper tiers)" ], "deliverables": [ "Campaign effectiveness report", "Employee vulnerability analysis", "Security awareness recommendations", "Training program design", "Response procedure assessment" ], "scope_url": "https://cisomarketplace.services/scope?service=social-engineering-assessment" }, { "slug": "software-supply-chain-security", "title": "Software Supply Chain Security Assessment", "url": "https://cisomarketplace.services/services/software-supply-chain-security", "md_url": "https://cisomarketplace.services/services/software-supply-chain-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive evaluation of your organization's software supply chain security posture, examining third-party dependencies, build processes, and deployment pipelines. Our assessment identifies vulnerabilities in your software supply chain and provides strategies to mitigate risks from compromised components, malicious packages, and insecure development practices.", "from_price_usd": 36000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Supply Chain Security Review", "price_usd": 36000, "description": "Up to 10 repositories, 1 CI/CD platform and up to 25 developers: third-party dependency review of critical applications, build pipeline and CI/CD control review, package repository settings, and code signing practices. Risk report.", "includes": [ "Up to 10 repositories", "Dependency review of critical applications", "Build pipeline and CI/CD control review", "Package repository security review", "Code signing practice review", "Risk assessment report" ], "excludes": [ "SBOM generation and implementation", "Container image security", "Provenance verification", "Governance framework" ], "limits": { "repositories": 10, "developers": 25 } }, { "id": "standard", "name": "Comprehensive Supply Chain Security Program", "price_usd": 65000, "description": "Up to 25 repositories, up to 3 CI/CD platforms and up to 100 developers: all nine scope areas including container images and provenance verification, SBOMs generated for in-scope applications, and a dependency vulnerability management process.", "includes": [ "Up to 25 repositories", "All nine scope areas", "SBOM generation and implementation strategy", "Container image security", "Provenance verification", "Vulnerability management process" ], "excludes": [ "Automated policy gates built into pipelines", "Governance framework", "Regulatory compliance mapping" ], "limits": { "repositories": 25, "developers": 100 } }, { "id": "enterprise", "name": "Enterprise Supply Chain Security Framework", "price_usd": 95000, "description": "Up to 100 repositories and up to 250 developers: Standard scope plus automated controls (dependency, signing and SBOM gates) implemented in pipelines, a supply chain governance framework, and mapping to the customer's named regulatory requirements.", "includes": [ "Up to 100 repositories", "Automated pipeline gates implemented", "Governance framework", "Code signing framework", "Regulatory compliance guidance" ], "excludes": [ "Tool licence costs", "Ongoing managed monitoring", "Application source code review for vulnerabilities" ], "limits": { "repositories": 100, "developers": 250 } } ], "scope": [ "Third-party dependency review", "Build pipeline security assessment", "Code signing practices", "Package repository security", "Provenance verification", "CI/CD security controls", "Container image security", "Dependency vulnerability management", "SBOM generation and management", "Artifact signing process evaluation", "Container and base-image security analysis" ], "deliverables": [ "Software supply chain risk assessment report", "Dependency security analysis", "Build pipeline security recommendations", "SBOM implementation strategy", "Code signing framework", "Repository security controls", "Vulnerability management process", "Regulatory compliance guidance" ], "scope_url": "https://cisomarketplace.services/scope?service=software-supply-chain-security" }, { "slug": "wireless-attack-assessment", "title": "Wireless Infrastructure Attack Assessment", "url": "https://cisomarketplace.services/services/wireless-attack-assessment", "md_url": "https://cisomarketplace.services/services/wireless-attack-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Advanced wireless security testing including WiFi, Bluetooth, RF, and cellular network attack simulation and vulnerability assessment.", "from_price_usd": 10000, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 10000, "description": "Single-office WiFi assessment: up to 5 networks. The smallest version of this work.", "includes": [ "One office", "WiFi only", "Findings report" ], "excludes": [ "Bluetooth and other radio protocols", "More than one site" ], "limits": { "locations": 1, "devices": 5 } }, { "id": "basic", "name": "Core Wireless Attack Assessment", "price_usd": 35000, "description": "Essential wireless security testing covering basic WiFi and Bluetooth attacks", "includes": [ "WiFi and Bluetooth", "Up to two sites" ], "excludes": [ "Cellular and other radio protocols" ], "limits": { "locations": 2, "devices": 15 } }, { "id": "advanced", "name": "Advanced Wireless Attack Program", "price_usd": 60000, "description": "WiFi, Bluetooth and additional radio protocols at up to 4 sites.", "includes": [ "Additional radio protocols", "Up to four sites" ], "excludes": [ "Custom tooling" ], "limits": { "locations": 4, "devices": 40 } }, { "id": "premium", "name": "Enterprise Wireless Attack Solution", "price_usd": 95000, "description": "All radio technologies at up to 8 sites, with custom tooling handed over at the end.", "includes": [ "All radio technologies", "Up to eight sites", "Tooling handover" ], "excludes": [ "Ongoing monitoring" ], "limits": { "locations": 8, "devices": 100 } } ], "scope": [ "WiFi network penetration testing", "Bluetooth security assessment", "RF protocol analysis", "Cellular network security testing", "Wireless IoT device evaluation" ], "deliverables": [ "Wireless vulnerability report", "Attack scenario documentation", "Security control recommendations", "Encryption assessment results", "Protocol security analysis" ], "scope_url": "https://cisomarketplace.services/scope?service=wireless-attack-assessment" }, { "slug": "zero-trust-security-assessment", "title": "Zero Trust Security Assessment", "url": "https://cisomarketplace.services/services/zero-trust-security-assessment", "md_url": "https://cisomarketplace.services/services/zero-trust-security-assessment.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Comprehensive evaluation of your organization's zero trust architecture implementation, examining identity verification, network segmentation, and access controls. Our assessment identifies gaps in your zero trust strategy and provides a roadmap for enhancing security beyond traditional perimeter-based approaches.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Zero Trust Readiness Assessment", "price_usd": 38000, "description": "Zero trust readiness review for up to 500 employees, up to 3 locations and up to 2 cloud accounts: current-state maturity scoring across identity, devices, network, data and policy enforcement from interviews and document review, with a gap list and next steps.", "includes": [ "Maturity scoring across zero trust pillars", "Identity and access management evaluation", "Device trust and least-privilege review", "Gap list with next steps", "1 readout" ], "excludes": [ "Hands-on configuration review", "Phased implementation roadmap", "Technology stack recommendations", "Microsegmentation design" ], "limits": { "employees": 500, "locations": 3, "cloud_accounts": 2 } }, { "id": "standard", "name": "Comprehensive Zero Trust Program", "price_usd": 65000, "description": "Assessment for up to 2,500 employees, up to 10 locations and up to 5 cloud accounts. Adds configuration review of identity, segmentation and traffic inspection controls, a phased implementation roadmap, identity strategy and technology stack recommendations.", "includes": [ "Configuration review of identity and network controls", "Microsegmentation assessment", "Phased implementation roadmap", "Identity strategy recommendations", "Technology stack recommendations", "Continuous monitoring strategy" ], "excludes": [ "Target architecture design", "Microsegmentation policy design", "Vendor selection support", "Implementation work" ], "limits": { "employees": 2500, "locations": 10, "cloud_accounts": 5 } }, { "id": "advanced", "name": "Enterprise Zero Trust Transformation", "price_usd": 95000, "description": "No fixed headcount or location cap (scoped at kickoff). Everything in Standard plus target zero trust architecture design, microsegmentation design guidance, a policy enforcement framework, implementation planning by workstream and integration design with existing tools.", "includes": [ "Scope set at kickoff, no fixed cap", "Target architecture design", "Microsegmentation design guidance", "Policy enforcement framework", "Workstream implementation plan", "Integration design with existing tools" ], "excludes": [ "Deployment and configuration of products", "Product licences", "Ongoing operation of the zero trust controls" ], "limits": {} } ], "scope": [ "Identity and access management evaluation", "Microsegmentation assessment", "Continuous verification analysis", "Least privilege implementation review", "Network traffic inspection capabilities", "Device trust verification", "Data protection controls", "Zero trust policy enforcement" ], "deliverables": [ "Zero trust maturity assessment report", "Architecture gap analysis", "Implementation roadmap", "Identity strategy recommendations", "Microsegmentation design guidance", "Policy enforcement framework", "Continuous monitoring strategy", "Technology stack recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=zero-trust-security-assessment" }, { "slug": "ai-governance-trism-program", "title": "AI Governance & TRiSM Program", "url": "https://cisomarketplace.services/services/ai-governance-trism-program", "md_url": "https://cisomarketplace.services/services/ai-governance-trism-program.md", "practice": "AI Security", "category_group": "Compliance & GRC", "description": "Stand up AI governance (TRiSM): inventory AI systems, classify risk, map to EU AI Act / NIST AI RMF / ISO 42001, and operate ongoing AI risk, trust, and security management with human oversight.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Inventory and risk classification of up to 10 AI systems and a gap analysis against 1 framework chosen from EU AI Act, NIST AI RMF and ISO 42001. Delivers the inventory, risk tiers and gap list.", "includes": [ "Up to 10 AI systems inventoried", "Risk classification per system", "Gap analysis against 1 framework", "Prioritized gap list" ], "excludes": [ "AI policy and oversight framework", "AI risk register", "Model risk and bias governance", "Ongoing risk management" ], "limits": { "ai_systems": 10, "frameworks": 1 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "AI governance framework for up to 25 AI systems: inventory and classification, mapping to EU AI Act, NIST AI RMF and ISO 42001 (3 frameworks), AI policy and oversight pack, model risk and bias governance, and an AI risk register.", "includes": [ "Up to 25 AI systems", "Mapping to 3 frameworks", "AI policy and oversight pack", "Model risk and bias governance procedures", "AI risk register" ], "excludes": [ "Operating the program after handover", "Oversight board facilitation", "Technical model testing or red teaming" ], "limits": { "ai_systems": 25, "frameworks": 3 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Continuous AI TRiSM program with oversight board", "includes": [], "excludes": [ "Technical model testing or red teaming", "Legal advice or regulatory filings", "Certification audit fees" ], "limits": { "frameworks": 3, "sessions": 4 } } ], "scope": [ "AI system inventory & risk classification", "EU AI Act / NIST AI RMF / ISO 42001 mapping", "AI policy & oversight framework", "Model risk & bias governance", "Ongoing AI risk management" ], "deliverables": [ "AI governance framework", "AI Act/RMF/42001 gap analysis", "AI risk register", "Oversight & policy pack" ], "scope_url": "https://cisomarketplace.services/scope?service=ai-governance-trism-program" }, { "slug": "cmmc-level-1-2-readiness", "title": "CMMC 2.0 Level 1 & 2 Readiness (NIST SP 800-171)", "url": "https://cisomarketplace.services/services/cmmc-level-1-2-readiness", "md_url": "https://cisomarketplace.services/services/cmmc-level-1-2-readiness.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "For contractors handling FCI or CUI. We scope the CUI boundary, assess all NIST SP 800-171 practices, calculate and document your SPRS score, write the System Security Plan and POA&M, and prepare you for self-assessment or a C3PAO assessment. CMMC phase-in dates have moved more than once; NIST SP 800-171 and DFARS 252.204-7012 obligations apply regardless, so we plan against the requirement rather than a single deadline.", "from_price_usd": 9500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential CMMC Level 1 Readiness", "price_usd": 9500, "description": "FCI only: 17 practices, self-assessment package and annual affirmation support", "includes": [], "excludes": [ "CUI — Level 1 covers FCI only", "SSP and POA&M authoring" ], "limits": { "users": 100, "locations": 2 } }, { "id": "advanced", "name": "Advanced CMMC Level 2 Readiness", "price_usd": 22000, "description": "CUI, single enclave up to 250 users: full 110-practice gap assessment, SPRS score, SSP and POA&M", "includes": [], "excludes": [], "limits": { "users": 250, "locations": 3 } }, { "id": "enterprise", "name": "Enterprise CMMC Level 2 Program", "price_usd": 45000, "description": "Multiple enclaves or 250+ users: adds enclave design, remediation oversight and a mock C3PAO assessment", "includes": [], "excludes": [], "limits": { "users": 2500, "locations": 15 } } ], "scope": [ "CUI / FCI scoping and enclave boundary definition", "NIST SP 800-171 practice-by-practice gap assessment", "SPRS score calculation and documentation", "System Security Plan and POA&M authoring", "Self-assessment or C3PAO assessment preparation" ], "deliverables": [ "Gap assessment report with SPRS score", "System Security Plan (SSP)", "Plan of Action & Milestones (POA&M)", "Assessment-readiness checklist" ], "scope_url": "https://cisomarketplace.services/scope?service=cmmc-level-1-2-readiness" }, { "slug": "california-privacy-law-assessment", "title": "California Privacy Law Assessment (CCPA/CPRA)", "url": "https://cisomarketplace.services/services/california-privacy-law-assessment", "md_url": "https://cisomarketplace.services/services/california-privacy-law-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's compliance with California's privacy regulations, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Our assessment examines data handling practices, consumer rights processes, and disclosure requirements to identify compliance gaps and provide a detailed remediation roadmap.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential California Privacy Assessment", "price_usd": 35000, "description": "CCPA/CPRA applicability determination and gap assessment for up to 250 employees: personal information inventory of up to 15 systems, privacy notice and policy review, consumer request process check, up to 10 service provider agreements.", "includes": [ "Up to 250 employees, up to 15 systems inventoried", "Applicability determination", "Privacy notice and policy review", "Review of up to 10 service provider agreements", "Compliance report and roadmap" ], "excludes": [ "Drafting updated notices and procedures", "Consumer rights procedure build-out", "Data retention schedule", "Other privacy frameworks" ], "limits": { "employees": 250, "vendors": 10, "frameworks": 1 } }, { "id": "standard", "name": "Comprehensive California Privacy Program", "price_usd": 60000, "description": "CCPA/CPRA assessment for up to 1,000 employees: data mapping of up to 40 systems, up to 25 service provider agreements, plus drafted privacy disclosures, consumer rights procedures, retention guidelines and vendor management framework.", "includes": [ "Up to 1,000 employees, up to 40 systems mapped", "Review of up to 25 service provider agreements", "Drafted notices and privacy disclosures", "Consumer rights request procedures", "Data retention guidelines and vendor framework" ], "excludes": [ "Hands-on implementation in your systems", "Integration with other privacy frameworks", "Post-project compliance maintenance" ], "limits": { "employees": 1000, "vendors": 25, "frameworks": 1 } }, { "id": "enterprise", "name": "Enterprise California Compliance Framework", "price_usd": 95000, "description": "Advanced compliance program for complex organizations with custom implementation support, integration with other privacy frameworks, and ongoing compliance maintenance", "includes": [], "excludes": [ "Legal representation or regulator filings", "Privacy tooling licences" ], "limits": { "vendors": 50, "frameworks": 3 } } ], "scope": [ "CCPA/CPRA applicability assessment", "Personal information inventory", "Consumer rights implementation review", "Privacy notice evaluation", "Do Not Sell implementation assessment", "Sensitive personal information handling", "Data retention practices", "Service provider agreement review", "Employee data handling assessment", "Consumer request process evaluation", "Privacy policy review", "Risk assessment methodology" ], "deliverables": [ "California privacy compliance report", "Applicability determination", "Data inventory and mapping", "Consumer rights procedure recommendations", "Notice requirements implementation plan", "Privacy disclosure updates", "Vendor management framework", "Data retention guidelines", "Implementation roadmap and timeline", "Compliance monitoring strategy" ], "scope_url": "https://cisomarketplace.services/scope?service=california-privacy-law-assessment" }, { "slug": "compliance-automation-implementation-managed-compliance", "title": "Compliance Automation Implementation & Managed Compliance", "url": "https://cisomarketplace.services/services/compliance-automation-implementation-managed-compliance", "md_url": "https://cisomarketplace.services/services/compliance-automation-implementation-managed-compliance.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Compliance automation platforms collect evidence; they do not write your policies, fix failing tests, scope your audit or answer your auditor. We implement the platform against your real environment, author policies that match how you work, close the failing controls, prepare you for the audit and stay on as the managed compliance team if you want one. Platform-neutral: we work with the tool you chose and never take a fee from an auditor.", "from_price_usd": 8500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Implementation", "price_usd": 8500, "description": "One framework (SOC 2 or ISO 27001), one cloud environment: platform setup, policies and remediation plan", "includes": [], "excludes": [], "limits": { "frameworks": 1, "cloud_accounts": 1, "employees": 150 } }, { "id": "advanced", "name": "Advanced Implementation", "price_usd": 16500, "description": "Two frameworks or a complex environment: adds hands-on remediation, vendor risk module and auditor liaison through fieldwork", "includes": [], "excludes": [], "limits": { "frameworks": 2, "cloud_accounts": 5, "employees": 750 } }, { "id": "enterprise", "name": "Enterprise Implementation & Managed Compliance", "price_usd": 28000, "description": "Multi-framework programs: adds custom control mapping, internal audit, and transition into a monthly managed compliance retainer", "includes": [], "excludes": [], "limits": { "frameworks": 5, "cloud_accounts": 25, "employees": 5000 } } ], "scope": [ "Platform configuration and integration of cloud, identity, HR and code systems", "Policy authoring matched to your operations", "Remediation of failing automated tests", "Audit scoping, auditor selection support and evidence review", "Optional ongoing managed compliance" ], "deliverables": [ "Configured compliance platform with passing controls", "Approved policy set", "Audit-readiness report", "Managed compliance runbook (if retained)" ], "scope_url": "https://cisomarketplace.services/scope?service=compliance-automation-implementation-managed-compliance" }, { "slug": "data-privacy-compliance", "title": "Data Privacy Compliance Program", "url": "https://cisomarketplace.services/services/data-privacy-compliance", "md_url": "https://cisomarketplace.services/services/data-privacy-compliance.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive data privacy compliance program covering GDPR, CCPA, and other international privacy regulations with implementation support.", "from_price_usd": 50000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Privacy Compliance Assessment", "price_usd": 50000, "description": "GDPR and CCPA assessment for up to 250 employees and up to 15 data-processing vendors: data mapping of up to 25 systems, consent management review, privacy impact assessment, gap report and roadmap.", "includes": [ "GDPR and CCPA gap assessment", "Data mapping of up to 25 systems", "Consent management review", "1 privacy impact assessment", "Implementation roadmap" ], "excludes": [ "Privacy laws beyond GDPR and CCPA", "Policy and notice drafting", "Control implementation support", "Training delivery" ], "limits": { "frameworks": 2, "employees": 250, "vendors": 15 } }, { "id": "advanced", "name": "Advanced Privacy Compliance Program", "price_usd": 85000, "description": "Comprehensive program including international privacy laws and detailed implementation support", "includes": [], "excludes": [ "Ongoing program management after hand-off", "Compliance monitoring reviews", "Legal opinions or DPO-as-a-service" ], "limits": { "frameworks": 5, "employees": 1000, "vendors": 50 } }, { "id": "premium", "name": "Enterprise Privacy Compliance Solution", "price_usd": 135000, "description": "Full-scope privacy program with custom frameworks, automated monitoring, and complete program management", "includes": [], "excludes": [ "Licences for privacy management or consent software", "Legal representation before regulators", "Acting as the appointed DPO" ], "limits": { "frameworks": 10, "employees": 5000, "vendors": 150 } } ], "scope": [ "GDPR compliance assessment", "CCPA requirements review", "International privacy law analysis", "Data mapping exercise", "Privacy control implementation", "Consent management review" ], "deliverables": [ "Privacy impact assessment", "Data protection framework", "Implementation roadmap", "Policy documentation", "Training materials", "Compliance monitoring plan" ], "scope_url": "https://cisomarketplace.services/scope?service=data-privacy-compliance" }, { "slug": "data-privacy-impact-assessment", "title": "Data Privacy Impact Assessment", "url": "https://cisomarketplace.services/services/data-privacy-impact-assessment", "md_url": "https://cisomarketplace.services/services/data-privacy-impact-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Systematic evaluation of data handling practices to ensure compliance with privacy regulations and identify potential privacy risks.", "from_price_usd": 20000, "price_cadence": "engagement", "tiers": [ { "id": "small", "name": "Small Organization DPIA", "price_usd": 20000, "description": "DPIA for an organization of up to 100 employees: up to 5 processing activities and up to 5 third-party data recipients. Data flow maps, privacy risk assessment, consent mechanism review, report with mitigations and roadmap.", "includes": [ "Data flow mapping for up to 5 processing activities", "Privacy risk assessment with rated risks", "Consent mechanism review", "Third-party sharing analysis for up to 5 recipients", "DPIA report, gap analysis and roadmap" ], "excludes": [ "More than 5 processing activities", "Implementing the recommended controls", "Policy or notice drafting", "Regulator consultation" ], "limits": { "employees": 100, "vendors": 5 } }, { "id": "medium", "name": "Medium Organization DPIA", "price_usd": 35000, "description": "DPIA for up to 500 employees: up to 15 processing activities and up to 15 third-party data recipients. Same method as Small with workshops per business unit and a data protection controls evaluation per system.", "includes": [ "Data flow mapping for up to 15 processing activities", "Workshops with each business unit in scope", "Data protection controls evaluation per system", "Third-party sharing analysis for up to 15 recipients", "DPIA report, gap analysis and roadmap" ], "excludes": [ "More than 15 processing activities", "Implementing the recommended controls", "Policy or notice drafting" ], "limits": { "employees": 500, "vendors": 15 } }, { "id": "large", "name": "Large Organization DPIA", "price_usd": 55000, "description": "DPIA for up to 2,500 employees: up to 40 processing activities and up to 40 third-party data recipients, including cross-border transfers. Larger estates are scoped separately.", "includes": [ "Data flow mapping for up to 40 processing activities", "Cross-border transfer analysis", "Data protection controls evaluation per system", "Third-party sharing analysis for up to 40 recipients", "Consolidated DPIA report with per-activity annexes", "Roadmap with owners" ], "excludes": [ "Implementing the recommended controls", "Full privacy program build (see Data Privacy Compliance Program)", "Legal opinions" ], "limits": { "employees": 2500, "vendors": 40 } } ], "scope": [ "Data flow mapping", "Privacy risk assessment", "Consent mechanism review", "Data protection controls evaluation", "Third-party data sharing analysis" ], "deliverables": [ "Privacy impact assessment report", "Risk mitigation recommendations", "Privacy control improvements", "Compliance gap analysis", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=data-privacy-impact-assessment" }, { "slug": "data-security-posture-management-dspm-assessment", "title": "Data Security Posture Management (DSPM) Assessment", "url": "https://cisomarketplace.services/services/data-security-posture-management-dspm-assessment", "md_url": "https://cisomarketplace.services/services/data-security-posture-management-dspm-assessment.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Discover known and shadow data across cloud and on-prem, classify sensitive data, map access and flows, and remediate exposure. Establishes a continuous data security posture aligned to privacy regimes.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Discovery and classification of up to 10 priority data stores in up to 2 cloud accounts. Cloud only. Delivers a data inventory with sensitivity classes and a list of exposed stores.", "includes": [ "Up to 10 priority data stores", "Up to 2 cloud accounts", "Sensitive/regulated data classification", "Data inventory and exposure findings" ], "excludes": [ "On-prem data stores", "Access and entitlement mapping", "Data flow analysis", "Shadow data discovery beyond the named stores" ], "limits": { "cloud_accounts": 2 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "DSPM assessment across up to 10 cloud accounts and up to 3 on-prem locations, up to 50 data stores including shadow-data discovery, with access/entitlement mapping, data flow and exposure analysis and a prioritized remediation roadmap.", "includes": [ "Up to 50 data stores, cloud and on-prem", "Shadow data discovery", "Access and entitlement mapping", "Data flow and exposure analysis", "Remediation roadmap" ], "excludes": [ "Ongoing monitoring after the report", "Remediation implementation", "Data governance operating model" ], "limits": { "cloud_accounts": 10, "locations": 3 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Continuous DSPM program with monitoring + governance", "includes": [], "excludes": [ "DSPM tool licence costs", "Hands-on remediation in your systems", "Privacy legal advice" ], "limits": { "cloud_accounts": 25, "locations": 5 } } ], "scope": [ "Data discovery (cloud + on-prem + shadow)", "Classification of sensitive/regulated data", "Access & entitlement mapping", "Data flow & exposure analysis", "Remediation prioritization" ], "deliverables": [ "DSPM assessment report", "Data inventory & classification", "Exposure & access findings", "Remediation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=data-security-posture-management-dspm-assessment" }, { "slug": "employee-security-awareness-assessment", "title": "Employee Security Awareness Assessment", "url": "https://cisomarketplace.services/services/employee-security-awareness-assessment", "md_url": "https://cisomarketplace.services/services/employee-security-awareness-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive assessment of employee security awareness levels to identify training needs and security culture gaps.", "from_price_usd": 15000, "price_cadence": "engagement", "tiers": [ { "id": "small", "name": "Small Organization Assessment", "price_usd": 15000, "description": "Awareness assessment for up to 100 employees at 1 location: 1 survey, 1 phishing simulation campaign, 1 knowledge assessment and up to 10 interviews. Report with training needs, benchmarks and a program roadmap.", "includes": [ "Security awareness survey for all staff in scope", "1 phishing simulation campaign", "Knowledge assessment", "Up to 10 staff interviews", "Assessment report, training needs analysis and roadmap" ], "excludes": [ "Repeat phishing campaigns", "Per-department breakdown", "Training content or delivery", "Ongoing phishing platform subscription" ], "limits": { "employees": 100, "locations": 1, "scenarios": 1, "participants": 10 } }, { "id": "medium", "name": "Medium Organization Assessment", "price_usd": 25000, "description": "Awareness assessment for up to 500 employees and up to 3 locations: survey, 2 phishing simulation campaigns of different difficulty, knowledge assessment and up to 25 interviews. Results broken down by department.", "includes": [ "Survey and knowledge assessment for all staff in scope", "2 phishing simulation campaigns", "Up to 25 staff interviews", "Per-department results and benchmarks", "Culture evaluation", "Training needs analysis and roadmap" ], "excludes": [ "Role-targeted campaigns (executives, finance, IT)", "Training content or delivery", "Ongoing phishing platform subscription" ], "limits": { "employees": 500, "locations": 3, "scenarios": 2, "participants": 25 } }, { "id": "large", "name": "Large Organization Assessment", "price_usd": 40000, "description": "For more than 500 employees; no fixed cap on headcount and locations - scoped at kickoff. Survey, 3 phishing campaigns including one targeted at high-risk roles, knowledge assessment and up to 50 interviews. Results by department, site and role.", "includes": [ "Survey and knowledge assessment for all staff in scope", "3 phishing campaigns, 1 targeted at executives, finance and IT", "Up to 50 staff interviews and focus groups", "Results by department, site and role", "Culture evaluation with benchmarks", "Multi-year awareness program roadmap" ], "excludes": [ "Training content development", "Training delivery", "Ongoing phishing platform subscription", "Vishing or physical social engineering" ], "limits": { "scenarios": 3, "participants": 50 } } ], "scope": [ "Security awareness surveys", "Phishing simulation tests", "Knowledge assessments", "Behavior analysis", "Culture evaluation" ], "deliverables": [ "Awareness assessment report", "Training needs analysis", "Culture improvement recommendations", "Awareness program roadmap", "Metrics and benchmarks" ], "scope_url": "https://cisomarketplace.services/scope?service=employee-security-awareness-assessment" }, { "slug": "ftc-safeguards-irs-wisp-compliance-package", "title": "FTC Safeguards Rule & IRS WISP Compliance Package", "url": "https://cisomarketplace.services/services/ftc-safeguards-irs-wisp-compliance-package", "md_url": "https://cisomarketplace.services/services/ftc-safeguards-irs-wisp-compliance-package.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "The FTC Safeguards Rule and IRS Publication 4557 require tax preparers, auto dealers, mortgage brokers and other small financial institutions to keep a Written Information Security Program, name a qualified individual, assess risk and train staff. This annual package delivers a WISP that reflects your firm, the risk assessment behind it, staff training and the yearly review that keeps it valid — with a practitioner who can act as your qualified individual.", "from_price_usd": 1500, "price_cadence": "year", "tiers": [ { "id": "basic", "name": "Essential WISP Package", "price_usd": 1500, "description": "Per year, firms up to 10 staff: WISP, risk assessment and annual training", "includes": [], "excludes": [], "limits": { "employees": 10, "locations": 1 } }, { "id": "advanced", "name": "Advanced Safeguards Package", "price_usd": 3500, "description": "Per year, up to 50 staff: adds vendor oversight, incident response plan and semi-annual review", "includes": [], "excludes": [], "limits": { "employees": 50, "locations": 3 } }, { "id": "enterprise", "name": "Enterprise Safeguards Program", "price_usd": 7500, "description": "Per year, multi-office firms: adds outsourced Qualified Individual, penetration test coordination and annual report to the board", "includes": [], "excludes": [], "limits": { "employees": 250, "locations": 10 } } ], "scope": [ "Written Information Security Program (WISP) tailored to the firm", "Risk assessment required by the Safeguards Rule", "Qualified Individual designation support", "Annual staff training", "Yearly review, update and board or owner report" ], "deliverables": [ "WISP document", "Risk assessment report", "Training completion records", "Annual compliance report" ], "scope_url": "https://cisomarketplace.services/scope?service=ftc-safeguards-irs-wisp-compliance-package" }, { "slug": "fedramp-compliance", "title": "FedRAMP Compliance Program", "url": "https://cisomarketplace.services/services/fedramp-compliance", "md_url": "https://cisomarketplace.services/services/fedramp-compliance.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Specialized compliance program for cloud service providers seeking FedRAMP authorization, including readiness assessment, documentation preparation, and implementation support.", "from_price_usd": 85000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core FedRAMP Readiness Assessment", "price_usd": 85000, "description": "Readiness assessment for 1 cloud service offering at Low / Moderate baseline: up to 1 cloud account and up to 5 external services in the boundary. Control gap assessment, architecture and boundary review, review of existing documentation, readiness report.", "includes": [ "FedRAMP control gap assessment at the chosen baseline", "Authorization boundary and cloud architecture evaluation", "Review of existing security documentation", "Third-party integration analysis for up to 5 services", "FedRAMP readiness report with remediation plan" ], "excludes": [ "Writing the SSP and attachments", "Control implementation support", "Continuous monitoring program", "The independent 3PAO assessment" ], "limits": { "cloud_accounts": 1, "vendors": 5 } }, { "id": "advanced", "name": "Advanced FedRAMP Implementation Program", "price_usd": 150000, "description": "Comprehensive program including complete documentation development and implementation support", "includes": [], "excludes": [ "Assembling and submitting the full authorization package", "Operating continuous monitoring", "High baseline systems", "The independent 3PAO assessment" ], "limits": { "cloud_accounts": 3, "vendors": 15 } }, { "id": "premium", "name": "Enterprise FedRAMP Authorization Solution", "price_usd": 250000, "description": "Full-scope FedRAMP program with complete authorization package preparation and continuous monitoring setup", "includes": [], "excludes": [ "The independent 3PAO assessment and its fees", "Operating continuous monitoring after hand-off", "Finding an agency sponsor", "Cloud infrastructure or tooling costs" ], "limits": { "cloud_accounts": 5, "vendors": 30 } } ], "scope": [ "FedRAMP control assessment", "Security documentation review", "Cloud architecture evaluation", "Third-party integration analysis", "Continuous monitoring planning" ], "deliverables": [ "FedRAMP readiness report", "SSP development support", "Security controls implementation guide", "Continuous monitoring program", "Authorization package preparation" ], "scope_url": "https://cisomarketplace.services/scope?service=fedramp-compliance" }, { "slug": "financial-services-compliance", "title": "Financial Services Compliance Program", "url": "https://cisomarketplace.services/services/financial-services-compliance", "md_url": "https://cisomarketplace.services/services/financial-services-compliance.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive compliance assessment and implementation program for financial institutions, covering SEC, FINRA, SOX, PCI-DSS, and banking regulations.", "from_price_usd": 55000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Financial Compliance Assessment", "price_usd": 55000, "description": "Gap assessment against up to 2 regulatory regimes for a firm of up to 250 employees and up to 3 offices. Control evaluation, risk assessment, gap analysis, control implementation roadmap and an audit preparation guide.", "includes": [ "Gap assessment against up to 2 regimes (e.g. SEC and FINRA)", "Risk assessment using the firm's framework", "Compliance gap analysis", "Control implementation roadmap", "Audit preparation guide" ], "excludes": [ "Policy documentation suite", "Regulatory reporting templates", "Training materials", "Hands-on control implementation" ], "limits": { "frameworks": 2, "employees": 250, "locations": 3 } }, { "id": "advanced", "name": "Advanced Financial Compliance Program", "price_usd": 95000, "description": "Comprehensive program including detailed control implementation, policy development, and audit preparation", "includes": [], "excludes": [ "Custom unified control framework", "Recurring compliance validation", "PCI DSS QSA assessment or SOX external audit" ], "limits": { "frameworks": 4, "employees": 1000, "locations": 10 } }, { "id": "premium", "name": "Enterprise Financial Compliance Solution", "price_usd": 150000, "description": "Full-scope financial compliance program with custom frameworks, automated monitoring, and continuous compliance validation", "includes": [], "excludes": [ "PCI DSS QSA assessment or SOX external audit", "Legal advice or representation before regulators", "Licences for GRC or monitoring software" ], "limits": { "frameworks": 6, "employees": 5000 } } ], "scope": [ "SEC compliance review", "FINRA requirements assessment", "SOX controls evaluation", "PCI-DSS assessment", "Banking regulation analysis", "Risk assessment frameworks" ], "deliverables": [ "Detailed compliance gap analysis", "Control implementation roadmap", "Policy documentation suite", "Regulatory reporting templates", "Training program materials", "Audit preparation guide" ], "scope_url": "https://cisomarketplace.services/scope?service=financial-services-compliance" }, { "slug": "gdpr-compliance-assessment", "title": "GDPR Compliance Assessment", "url": "https://cisomarketplace.services/services/gdpr-compliance-assessment", "md_url": "https://cisomarketplace.services/services/gdpr-compliance-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's compliance with the European Union's General Data Protection Regulation (GDPR). Our assessment examines data processing activities, privacy controls, and governance frameworks to identify compliance gaps and provide a detailed remediation roadmap for organizations handling EU resident data.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential GDPR Assessment", "price_usd": 38000, "description": "GDPR gap assessment for up to 250 employees, 1 country of establishment and up to 10 processor agreements: processing register, lawful basis, notices, data subject rights, consent, breach notification and DPO requirement. Gap report, data inventory and roadmap.", "includes": [ "Processing activities register evaluation", "Lawful basis, privacy notice and consent review", "Data subject rights and breach notification procedure review", "Review of up to 10 processor agreements", "Gap analysis report, data processing inventory and roadmap", "DPO requirement determination" ], "excludes": [ "Writing procedures, notices or DPIAs", "Cross-border transfer strategy", "Governance framework design", "Implementation support" ], "limits": { "employees": 250, "locations": 1, "vendors": 10 } }, { "id": "comprehensive", "name": "Comprehensive GDPR Compliance Program", "price_usd": 70000, "description": "For up to 1,000 employees, up to 3 countries and up to 30 processor agreements. Adds written data subject rights and breach procedures, a documentation framework, a privacy governance framework, transfer mechanism recommendations and step-by-step implementation guidance.", "includes": [ "Everything in the Essential assessment", "Data subject rights and breach notification procedures written", "Documentation framework and record-keeping templates", "Privacy governance framework", "Cross-border transfer recommendations", "Review of up to 30 processor agreements" ], "excludes": [ "Hands-on implementation support", "Compliance maintenance after delivery", "Acting as the appointed DPO", "Legal opinions" ], "limits": { "employees": 1000, "locations": 3, "vendors": 30 } }, { "id": "enterprise", "name": "Enterprise EU Privacy Framework", "price_usd": 120000, "description": "Advanced compliance program for complex multinational organizations with custom implementation support, cross-border strategies, and ongoing compliance maintenance", "includes": [], "excludes": [ "Acting as the appointed DPO or EU representative", "Legal representation before supervisory authorities", "Licences for privacy management software" ], "limits": { "locations": 10, "vendors": 75 } } ], "scope": [ "Data protection impact assessment review", "Processing activities register evaluation", "Lawful basis determination", "Privacy notice evaluation", "Data subject rights implementation assessment", "Consent management review", "Cross-border data transfer mechanisms", "Data protection officer requirements", "Privacy by design implementation", "Data breach notification procedures", "Processor agreement review", "Record keeping assessment" ], "deliverables": [ "GDPR compliance gap analysis report", "Data processing inventory", "Data protection enhancement plan", "Privacy governance framework", "Data subject rights procedures", "Cross-border transfer recommendations", "Breach notification process improvements", "DPO requirement determination", "Documentation framework", "Implementation roadmap and timeline" ], "scope_url": "https://cisomarketplace.services/scope?service=gdpr-compliance-assessment" }, { "slug": "hipaa-security-risk-analysis-small-practice", "title": "HIPAA Security Risk Analysis — Small Practice", "url": "https://cisomarketplace.services/services/hipaa-security-risk-analysis-small-practice", "md_url": "https://cisomarketplace.services/services/hipaa-security-risk-analysis-small-practice.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "The Security Rule requires every covered entity and business associate to perform a security risk analysis. This engagement delivers exactly that for small and mid-sized practices: an asset and ePHI inventory, threat and vulnerability analysis, risk ratings, and a remediation plan you can show OCR, a payer or a cyber insurer. It is the entry point below the full HIPAA/HITECH Compliance Assessment.", "from_price_usd": 3500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Practice SRA", "price_usd": 3500, "description": "Single-location practice with up to 25 staff: ePHI inventory, safeguard review, risk register and remediation plan.", "includes": [], "excludes": [ "Technical vulnerability scanning", "Policy authoring", "More than one location" ], "limits": { "employees": 25, "locations": 1 } }, { "id": "advanced", "name": "Advanced Practice SRA", "price_usd": 6500, "description": "Up to 100 staff AND up to 3 locations (exceeding either moves to the next tier): adds policy gap review, BAA review and a staff training session.", "includes": [], "excludes": [ "Technical vulnerability scanning", "EHR vendor review" ], "limits": { "employees": 100, "locations": 3 } }, { "id": "enterprise", "name": "Enterprise Practice SRA", "price_usd": 12500, "description": "Multi-location groups and business associates up to 500 staff and 10 locations: adds a technical vulnerability scan, EHR and vendor review and a 90-day remediation check. Larger organizations need the HIPAA/HITECH Compliance Assessment.", "includes": [], "excludes": [ "Organizations above 500 staff — use the HIPAA/HITECH Compliance Assessment", "Penetration testing" ], "limits": { "employees": 500, "locations": 10 } } ], "scope": [ "ePHI asset and data-flow inventory", "Administrative, physical and technical safeguard review", "Threat, vulnerability and risk rating per asset", "Remediation plan with owners and dates", "Policy and BAA gap check" ], "deliverables": [ "HIPAA security risk analysis report", "Risk register", "Remediation plan", "Attestation summary for insurers and partners" ], "scope_url": "https://cisomarketplace.services/scope?service=hipaa-security-risk-analysis-small-practice" }, { "slug": "hipaa-hitech-compliance-assessment", "title": "HIPAA/HITECH Compliance Assessment", "url": "https://cisomarketplace.services/services/hipaa-hitech-compliance-assessment", "md_url": "https://cisomarketplace.services/services/hipaa-hitech-compliance-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's compliance with HIPAA and HITECH regulations, focusing on the protection of electronic protected health information (ePHI). Our assessment examines technical, administrative, and physical safeguards, providing a detailed gap analysis and remediation plan to achieve and maintain compliance while reducing the risk of breaches and penalties.", "from_price_usd": 36000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential HIPAA/HITECH Assessment", "price_usd": 36000, "description": "HIPAA / HITECH gap assessment for up to 100 employees, 1 site and up to 10 business associates: Security Rule, Privacy Rule and breach notification review, ePHI data flow analysis, safeguards evaluation by interview and document review. Report and roadmap.", "includes": [ "Security Rule, Privacy Rule and breach notification review", "Administrative, physical and technical safeguards evaluation", "ePHI data flow analysis", "Business associate agreement review for up to 10 BAs", "Compliance report, gap analysis and remediation roadmap" ], "excludes": [ "Technical configuration review of access control and logging", "Policy and documentation writing", "Training", "Implementation support" ], "limits": { "employees": 100, "locations": 1, "vendors": 10 } }, { "id": "comprehensive", "name": "Comprehensive HIPAA Compliance Program", "price_usd": 65000, "description": "For up to 500 employees, up to 5 sites and up to 30 business associates. Adds configuration-level review of access control, audit logging and monitoring, an administrative controls framework, updated breach response procedures and compliance documentation.", "includes": [ "Everything in the Essential assessment", "Configuration review of access control, audit logging and monitoring", "Technical safeguards enhancement plan", "Administrative controls framework", "Breach response procedures updated", "Compliance documentation written" ], "excludes": [ "Workforce training delivery", "Hands-on implementation support", "Governance framework", "Penetration testing" ], "limits": { "employees": 500, "locations": 5, "vendors": 30 } }, { "id": "enterprise", "name": "Enterprise Healthcare Compliance Framework", "price_usd": 110000, "description": "Advanced compliance program for complex healthcare environments with custom implementation support, training, and governance framework", "includes": [], "excludes": [ "Ongoing program management (see Healthcare Compliance Program)", "Penetration testing or vulnerability scanning", "Legal representation in OCR matters" ], "limits": { "employees": 2500, "locations": 15, "vendors": 75, "sessions": 4 } } ], "scope": [ "HIPAA Security Rule assessment", "HIPAA Privacy Rule evaluation", "Breach notification process review", "Business associate management assessment", "Technical safeguards evaluation", "Administrative safeguards review", "Physical safeguards assessment", "ePHI data flow analysis", "Access control implementation review", "Audit logging and monitoring evaluation", "Risk analysis methodology assessment", "Incident response capability review", "HITECH compliance review", "Patient data handling assessment" ], "deliverables": [ "HIPAA/HITECH compliance report", "Gap analysis and findings", "Technical safeguards enhancement plan", "Administrative controls framework", "Physical security recommendations", "ePHI protection strategy", "Business associate agreement review", "Risk assessment methodology improvements", "Breach response procedure updates", "Compliance documentation recommendations", "Remediation roadmap and timeline" ], "scope_url": "https://cisomarketplace.services/scope?service=hipaa-hitech-compliance-assessment" }, { "slug": "hitrust-e1-i1-readiness", "title": "HITRUST e1 / i1 Readiness", "url": "https://cisomarketplace.services/services/hitrust-e1-i1-readiness", "md_url": "https://cisomarketplace.services/services/hitrust-e1-i1-readiness.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Healthcare customers and payers increasingly require HITRUST. We scope the assessment, perform the readiness assessment against the e1 (44 requirements) or i1 (182 requirements) set, remediate gaps, build the evidence library in MyCSF terms and prepare you for the external assessor. We are the readiness partner, not the assessor.", "from_price_usd": 30000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential HITRUST e1 Readiness", "price_usd": 30000, "description": "e1 (44 requirements), single system: readiness assessment, remediation plan and evidence library", "includes": [], "excludes": [ "i1 requirements", "More than one in-scope system" ], "limits": { "employees": 250 } }, { "id": "advanced", "name": "Advanced HITRUST i1 Readiness", "price_usd": 65000, "description": "i1 (182 requirements), single system: adds policy authoring, remediation oversight and assessor liaison", "includes": [], "excludes": [], "limits": { "employees": 1500 } }, { "id": "enterprise", "name": "Enterprise HITRUST Program", "price_usd": 120000, "description": "i1 across multiple systems or a path to r2: adds program management, internal audit and year-two rapid recertification planning", "includes": [], "excludes": [], "limits": { "employees": 10000 } } ], "scope": [ "Assessment scoping and MyCSF object definition", "Readiness assessment against e1 or i1 requirements", "Gap remediation planning and oversight", "Policy, procedure and evidence library build", "External assessor preparation" ], "deliverables": [ "Readiness assessment report", "Remediation plan", "Evidence library mapped to requirements", "Assessor-ready submission package" ], "scope_url": "https://cisomarketplace.services/scope?service=hitrust-e1-i1-readiness" }, { "slug": "iso-27001-certification-readiness", "title": "ISO 27001 Certification Readiness Assessment", "url": "https://cisomarketplace.services/services/iso-27001-certification-readiness", "md_url": "https://cisomarketplace.services/services/iso-27001-certification-readiness.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's readiness for ISO 27001 certification, examining your information security management system (ISMS) against the standard's requirements. Our assessment provides a detailed gap analysis and implementation roadmap to help you achieve certification efficiently and effectively.", "from_price_usd": 13000, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 13000, "description": "Gap analysis only: one ISMS scope, up to 50 employees and 1 location. Clauses 4-10 and the Annex A controls scored from document review and up to 6 interviews, run remotely. Output is a gap report and a prioritized action list.", "includes": [ "Clause 4-10 and Annex A gap scoring", "Review of existing ISMS documents", "Up to 6 stakeholder interviews (remote)", "Gap report with prioritized action list" ], "excludes": [ "Implementation roadmap with timeline and resourcing", "Risk methodology and Statement of Applicability review", "Internal audit program evaluation", "Writing any documentation" ], "limits": { "employees": 50, "locations": 1, "months": 1 } }, { "id": "basic", "name": "Essential ISO 27001 Gap Analysis", "price_usd": 38000, "description": "Gap analysis plus certification plan: up to 250 employees and up to 2 locations. Adds risk assessment methodology, Statement of Applicability, management review and internal audit program evaluation, with an implementation roadmap, resource estimate and certification checklist.", "includes": [ "Full clause and Annex A gap analysis", "Risk methodology and Statement of Applicability evaluation", "Management review and internal audit program assessment", "ISMS implementation roadmap with timeline and resource requirements", "Certification preparation checklist and auditor-selection guidance" ], "excludes": [ "Authoring policies, procedures or the SoA", "Hands-on control implementation", "Running the internal audit", "Support during the certification audit" ], "limits": { "employees": 250, "locations": 2, "months": 2 } }, { "id": "advanced", "name": "Comprehensive ISO 27001 Preparation", "price_usd": 65000, "description": "Complete certification preparation with detailed documentation development and implementation assistance", "includes": [], "excludes": [ "Hands-on technical control implementation", "Conducting the internal audit", "Attendance at Stage 1 and Stage 2 audits", "The certification body's audit fees" ], "limits": { "employees": 1000, "locations": 5 } }, { "id": "enterprise", "name": "Enterprise ISO 27001 Implementation Program", "price_usd": 110000, "description": "Full-service ISO 27001 implementation support including documentation development, control implementation, and certification guidance", "includes": [], "excludes": [ "The certification audit itself and certification body fees", "Security tooling or licence costs", "Post-certification surveillance-year support", "Scopes above 2,500 employees (scoped separately)" ], "limits": { "employees": 2500, "locations": 10 } } ], "scope": [ "ISO 27001 gap analysis", "ISMS documentation review", "Control implementation assessment", "Risk assessment methodology review", "Statement of Applicability evaluation", "Management review process assessment", "Internal audit program evaluation", "Security policy framework review", "ISMS metrics assessment", "Certification preparation guidance" ], "deliverables": [ "ISO 27001 gap analysis report", "ISMS implementation roadmap", "Documentation enhancement recommendations", "Control remediation plan", "Certification preparation checklist", "Risk assessment framework enhancements", "ISMS process improvements", "Implementation timeline", "Resource requirements", "Certification strategy" ], "scope_url": "https://cisomarketplace.services/scope?service=iso-27001-certification-readiness" }, { "slug": "iso-42001-eu-ai-act-readiness", "title": "ISO/IEC 42001 & EU AI Act Readiness", "url": "https://cisomarketplace.services/services/iso-42001-eu-ai-act-readiness", "md_url": "https://cisomarketplace.services/services/iso-42001-eu-ai-act-readiness.md", "practice": "AI Security", "category_group": "Compliance & GRC", "description": "Organizations building or deploying AI are being asked for ISO/IEC 42001 certification and EU AI Act conformity. This engagement inventories your AI systems, classifies them under the AI Act risk tiers, assesses the AI management system against ISO 42001 Annex A, and produces the policies, impact assessments and roadmap needed to reach certification readiness.", "from_price_usd": 7500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential AI Governance Gap Analysis", "price_usd": 7500, "description": "Up to 5 AI systems: inventory, AI Act classification and ISO 42001 gap analysis", "includes": [], "excludes": [], "limits": { "ai_systems": 5 } }, { "id": "advanced", "name": "Advanced ISO 42001 Readiness", "price_usd": 18000, "description": "Up to 20 AI systems: adds policy set, impact assessment method, role design and internal-audit preparation", "includes": [], "excludes": [], "limits": { "ai_systems": 20 } }, { "id": "enterprise", "name": "Enterprise AI Management System Program", "price_usd": 38000, "description": "Portfolio of AI systems or high-risk AI: adds conformity documentation, supplier controls, training and certification-audit support", "includes": [], "excludes": [], "limits": { "ai_systems": 100 } } ], "scope": [ "AI system inventory and EU AI Act risk classification", "ISO/IEC 42001 clause and Annex A gap analysis", "AI risk and impact assessment method", "AI policy, roles and lifecycle controls", "Certification readiness roadmap" ], "deliverables": [ "AI system register with risk tiers", "ISO 42001 gap analysis", "AI governance policy set", "Readiness roadmap and audit preparation plan" ], "scope_url": "https://cisomarketplace.services/scope?service=iso-42001-eu-ai-act-readiness" }, { "slug": "nist-csf-2-assessment", "title": "NIST CSF 2.0 Maturity Assessment", "url": "https://cisomarketplace.services/services/nist-csf-2-assessment", "md_url": "https://cisomarketplace.services/services/nist-csf-2-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "A named, fixed-scope assessment against all six NIST Cybersecurity Framework 2.0 functions — Govern, Identify, Protect, Detect, Respond, Recover. Evidence-based interviews and document review produce a current-state maturity score per category, a target profile matched to your risk appetite, and a funded roadmap. The scorecard is built to be shown to a board, an acquirer or a cyber insurer.", "from_price_usd": 15000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential CSF Assessment", "price_usd": 15000, "description": "Single business unit, up to 250 employees: maturity scorecard, gap analysis and roadmap", "includes": [], "excludes": [], "limits": { "employees": 250, "locations": 3 } }, { "id": "advanced", "name": "Advanced CSF Assessment", "price_usd": 28000, "description": "Up to 1,500 employees or regulated environments: adds control evidence sampling, target profile workshop and board presentation", "includes": [], "excludes": [], "limits": { "employees": 1500, "locations": 10 } }, { "id": "enterprise", "name": "Enterprise CSF Program", "price_usd": 55000, "description": "Multi-entity or 1,500+ employees: adds per-entity profiles, cross-mapping to ISO 27001 / SOC 2 / CIS and a quarterly re-scoring plan", "includes": [], "excludes": [], "limits": { "employees": 10000, "locations": 50 } } ], "scope": [ "Current-profile assessment across all six CSF 2.0 functions", "Evidence review and stakeholder interviews", "Target profile and risk-based prioritization", "Roadmap with effort and cost bands", "Board and insurer-ready scorecard" ], "deliverables": [ "NIST CSF 2.0 maturity scorecard", "Gap analysis by category and subcategory", "12-24 month prioritized roadmap", "Board presentation" ], "scope_url": "https://cisomarketplace.services/scope?service=nist-csf-2-assessment" }, { "slug": "pci-dss-compliance-assessment", "title": "PCI DSS Compliance Assessment", "url": "https://cisomarketplace.services/services/pci-dss-compliance-assessment", "md_url": "https://cisomarketplace.services/services/pci-dss-compliance-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's compliance with Payment Card Industry Data Security Standard (PCI DSS) requirements. Our assessment examines cardholder data environments, security controls, and processes to identify compliance gaps and provide a detailed remediation roadmap to achieve and maintain PCI DSS compliance while protecting sensitive payment information.", "from_price_usd": 34000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential PCI DSS Assessment", "price_usd": 34000, "description": "SAQ-eligible merchants: one cardholder data environment with up to 3 card-accepting locations, 1 e-commerce channel and up to 5 service providers. Data flow map, gap analysis against all 12 requirements, SAQ type selection and a remediation roadmap.", "includes": [ "Cardholder data flow mapping", "Gap analysis against the 12 PCI DSS requirements", "SAQ type selection and completion guidance", "Scope reduction recommendations", "Remediation roadmap with priorities" ], "excludes": [ "Network segmentation validation testing", "Writing policies and compliance documentation", "ASV scans and penetration testing", "Report on Compliance preparation" ], "limits": { "locations": 3, "web_apps": 1, "vendors": 5 } }, { "id": "standard", "name": "Comprehensive PCI Compliance Program", "price_usd": 60000, "description": "Up to 10 card-accepting locations, up to 3 e-commerce channels and up to 15 service providers. Adds segmentation design validation, secure configuration sampling, drafted PCI policies and procedures, and remediation guidance sessions with control owners.", "includes": [ "Everything in the SAQ-merchant tier", "Network segmentation validation (design and rule review)", "Secure configuration review on sampled systems", "Drafted PCI policy and procedure set", "Service provider management assessment" ], "excludes": [ "Report on Compliance preparation", "Hands-on remediation of systems", "ASV scans and penetration testing", "Post-project compliance maintenance support" ], "limits": { "locations": 10, "web_apps": 3, "vendors": 15 } }, { "id": "advanced", "name": "Enterprise Payment Security Framework", "price_usd": 95000, "description": "Advanced compliance program for complex payment environments with custom implementation support, SAQ/ROC preparation, and ongoing compliance maintenance", "includes": [], "excludes": [ "The formal QSA validation audit and signed ROC", "ASV scans and penetration testing", "Security tooling costs", "Environments above 25 locations (scoped separately)" ], "limits": { "locations": 25, "web_apps": 5, "vendors": 30 } } ], "scope": [ "PCI DSS requirements gap analysis", "Cardholder data environment assessment", "Network segmentation validation", "Secure configuration review", "Vulnerability management evaluation", "Access control implementation assessment", "Security monitoring and testing review", "Information security policy evaluation", "Encryption implementation review", "Service provider management assessment", "Self-assessment questionnaire preparation", "Attestation of compliance guidance" ], "deliverables": [ "PCI DSS compliance report", "Cardholder data flow mapping", "Gap analysis and findings", "Scope reduction recommendations", "Security control enhancement plan", "Vulnerability remediation strategy", "Compliance documentation framework", "SAQ preparation assistance", "Remediation roadmap and timeline", "PCI compliance maintenance strategy", "Implementation prioritization" ], "scope_url": "https://cisomarketplace.services/scope?service=pci-dss-compliance-assessment" }, { "slug": "smb-compliance-readiness", "title": "SMB Compliance Readiness", "url": "https://cisomarketplace.services/services/smb-compliance-readiness", "md_url": "https://cisomarketplace.services/services/smb-compliance-readiness.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Targeted assessment for SMBs preparing for compliance certification.", "from_price_usd": 6500, "price_cadence": "engagement", "tiers": [], "scope": [ "HIPAA/PCI DSS gap analysis", "Control framework mapping", "Policy and procedure review", "Technical controls assessment", "Data flow analysis", "Vendor security review", "Incident response planning" ], "deliverables": [ "Compliance gap report", "Control implementation matrix", "Policy templates", "12-month compliance roadmap", "2-hour workshop session" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-compliance-readiness" }, { "slug": "soc2-readiness-assessment", "title": "SOC 2 Readiness Assessment", "url": "https://cisomarketplace.services/services/soc2-readiness-assessment", "md_url": "https://cisomarketplace.services/services/soc2-readiness-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's readiness for SOC 2 compliance, examining your controls against the relevant Trust Services Criteria. Our assessment provides a detailed gap analysis and implementation roadmap to help you prepare for a successful SOC 2 audit.", "from_price_usd": 15500, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 15500, "description": "Type I readiness check: Security criterion only, 1 in-scope product, up to 50 employees. Controls compared to the criteria through document review and up to 6 remote interviews. Output is a gap list and a pre-audit checklist.", "includes": [ "Security (Common Criteria) gap analysis", "Review of existing policies and control documentation", "Up to 6 remote interviews", "Gap list with owners and priorities", "Pre-audit preparation checklist" ], "excludes": [ "Additional criteria (Availability, Confidentiality, Processing Integrity, Privacy)", "Type II evidence collection design", "Remediation roadmap with timeline", "Writing policies" ], "limits": { "employees": 50, "web_apps": 1, "months": 1 } }, { "id": "basic", "name": "Essential SOC 2 Gap Analysis", "price_usd": 35000, "description": "Up to 250 employees, up to 2 in-scope products and up to 3 Trust Services Criteria. Gap analysis, Type 1 vs Type 2 strategy, vendor, change management and risk assessment reviews, remediation roadmap with timeline and auditor selection guidance.", "includes": [ "Gap analysis for up to 3 Trust Services Criteria", "Type 1 vs Type 2 strategy", "Vendor, change management and risk assessment process reviews", "Remediation roadmap and implementation timeline", "Auditor selection guidance" ], "excludes": [ "Evidence collection framework build", "Per-control implementation guidance", "Writing policies and procedures", "Support during the audit" ], "limits": { "employees": 250, "web_apps": 2, "months": 2 } }, { "id": "advanced", "name": "Comprehensive SOC 2 Preparation", "price_usd": 60000, "description": "Complete readiness assessment with detailed control implementation guidance and evidence collection framework", "includes": [], "excludes": [ "Writing the policy and procedure set", "Hands-on control implementation", "Liaison with the auditor during fieldwork", "The CPA firm's audit fees" ], "limits": { "employees": 500, "web_apps": 3 } }, { "id": "enterprise", "name": "Enterprise SOC 2 Implementation Program", "price_usd": 95000, "description": "Full-service SOC 2 preparation including control implementation, documentation development, and audit support", "includes": [], "excludes": [ "The SOC 2 audit and report (issued by a CPA firm)", "Compliance automation platform licences", "Penetration testing", "Organizations above 1,000 employees (scoped separately)" ], "limits": { "employees": 1000, "web_apps": 5 } } ], "scope": [ "SOC 2 Type selection guidance", "Trust Services Criteria gap analysis", "Control documentation review", "Evidence collection process assessment", "Vendor management control review", "Change management process evaluation", "Risk assessment framework review", "Security monitoring evaluation", "Control testing preparation", "Auditor selection guidance" ], "deliverables": [ "SOC 2 readiness report", "Control gap analysis", "Documentation enhancement plan", "Evidence collection framework", "Remediation roadmap", "Control implementation guidance", "Vendor assessment recommendations", "Pre-audit preparation checklist", "Type 1 vs. Type 2 strategy", "Implementation timeline" ], "scope_url": "https://cisomarketplace.services/scope?service=soc2-readiness-assessment" }, { "slug": "state-local-government-compliance", "title": "State & Local Government Compliance Assessment", "url": "https://cisomarketplace.services/services/state-local-government-compliance", "md_url": "https://cisomarketplace.services/services/state-local-government-compliance.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Specialized compliance assessment for state and local government agencies addressing the unique regulatory requirements that apply to public sector entities. Our evaluation examines state-specific cybersecurity regulations, data protection laws, sunshine laws, records retention requirements, and security standards to help government entities achieve compliance and protect sensitive information.", "from_price_usd": 42000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Government Compliance Assessment", "price_usd": 42000, "description": "One agency, municipality or department of up to 250 employees, assessed against up to 3 regulatory domains chosen at kickoff (for example breach notification, public records, privacy). Requirement mapping, gap analysis, control recommendations and a roadmap.", "includes": [ "Jurisdiction-specific requirement mapping for up to 3 domains", "Compliance gap analysis", "Data classification review", "Security control recommendations", "Implementation roadmap and timeline" ], "excludes": [ "Writing compliance documentation and procedures", "Training recommendations by role", "Additional regulatory domains beyond 3", "Cross-agency coordination" ], "limits": { "employees": 250, "frameworks": 3 } }, { "id": "comprehensive", "name": "Comprehensive Government Compliance Program", "price_usd": 75000, "description": "One entity of up to 1,000 employees, up to 6 regulatory domains. Adds a written compliance documentation framework, public records management framework, data breach response procedures, role-based training recommendations and resource planning.", "includes": [ "Everything in the single-agency tier", "Compliance documentation framework written", "Public records management framework", "Data breach response procedures", "Training recommendations and resource planning guidance" ], "excludes": [ "Multi-agency or shared-services coordination", "Hands-on implementation support", "Ongoing compliance maintenance", "Technical security testing" ], "limits": { "employees": 1000, "frameworks": 6 } }, { "id": "enterprise", "name": "Enterprise Government Compliance Framework", "price_usd": 125000, "description": "Advanced compliance program for complex government entities with custom implementation support, cross-agency coordination, and ongoing compliance maintenance", "includes": [], "excludes": [ "Technical security testing and penetration testing", "Formal authorization or audit by a regulator", "Staff training delivery", "Managed compliance services after handover" ], "limits": { "frameworks": 12 } } ], "scope": [ "State-specific security regulation review", "Data breach notification requirements", "Public records management assessment", "Critical infrastructure compliance review", "State/local privacy law assessment", "Data classification implementation", "Criminal justice information systems compliance", "Election systems security compliance", "Emergency services data protection", "Health data compliance", "Financial data security standards", "Educational records protection" ], "deliverables": [ "State & local compliance gap analysis", "Jurisdiction-specific requirement mapping", "Public records management framework", "Data protection implementation plan", "Data breach response procedures", "Security control recommendations", "Compliance documentation framework", "Training recommendations", "Implementation roadmap and timeline", "Resource planning guidance" ], "scope_url": "https://cisomarketplace.services/scope?service=state-local-government-compliance" }, { "slug": "trifecta-security-assessment", "title": "Trifecta Security Assessment: Business Continuity, Disaster Recovery, and Incident Response", "url": "https://cisomarketplace.services/services/trifecta-security-assessment", "md_url": "https://cisomarketplace.services/services/trifecta-security-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive assessment covering three critical areas of organizational resilience - business continuity planning, disaster recovery strategies, and incident response capabilities.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "small", "name": "Small Organization Assessment", "price_usd": 35000, "description": "Up to 100 employees and 1 site. Business continuity, disaster recovery and incident response reviewed together: BIA for up to 10 critical functions, RTO/RPO analysis, gap analysis, policy and procedure templates, exercise plan.", "includes": [ "BC, DR and IR capability review", "Business impact analysis for up to 10 critical functions", "RTO/RPO analysis", "Gap analysis and improvement roadmap", "Policy templates plus testing and exercise plan" ], "excludes": [ "Facilitating a tabletop exercise", "Live recovery testing", "Writing the full BC/DR/IR plans", "Additional sites" ], "limits": { "employees": 100, "locations": 1 } }, { "id": "medium", "name": "Medium Organization Assessment", "price_usd": 55000, "description": "101-500 employees and up to 3 sites. Same three-area assessment with a BIA for up to 25 critical functions, per-site recovery strategy review, training recommendations by role and an exercise plan covering all three disciplines.", "includes": [ "BC, DR and IR capability review across up to 3 sites", "Business impact analysis for up to 25 critical functions", "RTO/RPO analysis per critical system", "Gap analysis and improvement roadmap", "Templates, exercise plans and training recommendations" ], "excludes": [ "Facilitating tabletop exercises", "Live recovery or failover testing", "Writing the full BC/DR/IR plans", "More than 3 sites" ], "limits": { "employees": 500, "locations": 3 } }, { "id": "large", "name": "Large Organization Assessment", "price_usd": 85000, "description": "More than 500 employees, no fixed headcount cap - scoped at kickoff; up to 10 sites. BIA for up to 50 critical functions across business units, per-site DR review, IR capability review across teams, and an executive-level roadmap.", "includes": [ "BC, DR and IR capability review across business units", "Business impact analysis for up to 50 critical functions", "Per-site disaster recovery strategy review", "Executive roadmap and briefing", "Templates, exercise plans and training recommendations" ], "excludes": [ "Facilitating tabletop exercises", "Live recovery or failover testing", "Writing the full BC/DR/IR plans", "Crisis management retainer" ], "limits": { "locations": 10 } } ], "scope": [ "Business continuity planning review", "Disaster recovery strategy assessment", "Incident response capability evaluation", "Recovery time objective analysis", "Business impact analysis" ], "deliverables": [ "Comprehensive BC/DR/IR report", "Gap analysis findings", "Improvement roadmap", "Policy and procedure templates", "Testing and exercise plans", "Training recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=trifecta-security-assessment" }, { "slug": "advanced-threat-hunting-program", "title": "Advanced Threat Hunting Program", "url": "https://cisomarketplace.services/services/advanced-threat-hunting-program", "md_url": "https://cisomarketplace.services/services/advanced-threat-hunting-program.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Proactive threat hunting service combining machine learning, behavioral analytics, and expert analysis to identify sophisticated threats and establish continuous hunting capabilities.", "from_price_usd": 70000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Threat Hunting Program", "price_usd": 70000, "description": "Essential threat hunting covering primary attack vectors and basic MITRE ATT&CK mapping", "includes": [], "excludes": [ "Behavioral analytics setup", "Threat intelligence feed integration", "Automated response playbooks" ], "limits": { "devices": 1000 } }, { "id": "advanced", "name": "Advanced Threat Hunting Solution", "price_usd": 120000, "description": "Comprehensive hunting program with custom detection engineering, behavioral analytics, and automated response", "includes": [], "excludes": [ "ML-based detection models", "Incident response for confirmed intrusions", "SIEM or EDR licences" ], "limits": { "devices": 2500 } }, { "id": "premium", "name": "Enterprise Threat Hunting Platform", "price_usd": 180000, "description": "Full-scale hunting program with ML-powered detection, custom playbooks, and 24/7 expert monitoring", "includes": [], "excludes": [ "Full incident response and forensics (separate retainer)", "SIEM, EDR or data platform licences", "Environments above 5,000 endpoints (scoped separately)" ], "limits": { "devices": 5000 } } ], "scope": [ "Environment baseline analysis", "Threat intelligence implementation", "Detection rule development", "Behavioral analytics setup", "Hunt process establishment" ], "deliverables": [ "Threat hunting playbooks", "Custom detection rules", "Behavioral analysis framework", "Investigation procedures", "Threat intelligence feeds integration", "Team training materials" ], "scope_url": "https://cisomarketplace.services/scope?service=advanced-threat-hunting-program" }, { "slug": "autonomous-vehicle-security", "title": "Autonomous Vehicle Security Program", "url": "https://cisomarketplace.services/services/autonomous-vehicle-security", "md_url": "https://cisomarketplace.services/services/autonomous-vehicle-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Advanced security assessment and testing program for autonomous vehicle systems, focusing on AI/ML components, sensor networks, and vehicle communications.", "from_price_usd": 75000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Autonomous Vehicle Assessment", "price_usd": 75000, "description": "One vehicle platform: threat model, architecture review and security testing of the autonomy stack's sensor inputs and in-vehicle networks. No AI/ML model testing and no V2X testing.", "includes": [ "Threat model for 1 vehicle platform", "Sensor network and in-vehicle network security testing", "Safety system interface review", "Vulnerability analysis and architecture recommendations" ], "excludes": [ "AI/ML model adversarial testing", "V2X communication testing", "Backend and fleet management systems", "Retest beyond one round" ], "limits": { "devices": 1 } }, { "id": "advanced", "name": "Advanced Autonomous Security Program", "price_usd": 125000, "description": "One vehicle platform plus up to 2 AI/ML models: everything in the basic tier, adversarial testing of perception and planning models, and V2X communication testing.", "includes": [ "Everything in the basic tier", "Adversarial-input testing of up to 2 AI/ML models", "V2X protocol and message security testing", "Safety system fault-injection review", "One retest round" ], "excludes": [ "Custom test tooling built for the client", "Monitoring design and post-delivery support", "Additional vehicle platforms" ], "limits": { "devices": 1, "ai_systems": 2 } }, { "id": "premium", "name": "Enterprise Autonomous Vehicle Solution", "price_usd": 200000, "description": "Full-scope autonomous vehicle security program including custom tools and continuous monitoring", "includes": [], "excludes": [ "Operating a monitoring service for the client", "Safety certification or homologation work", "Remediation engineering" ], "limits": { "devices": 3, "ai_systems": 5 } } ], "scope": [ "Assessment of autonomous systems", "sensor networks", "AI/ML models", "V2X communications", "safety systems" ], "deliverables": [ "Comprehensive security assessment report", "threat model", "vulnerability analysis", "security architecture recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=autonomous-vehicle-security" }, { "slug": "aviation-aerospace-security", "title": "Aviation & Aerospace Security Assessment", "url": "https://cisomarketplace.services/services/aviation-aerospace-security", "md_url": "https://cisomarketplace.services/services/aviation-aerospace-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Specialized security assessment for aviation and aerospace organizations, addressing the critical security challenges of aircraft systems, airport infrastructure, flight operations, and aerospace manufacturing. Our assessment helps aviation organizations protect safety-critical systems, intellectual property, and operational technology while meeting strict regulatory requirements and ensuring passenger safety.", "from_price_usd": 48000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Aviation Security Assessment", "price_usd": 48000, "description": "Assessment of 1 site and up to 3 operational domains chosen from the 10 in scope (e.g. flight ops, maintenance, passenger data). Interview, document and configuration based; gap analysis against 1 regulatory framework.", "includes": [ "1 site, up to 3 operational domains", "Interview, document and configuration review", "Gap analysis against 1 regulatory framework", "Assessment report and risk prioritization" ], "excludes": [ "Hands-on avionics testing", "Supply chain security verification", "OT network testing", "Additional sites" ], "limits": { "locations": 1, "frameworks": 1 } }, { "id": "comprehensive", "name": "Comprehensive Aviation Security Program", "price_usd": 85000, "description": "Assessment of up to 3 sites across all 10 scope domains, with hands-on bench testing of up to 3 avionics or aircraft-connected systems, OT review, verification of up to 10 suppliers and gap analysis against up to 2 frameworks.", "includes": [ "Up to 3 sites, all 10 scope domains", "Bench testing of up to 3 avionics/connected systems", "Operational technology protection strategy", "Supply chain verification of up to 10 suppliers", "Aviation cybersecurity roadmap" ], "excludes": [ "In-flight or live-aircraft testing", "Global multi-region supply chain program", "Remediation implementation" ], "limits": { "locations": 3, "frameworks": 2, "devices": 3, "vendors": 10 } }, { "id": "enterprise", "name": "Enterprise Aerospace Security Framework", "price_usd": 140000, "description": "Program for aerospace groups with operations and manufacturing: up to 10 sites, up to 10 systems bench-tested, up to 50 suppliers and up to 3 frameworks. Adds manufacturing security and security architecture. Delivered in phases.", "includes": [ "Up to 10 sites across regions", "Bench testing of up to 10 systems", "Aerospace manufacturing and IP protection review", "Supply chain framework covering up to 50 suppliers", "Security architecture recommendations" ], "excludes": [ "In-flight or live-aircraft testing", "Remediation implementation", "Regulatory filings or certification fees" ], "limits": { "locations": 10, "frameworks": 3, "devices": 10, "vendors": 50 } } ], "scope": [ "Aircraft systems security assessment", "Avionics security testing", "Airport infrastructure security", "Flight operations systems review", "Air traffic management security", "Maintenance system security", "Supply chain security verification", "Aviation regulatory compliance", "Aerospace manufacturing security", "Passenger data protection review" ], "deliverables": [ "Aviation security assessment report", "Regulatory compliance gap analysis", "Aircraft systems security recommendations", "Operational technology protection strategy", "Supply chain security framework", "Aviation cybersecurity roadmap", "Security architecture recommendations", "Risk mitigation prioritization" ], "scope_url": "https://cisomarketplace.services/scope?service=aviation-aerospace-security" }, { "slug": "aviation-systems-security", "title": "Aviation Systems Security Program", "url": "https://cisomarketplace.services/services/aviation-systems-security", "md_url": "https://cisomarketplace.services/services/aviation-systems-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment for aviation systems including avionics, ground control systems, and airport infrastructure security.", "from_price_usd": 65000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Aviation Security Assessment", "price_usd": 65000, "description": "One facility and up to 3 systems (for example one ground control system, one communication system, one avionics unit on a test bench): architecture review, configuration review and non-intrusive testing. No air traffic control review.", "includes": [ "Architecture and configuration review of up to 3 systems", "Non-intrusive testing on bench or test environments", "Airport or facility IT/OT network segmentation review", "Infrastructure protection plan" ], "excludes": [ "Air traffic control system review", "Hands-on avionics testing beyond one bench unit", "Custom test tooling", "More than one facility" ], "limits": { "locations": 1, "devices": 3 } }, { "id": "advanced", "name": "Advanced Aviation Security Program", "price_usd": 110000, "description": "Up to 2 facilities and up to 8 systems: everything in the basic tier, hands-on avionics and communication systems testing, air traffic control security review and airport infrastructure evaluation.", "includes": [ "Everything in the basic tier", "Hands-on avionics and communication systems testing", "Air traffic control security review", "Airport infrastructure evaluation", "Communication security framework" ], "excludes": [ "Custom test tooling built for the client", "More than 2 facilities", "Remediation implementation" ], "limits": { "locations": 2, "devices": 8 } }, { "id": "premium", "name": "Enterprise Aviation Security Solution", "price_usd": 175000, "description": "Up to 5 facilities; number of systems is not capped and is fixed in the statement of work. Everything in the advanced tier, plus test tooling built for the client's systems, a cross-facility security architecture and one retest round.", "includes": [ "Everything in the advanced tier", "Custom test tooling for proprietary systems, handed over", "Cross-facility aviation security architecture", "Compliance documentation pack", "One retest round" ], "excludes": [ "Testing on in-service aircraft or live air traffic systems", "Ongoing monitoring", "Remediation implementation" ], "limits": { "locations": 5 } } ], "scope": [ "Avionics system security testing", "Ground control system assessment", "Air traffic control security review", "Airport infrastructure evaluation", "Communication systems testing" ], "deliverables": [ "Aviation security architecture", "Systems security analysis", "Communication security framework", "Infrastructure protection plan", "Compliance documentation" ], "scope_url": "https://cisomarketplace.services/scope?service=aviation-systems-security" }, { "slug": "blockchain-security-and-smart-contract-audit", "title": "Blockchain Security and Smart Contract Audit", "url": "https://cisomarketplace.services/services/blockchain-security-and-smart-contract-audit", "md_url": "https://cisomarketplace.services/services/blockchain-security-and-smart-contract-audit.md", "practice": "Offensive Security", "category_group": "Specialized", "description": "Comprehensive security assessment for blockchain implementations and smart contracts, including code audits, cryptographic review, and security architecture evaluation.", "from_price_usd": 60000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Blockchain Assessment", "price_usd": 60000, "description": "Manual and automated audit of up to 1 contract repository, roughly 2,500 lines of contract code on one chain, plus a review of the wallet and key handling around it. One fix-review round.", "includes": [ "Line-by-line smart contract audit of 1 repository", "Automated analysis and manual exploit attempts", "Wallet and key management review for up to 3 wallets", "Audit report with remediation guidelines", "One fix-review round" ], "excludes": [ "Cryptographic implementation review", "Consensus mechanism and node network assessment", "Multi-chain or bridge contracts", "Custom tooling and monitoring" ], "limits": { "repositories": 1, "wallets": 3 } }, { "id": "advanced", "name": "Advanced Blockchain Assessment", "price_usd": 90000, "description": "Up to 3 repositories, roughly 6,000 lines of contract code: everything in the basic tier, a cryptographic implementation review, consensus mechanism assessment and node network security evaluation. Two fix-review rounds.", "includes": [ "Everything in the basic tier", "Cryptographic implementation review", "Consensus mechanism assessment", "Node and network security evaluation", "Two fix-review rounds" ], "excludes": [ "Custom detection tooling", "Post-deployment monitoring", "Bridges and cross-chain messaging beyond the 3 repositories" ], "limits": { "repositories": 3, "wallets": 5 } }, { "id": "premium", "name": "Enterprise Blockchain Assessment", "price_usd": 120000, "description": "Full-scope blockchain security program including custom tool development and continuous monitoring", "includes": [], "excludes": [ "Bug bounty program management", "Formal verification of the full codebase" ], "limits": { "repositories": 5, "wallets": 10 } } ], "scope": [ "Smart contract code audit", "Cryptographic implementation review", "Consensus mechanism assessment", "Network security evaluation", "Wallet security review" ], "deliverables": [ "Smart contract audit report", "Security architecture document", "Vulnerability assessment findings", "Remediation guidelines", "Security best practices", "Monitoring recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=blockchain-security-and-smart-contract-audit" }, { "slug": "breach-impact-assessment", "title": "Breach Impact Assessment", "url": "https://cisomarketplace.services/services/breach-impact-assessment", "md_url": "https://cisomarketplace.services/services/breach-impact-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Strategic evaluation of your organization's potential business impact from various cybersecurity breach scenarios. Our assessment quantifies financial, reputational, operational, and regulatory consequences of different types of security incidents, providing crucial data to support security investment decisions and risk management strategies.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Breach Impact Analysis", "price_usd": 38000, "description": "Up to 3 breach scenarios modelled against the organization's critical data: financial and operational impact estimated in ranges, with impact reduction recommendations. One stakeholder workshop.", "includes": [ "Critical data identification", "Up to 3 breach scenarios", "Financial and operational impact ranges per scenario", "One stakeholder workshop", "Breach impact assessment report" ], "excludes": [ "Reputational, regulatory and market valuation impact", "Third-party breach scenarios", "Security investment prioritization framework", "Board presentation deck" ], "limits": { "scenarios": 3, "sessions": 1 } }, { "id": "standard", "name": "Comprehensive Impact Assessment Program", "price_usd": 65000, "description": "Up to 6 scenarios including third-party breach: everything in the basic tier, scenario-level financial modelling, reputational, regulatory and customer impact analysis, and a security investment prioritization framework. Up to 3 workshops.", "includes": [ "Everything in the basic tier", "Financial model per scenario with stated assumptions", "Reputational, regulatory and customer impact analysis", "Third-party breach scenario", "Security investment prioritization framework" ], "excludes": [ "Board presentation deck and board session", "Market valuation impact", "Risk transfer strategy", "Risk management framework" ], "limits": { "scenarios": 6, "sessions": 3 } }, { "id": "executive", "name": "Executive Cyber Risk Program", "price_usd": 95000, "description": "Up to 10 scenarios: everything in the standard tier, market valuation impact, risk transfer strategies, a cyber risk management framework, executive communication materials and a board deck presented in person. Up to 5 sessions including 1 board session.", "includes": [ "Everything in the standard tier", "Market valuation impact and business resilience evaluation", "Risk transfer strategies", "Board presentation deck with one board session", "Cyber risk management framework" ], "excludes": [ "Technical penetration testing or control testing", "Insurance brokerage or policy placement", "Ongoing risk quantification after delivery" ], "limits": { "scenarios": 10, "sessions": 5 } } ], "scope": [ "Critical data identification", "Breach scenario modeling", "Financial impact analysis", "Reputational impact assessment", "Operational disruption analysis", "Regulatory impact evaluation", "Third-party breach impact", "Customer/client impact assessment", "Market valuation impact", "Business resilience evaluation" ], "deliverables": [ "Breach impact assessment report", "Financial impact quantification", "Scenario-based risk analysis", "Impact reduction recommendations", "Security investment prioritization framework", "Risk transfer strategies", "Executive communication materials", "Board presentation deck" ], "scope_url": "https://cisomarketplace.services/scope?service=breach-impact-assessment" }, { "slug": "ciso-comprehensive-security-assessment", "title": "CISO Comprehensive Security Assessment", "url": "https://cisomarketplace.services/services/ciso-comprehensive-security-assessment", "md_url": "https://cisomarketplace.services/services/ciso-comprehensive-security-assessment.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Holistic evaluation of your organization's entire security program across all critical domains. This efficient, structured assessment provides CISOs and security leaders with a complete diagnostic of security capabilities, maturity gaps, and prioritized improvement opportunities. Our comprehensive approach delivers actionable insights across governance, technical controls, and operational security to inform strategic decision-making and resource allocation.", "from_price_usd": 65000, "price_cadence": "engagement", "tiers": [ { "id": "standard", "name": "Standard Enterprise Assessment", "price_usd": 65000, "description": "Security programme assessment across all 14 domains for up to 500 employees, up to 3 locations and up to 3 cloud accounts. Based on up to 15 stakeholder interviews and document review; maturity scoring, gap analysis, prioritised roadmap and 1 executive readout.", "includes": [ "All 14 programme domains assessed", "Up to 15 stakeholder interviews", "Maturity scoring and domain gap analysis", "Risk-prioritised roadmap", "1 executive readout" ], "excludes": [ "Hands-on configuration review of cloud, identity and network controls", "Penetration testing or vulnerability scanning", "Peer benchmark comparison", "Board presentation and executive workshops" ], "limits": { "employees": 500, "locations": 3, "cloud_accounts": 3, "sessions": 1 } }, { "id": "advanced", "name": "Advanced Enterprise Assessment", "price_usd": 95000, "description": "All 14 domains for up to 2,500 employees, up to 10 locations and up to 10 cloud accounts. Adds hands-on configuration review of cloud, identity and network controls, up to 30 interviews, a technical findings appendix, peer benchmark and remediation guidance per finding.", "includes": [ "Up to 30 stakeholder interviews", "Configuration review of cloud, identity and network controls", "Detailed technical findings appendix", "Peer benchmark comparison", "Remediation guidance with resource estimates", "2 readouts (technical and executive)" ], "excludes": [ "Penetration testing", "Board-level presentation", "Executive workshops", "Multi-year investment plan" ], "limits": { "employees": 2500, "locations": 10, "cloud_accounts": 10, "sessions": 2 } }, { "id": "executive", "name": "Executive Security Program Assessment", "price_usd": 150000, "description": "No fixed headcount or location cap; scoped for multi-entity or multi-region enterprises. Everything in Advanced plus a board-level presentation, up to 4 executive workshops, a multi-year strategic roadmap with investment guidance and a security metrics dashboard design.", "includes": [ "Scope set at kickoff, no fixed size cap", "Board-level presentation", "Up to 4 executive workshops", "Multi-year roadmap with investment guidance", "Detailed peer benchmarking", "Security metrics dashboard design" ], "excludes": [ "Penetration testing", "Implementation of roadmap items", "Ongoing vCISO support after delivery" ], "limits": { "sessions": 4 } } ], "scope": [ "Security program governance assessment", "Security architecture evaluation", "Cloud security posture review", "Identity and access management analysis", "Application security program assessment", "Data protection controls review", "Network security evaluation", "Vulnerability management program assessment", "Security operations and incident response review", "Third-party risk management assessment", "Security awareness program evaluation", "Compliance posture analysis", "Emerging technology risk assessment", "Security metrics and reporting review" ], "deliverables": [ "Comprehensive security posture report", "Security program maturity scoring", "Domain-by-domain gap analysis", "Risk-prioritized recommendation roadmap", "Security investment guidance", "Executive presentation with findings", "Implementation timeline and resource requirements", "Benchmark comparison to industry peers", "Security metrics dashboard", "Detailed technical findings appendix" ], "scope_url": "https://cisomarketplace.services/scope?service=ciso-comprehensive-security-assessment" }, { "slug": "critical-infrastructure-protection", "title": "Critical Infrastructure Protection Program", "url": "https://cisomarketplace.services/services/critical-infrastructure-protection", "md_url": "https://cisomarketplace.services/services/critical-infrastructure-protection.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive security program for critical infrastructure protection, including water systems, emergency services, and essential facility security.", "from_price_usd": 90000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Infrastructure Protection Assessment", "price_usd": 90000, "description": "Assessment of one site, covering the IT network and the boundary with the operational network.", "includes": [ "One site", "IT and boundary review", "Risk register" ], "excludes": [ "Hands-on testing of operational equipment", "More than one site" ], "limits": { "locations": 1 } }, { "id": "advanced", "name": "Advanced Infrastructure Protection Program", "price_usd": 155000, "description": "Up to 3 sites, including passive review of the operational network.", "includes": [ "Up to three sites", "Passive operational network review" ], "excludes": [ "Active testing of live operational equipment" ], "limits": { "locations": 3 } }, { "id": "premium", "name": "Enterprise Infrastructure Protection Solution", "price_usd": 240000, "description": "Up to 6 sites with a protection program roadmap; larger estates are scoped at kickoff.", "includes": [ "Up to six sites", "Program roadmap", "Executive readout" ], "excludes": [ "Implementation work" ], "limits": { "locations": 6 } } ], "scope": [ "Water system security", "Emergency services protection", "Essential facility assessment", "Infrastructure interdependency analysis", "Physical security integration" ], "deliverables": [ "Infrastructure security architecture", "Protection framework", "Interdependency analysis", "Risk mitigation strategy", "Emergency response procedures" ], "scope_url": "https://cisomarketplace.services/scope?service=critical-infrastructure-protection" }, { "slug": "crypto-exchange-security", "title": "Cryptocurrency Exchange Security Program", "url": "https://cisomarketplace.services/services/crypto-exchange-security", "md_url": "https://cisomarketplace.services/services/crypto-exchange-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Advanced security assessment and implementation program for cryptocurrency exchanges, focusing on wallet security, trading systems, and regulatory compliance.", "from_price_usd": 75000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Exchange Security Assessment", "price_usd": 75000, "description": "One exchange platform: up to 3 wallet systems (hot and cold), 1 trading web app and 1 public API. Wallet architecture and key ceremony review plus trading engine security testing.", "includes": [ "Hot wallet security assessment", "Cold storage procedure and key ceremony review", "Trading engine and web app security testing", "Public API security testing", "Exchange security architecture report" ], "excludes": [ "Smart contract audit", "KYC/AML compliance evaluation", "Mobile app testing", "Incident response playbooks" ], "limits": { "wallets": 3, "web_apps": 1, "apis": 1 } }, { "id": "advanced", "name": "Advanced Exchange Security Program", "price_usd": 125000, "description": "Up to 10 wallet systems, 2 web apps, 3 APIs, 1 mobile app and 1 smart contract repository: everything in the basic tier, wallet architecture redesign recommendations, KYC/AML control evaluation, smart contract audit and incident response playbooks.", "includes": [ "Everything in the basic tier", "Wallet security framework including multi-signature and withdrawal controls", "KYC/AML compliance evaluation", "Smart contract audit for 1 repository", "Incident response playbooks" ], "excludes": [ "Custom security tooling", "Internal corporate network testing", "Ongoing monitoring" ], "limits": { "wallets": 10, "web_apps": 2, "apis": 3, "mobile_apps": 1, "repositories": 1 } }, { "id": "premium", "name": "Enterprise Exchange Security Solution", "price_usd": 200000, "description": "Up to 25 wallet systems, 3 web apps, 5 APIs, 2 mobile apps and 3 contract repositories: everything in the advanced tier, corporate and cloud infrastructure testing, custom withdrawal-anomaly tooling handed over, and one retest round.", "includes": [ "Everything in the advanced tier", "Corporate, cloud and production infrastructure testing", "Custom detection tooling handed over", "Red-team style withdrawal path exercise", "One full retest round" ], "excludes": [ "Operating a monitoring service", "Licensing or regulatory filings", "Custody of client keys" ], "limits": { "wallets": 25, "web_apps": 3, "apis": 5, "mobile_apps": 2, "repositories": 3 } } ], "scope": [ "Hot wallet security assessment", "Cold storage implementation review", "Trading engine security testing", "KYC/AML compliance evaluation", "Smart contract security audit" ], "deliverables": [ "Exchange security architecture", "Wallet security framework", "Trading system analysis", "Compliance documentation", "Incident response playbooks" ], "scope_url": "https://cisomarketplace.services/scope?service=crypto-exchange-security" }, { "slug": "defense-industry-security", "title": "Defense Industry Security Program", "url": "https://cisomarketplace.services/services/defense-industry-security", "md_url": "https://cisomarketplace.services/services/defense-industry-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment and compliance program for defense contractors and military industrial complex, focusing on CMMC, NIST 800-171, and classified information handling.", "from_price_usd": 12500, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 12500, "description": "CMMC Level 2 / NIST SP 800-171 gap assessment of 1 enclave at 1 location, up to 50 employees: all 110 requirements scored from interviews and document review, with a gap report and a draft plan of action. No documentation writing.", "includes": [ "Assessment of the 110 NIST SP 800-171 requirements", "Scoping of the CUI boundary for 1 enclave", "Scored gap report", "Draft plan of action and milestones", "Readout call" ], "excludes": [ "System Security Plan or policy writing", "Supply chain, physical security and insider threat reviews", "Control implementation", "Level 3 preparation" ], "limits": { "employees": 50, "locations": 1 } }, { "id": "basic", "name": "Core Defense Security Assessment", "price_usd": 85000, "description": "CMMC Level 1-2 readiness for up to 250 employees, up to 2 locations and up to 10 suppliers: gap assessment, System Security Plan and policy set, review of classified / controlled information handling, physical security assessment of each site and supply chain risk analysis.", "includes": [ "CMMC Level 1-2 gap assessment and readiness report", "System Security Plan and policy documentation", "Classified / controlled information handling procedures", "Physical security assessment of up to 2 sites", "Supply chain risk analysis for up to 10 suppliers" ], "excludes": [ "CMMC Level 3 preparation", "Insider threat program evaluation", "Hands-on control implementation", "The certification assessment itself" ], "limits": { "employees": 250, "locations": 2, "vendors": 10 } }, { "id": "advanced", "name": "Advanced Defense Security Program", "price_usd": 150000, "description": "CMMC Level 2 with third-party (C3PAO) assessment preparation: remediation oversight, evidence library and a mock assessment, plus supply-chain flow-down review.", "includes": [], "excludes": [ "Program management of the full implementation", "Mock assessment before certification", "The certification assessment itself" ], "limits": { "employees": 1000, "locations": 5, "vendors": 25 } }, { "id": "premium", "name": "Enterprise Defense Security Solution", "price_usd": 250000, "description": "CMMC Level 3 preparation (NIST SP 800-172 enhanced requirements, DIBCAC-assessed) and multi-enclave program management. CMMC 2.0 has three levels; there is no Level 4 or 5.", "includes": [], "excludes": [ "The certification assessment itself (performed by an independent assessor)", "Facility clearance sponsorship", "Purchase of security tooling", "Managed security operations" ], "limits": { "employees": 5000, "locations": 15, "vendors": 75 } } ], "scope": [ "CMMC compliance assessment", "Classified information handling review", "Supply chain security evaluation", "Physical security assessment", "Insider threat program evaluation" ], "deliverables": [ "Defense security architecture", "CMMC readiness report", "Classified data handling procedures", "Supply chain risk analysis", "Security program documentation" ], "scope_url": "https://cisomarketplace.services/scope?service=defense-industry-security" }, { "slug": "digital-banking-security", "title": "Digital Banking Security Assessment", "url": "https://cisomarketplace.services/services/digital-banking-security", "md_url": "https://cisomarketplace.services/services/digital-banking-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment for digital banking platforms, focusing on payment systems, mobile banking security, and financial transaction protection.", "from_price_usd": 60000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Digital Banking Assessment", "price_usd": 60000, "description": "One digital banking platform: 1 web app, 1 mobile app (one platform) and up to 2 APIs. Security testing of login, payments and account functions plus a payment processing security review.", "includes": [ "Web and mobile banking application security testing", "Payment processing security review", "API security review for up to 2 APIs", "Banking platform security report", "One retest round" ], "excludes": [ "Transaction monitoring evaluation", "Fraud prevention analysis", "Second mobile platform", "Custom tooling" ], "limits": { "web_apps": 1, "mobile_apps": 1, "apis": 2 } }, { "id": "advanced", "name": "Advanced Digital Banking Program", "price_usd": 100000, "description": "Up to 2 web apps, 2 mobile apps (iOS and Android) and 5 APIs: everything in the basic tier, transaction monitoring rule evaluation, fraud prevention analysis with abuse-case testing and an API protection strategy.", "includes": [ "Everything in the basic tier", "Transaction monitoring evaluation", "Fraud prevention analysis and abuse-case testing", "API protection strategy", "Fraud prevention framework" ], "excludes": [ "Custom test and detection tooling", "Core banking and internal network testing", "Partner and open-banking integrations beyond 5 APIs" ], "limits": { "web_apps": 2, "mobile_apps": 2, "apis": 5 } }, { "id": "premium", "name": "Enterprise Digital Banking Solution", "price_usd": 165000, "description": "Up to 3 web apps, 4 mobile apps and 10 APIs including partner integrations: everything in the advanced tier, supporting cloud and internal infrastructure testing, custom fraud-scenario test tooling handed over and two retest rounds.", "includes": [ "Everything in the advanced tier", "Partner and open-banking API testing", "Cloud and internal infrastructure supporting the platform", "Custom fraud-scenario tooling handed over", "Two retest rounds" ], "excludes": [ "Operating fraud monitoring", "Regulatory audit or attestation", "Remediation engineering" ], "limits": { "web_apps": 3, "mobile_apps": 4, "apis": 10 } } ], "scope": [ "Payment processing security", "Mobile banking assessment", "API security review", "Transaction monitoring evaluation", "Fraud prevention analysis" ], "deliverables": [ "Banking platform security report", "Payment security analysis", "Mobile security recommendations", "API protection strategy", "Fraud prevention framework" ], "scope_url": "https://cisomarketplace.services/scope?service=digital-banking-security" }, { "slug": "digital-transformation-security", "title": "Digital Transformation Security Program", "url": "https://cisomarketplace.services/services/digital-transformation-security", "md_url": "https://cisomarketplace.services/services/digital-transformation-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment and framework designed specifically for organizations undergoing digital transformation initiatives. Our specialized program addresses the unique security challenges of rapid technological change, legacy system integration, new business models, and accelerated development cycles - ensuring security becomes an enabler rather than a barrier to digital innovation.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "essential", "name": "Essential Digital Security Assessment", "price_usd": 45000, "description": "Security assessment of 1 transformation initiative for up to 500 employees: up to 2 cloud accounts, up to 10 APIs and up to 25 developers. Architecture review, cloud migration and legacy-transition risks, technology risk report and roadmap.", "includes": [ "Security architecture review of 1 initiative", "Cloud migration security evaluation for up to 2 accounts", "Legacy-to-digital transition risk review", "API security review (design-level) for up to 10 APIs", "Technology risk assessment report and roadmap" ], "excludes": [ "DevSecOps transformation assessment", "Digital identity modernization", "Risk quantification model", "Penetration testing or code review" ], "limits": { "employees": 500, "cloud_accounts": 2, "apis": 10, "developers": 25 } }, { "id": "comprehensive", "name": "Comprehensive Digital Transformation Security", "price_usd": 85000, "description": "Up to 3 initiatives for up to 2,500 employees: up to 5 cloud accounts, up to 30 APIs and up to 100 developers. Adds a security architecture blueprint, DevSecOps assessment and roadmap, API governance model, identity modernization review and data governance.", "includes": [ "Everything in Essential, for up to 3 initiatives", "Security architecture blueprint", "DevSecOps assessment and implementation roadmap", "API security governance model", "Digital identity modernization review", "Cloud security enhancement plan" ], "excludes": [ "Organization-wide governance model", "Digital risk quantification", "Security talent development plan", "Hands-on implementation" ], "limits": { "employees": 2500, "cloud_accounts": 5, "apis": 30, "developers": 100 } }, { "id": "enterprise", "name": "Enterprise Digital Security Transformation", "price_usd": 135000, "description": "Organization-wide transformation: up to 15 cloud accounts, up to 100 APIs and up to 300 developers; no fixed cap on employees and initiatives - scoped at kickoff. Adds a quantified risk model, governance structure, security automation plan and talent development plan.", "includes": [ "Everything in Comprehensive, organization-wide", "Digital risk quantification model", "Security governance structure for digital initiatives", "Security automation recommendations and control design", "Security culture and talent development plan", "Executive and board readout" ], "excludes": [ "Building or operating the automation", "Penetration testing or code review", "Staffing the transformation program", "Tool licences" ], "limits": { "cloud_accounts": 15, "apis": 100, "developers": 300 } } ], "scope": [ "Digital initiative security architecture review", "Legacy-to-digital transition security", "DevSecOps transformation assessment", "Cloud migration security evaluation", "API ecosystem security", "Digital identity modernization", "Data governance for digital initiatives", "Security culture transformation", "Automated security controls assessment", "Digital risk quantification" ], "deliverables": [ "Digital transformation security framework", "Security architecture blueprint", "Technology risk assessment report", "Legacy integration security strategy", "DevSecOps implementation roadmap", "Cloud security enhancement plan", "API security governance model", "Security automation recommendations", "Security talent development plan" ], "scope_url": "https://cisomarketplace.services/scope?service=digital-transformation-security" }, { "slug": "election-systems-security", "title": "Election Systems Security Assessment", "url": "https://cisomarketplace.services/services/election-systems-security", "md_url": "https://cisomarketplace.services/services/election-systems-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Specialized security assessment for election systems and voting infrastructure, including hardware testing, software evaluation, and process validation.", "from_price_usd": 65000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Election Systems Assessment", "price_usd": 65000, "description": "Assessment for 1 jurisdiction: up to 2 equipment models (limit 'devices' = distinct models), configuration review of the election management software, ballot processing review, audit log validation and process walkthroughs. No hardware teardown.", "includes": [ "Security testing of up to 2 voting equipment models (external interfaces and configuration)", "Election management software configuration review", "Ballot processing system review", "Audit log validation", "Process validation documentation and security report" ], "excludes": [ "Hardware teardown and firmware extraction", "Results transmission testing", "Custom test tooling", "Additional jurisdictions" ], "limits": { "devices": 2, "locations": 1 } }, { "id": "advanced", "name": "Advanced Election Security Program", "price_usd": 110000, "description": "Up to 5 equipment models and up to 3 jurisdictions. Adds hardware-level testing (ports, storage media, firmware extraction), results transmission security testing, and process validation of every stage from ballot definition to canvass.", "includes": [ "Hardware-level testing of up to 5 equipment models", "Results transmission security testing", "Election management software assessment", "End-to-end process validation for up to 3 jurisdictions", "Audit framework recommendations", "Security enhancement roadmap" ], "excludes": [ "Custom test harnesses and tooling", "Whole-system validation across all components", "Certification testing under any federal or state program" ], "limits": { "devices": 5, "locations": 3 } }, { "id": "premium", "name": "Enterprise Election Security Solution", "price_usd": 175000, "description": "Up to 10 equipment models and up to 10 jurisdictions, e.g. a statewide system. Adds custom test tooling built for the equipment in scope and validation of the whole system as deployed, including integrations between components.", "includes": [ "Everything in the Advanced program, for up to 10 models", "Custom test tooling for the equipment in scope", "Whole-system validation including component integrations", "Audit framework design", "Executive briefing for election officials" ], "excludes": [ "Certification testing under any federal or state program", "Election-day monitoring or incident response", "Remediation by the equipment vendor", "Public disclosure handling" ], "limits": { "devices": 10, "locations": 10 } } ], "scope": [ "Voting machine security testing", "Ballot processing system review", "Election management software assessment", "Results transmission security", "Audit log validation" ], "deliverables": [ "Election system security report", "Process validation documentation", "Technical security analysis", "Audit framework recommendations", "Security enhancement roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=election-systems-security" }, { "slug": "energy-sector-security", "title": "Energy Sector Security Program", "url": "https://cisomarketplace.services/services/energy-sector-security", "md_url": "https://cisomarketplace.services/services/energy-sector-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security assessment for energy sector infrastructure, including power generation, distribution systems, and grid security.", "from_price_usd": 95000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Energy Security Assessment", "price_usd": 95000, "description": "One generation or distribution site with up to 250 OT/SCADA assets: architecture review, passive network assessment, SCADA configuration review and IT/OT segmentation testing. No active testing on live control systems.", "includes": [ "OT asset inventory and architecture review", "Passive SCADA network assessment", "IT/OT segmentation testing", "SCADA configuration and remote access review", "Emergency response procedure review" ], "excludes": [ "Smart grid and distribution automation analysis", "Active testing of control systems", "Compliance documentation", "Nuclear facilities" ], "limits": { "locations": 1, "internal_hosts": 250 } }, { "id": "advanced", "name": "Advanced Energy Security Program", "price_usd": 165000, "description": "Up to 3 sites and up to 1,000 OT/SCADA assets: everything in the basic tier, distribution and smart grid analysis, active SCADA testing in maintenance windows or test environments, renewable systems review and a grid protection framework.", "includes": [ "Everything in the basic tier", "Distribution system and smart grid assessment", "Active SCADA testing in agreed windows", "Renewable energy system review", "Grid protection framework and compliance documentation" ], "excludes": [ "Custom tooling", "Monitoring after delivery", "Nuclear facilities", "More than 3 sites" ], "limits": { "locations": 3, "internal_hosts": 1000 } }, { "id": "premium", "name": "Enterprise Energy Security Solution", "price_usd": 250000, "description": "Full-scope energy security with custom tools, continuous monitoring, and complete compliance management", "includes": [], "excludes": [ "Remediation engineering or control system replacement", "Physical security guarding" ], "limits": { "locations": 8 } } ], "scope": [ "Power generation security", "Distribution system assessment", "Smart grid protection", "SCADA system testing", "Nuclear facility security", "Renewable energy systems" ], "deliverables": [ "Energy sector security architecture", "Grid protection framework", "SCADA security analysis", "Regulatory compliance documentation", "Emergency response procedures" ], "scope_url": "https://cisomarketplace.services/scope?service=energy-sector-security" }, { "slug": "event-specific-security", "title": "Event-Specific Security Enhancement Program", "url": "https://cisomarketplace.services/services/event-specific-security", "md_url": "https://cisomarketplace.services/services/event-specific-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security packages tailored for specific major events like the Super Bowl, World Series, Kentucky Derby, focusing on unique venue characteristics and event-specific requirements.", "from_price_usd": 150000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Event Enhancement Package", "price_usd": 150000, "description": "One named event at 1 venue: event-specific threat assessment, historical incident analysis, local threat intelligence and an event security plan with up to 3 playbooks. One coordination session with local agencies.", "includes": [ "Event-specific threat assessment", "Historical incident analysis", "Local threat intelligence summary", "Event security plan with up to 3 playbooks", "One local coordination session" ], "excludes": [ "Venue-specific access control design", "On-site presence during the event", "After-action documentation", "Tabletop exercises" ], "limits": { "locations": 1, "scenarios": 3, "sessions": 1 } }, { "id": "advanced", "name": "Advanced Event Enhancement Program", "price_usd": 275000, "description": "One event across up to 2 venues: everything in the basic tier, venue-specific protocols and access control design, a local coordination framework, regional security matrix, up to 6 playbooks and up to 3 sessions including 1 tabletop exercise.", "includes": [ "Everything in the basic tier", "Venue-specific security protocols and access control design", "Local coordination framework and regional security matrix", "Up to 6 playbooks", "One tabletop exercise with local agencies" ], "excludes": [ "On-site team during event days", "Custom coordination tooling", "After-action review" ], "limits": { "locations": 2, "scenarios": 6, "sessions": 3 } }, { "id": "premium", "name": "Premium Event Enhancement Solution", "price_usd": 450000, "description": "One event across up to 4 venues: everything in the advanced tier, custom coordination tooling for local partners, up to 10 playbooks, up to 6 sessions including 2 exercises, on-site advisory presence during event days and after-action documentation.", "includes": [ "Everything in the advanced tier", "Custom local coordination and reporting tooling", "On-site advisory team during event days", "Two exercises including one full rehearsal", "After-action documentation" ], "excludes": [ "Guard force or physical security staffing", "Security equipment and screening hardware", "A second event" ], "limits": { "locations": 4, "scenarios": 10, "sessions": 6 } } ], "scope": [ "Event-specific threat assessment", "Historical incident analysis", "Local coordination planning", "Specialized venue security", "Event-specific access control", "Local threat intelligence", "Cultural considerations", "Regional security integration" ], "deliverables": [ "Event-specific security plan", "Local coordination framework", "Specialized venue protocols", "Cultural sensitivity guidelines", "Regional security matrix", "Local threat analysis", "Event-specific playbooks", "After-action documentation" ], "scope_url": "https://cisomarketplace.services/scope?service=event-specific-security" }, { "slug": "healthcare-device-manufacturing", "title": "Healthcare Device Manufacturing Security Program", "url": "https://cisomarketplace.services/services/healthcare-device-manufacturing", "md_url": "https://cisomarketplace.services/services/healthcare-device-manufacturing.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment for medical device manufacturers, covering FDA compliance, manufacturing processes, and device security throughout the development lifecycle.", "from_price_usd": 75000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Manufacturing Security Assessment", "price_usd": 75000, "description": "Assessment for 1 device product line, 1 manufacturing site and up to 10 suppliers: manufacturing process security review, FDA cybersecurity requirements gap review, firmware security design review, quality system and development lifecycle review. Report and controls matrix.", "includes": [ "Manufacturing process security review of 1 site", "FDA cybersecurity requirements gap review", "Firmware security design review for 1 product line", "Supply chain review for up to 10 suppliers", "Security controls matrix and device security guidelines" ], "excludes": [ "Hands-on firmware or device penetration testing", "Writing FDA submission documentation", "Secure SDLC implementation", "Additional product lines or sites" ], "limits": { "devices": 1, "locations": 1, "vendors": 10 } }, { "id": "advanced", "name": "Advanced Manufacturing Security Program", "price_usd": 125000, "description": "Comprehensive program including detailed process validation and complete security implementation", "includes": [], "excludes": [ "Hands-on device penetration testing", "Ongoing compliance management", "Custom tooling" ], "limits": { "devices": 3, "locations": 2, "vendors": 25 } }, { "id": "premium", "name": "Enterprise Manufacturing Security Solution", "price_usd": 200000, "description": "Full-scope manufacturing security with custom tools, continuous monitoring, and complete compliance management", "includes": [], "excludes": [ "Hands-on device penetration testing (separate service)", "FDA submission filing or regulatory representation", "Tool licences and production hardware" ], "limits": { "devices": 6, "locations": 5, "vendors": 60 } } ], "scope": [ "Manufacturing process security", "FDA compliance review", "Device firmware security", "Supply chain validation", "Quality control systems assessment", "Development lifecycle security" ], "deliverables": [ "Manufacturing security architecture", "FDA compliance documentation", "Security controls matrix", "Supply chain security framework", "Device security guidelines", "Secure SDLC implementation" ], "scope_url": "https://cisomarketplace.services/scope?service=healthcare-device-manufacturing" }, { "slug": "industrial-control-systems-security-program", "title": "Industrial Control Systems Security Program", "url": "https://cisomarketplace.services/services/industrial-control-systems-security-program", "md_url": "https://cisomarketplace.services/services/industrial-control-systems-security-program.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "End-to-end security program for industrial control systems and operational technology environments, including SCADA systems, PLCs, and industrial IoT devices.", "from_price_usd": 85000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core ICS Security Program", "price_usd": 85000, "description": "Program for 1 site: ICS network assessment, SCADA security review, OT security architecture and segmentation design, security controls matrix, OT incident response procedures, and training materials. Monitoring is specified, not deployed.", "includes": [ "ICS network and SCADA security assessment of 1 site", "OT security architecture and network segmentation design", "Security controls matrix", "OT incident response procedures", "Monitoring requirements specification", "Staff training materials" ], "excludes": [ "PLC-level hardening work", "Monitoring implementation", "IT/OT convergence planning across the corporate network", "Additional sites" ], "limits": { "locations": 1, "months": 4 } }, { "id": "advanced", "name": "Advanced ICS Security Solution", "price_usd": 145000, "description": "Program for up to 3 sites. Adds PLC configuration analysis and hardening baselines, industrial IoT evaluation, IT/OT convergence plan, OT monitoring implementation with detection use cases, and compliance documentation.", "includes": [ "Everything in the Core tier, for up to 3 sites", "PLC configuration analysis and hardening baselines", "Industrial IoT device evaluation", "IT/OT convergence plan", "OT monitoring implementation and tuning", "Compliance documentation set" ], "excludes": [ "Round-the-clock monitoring operations design", "Custom tool development", "OT incident response exercises" ], "limits": { "locations": 3, "months": 5 } }, { "id": "premium", "name": "Enterprise ICS Security Platform", "price_usd": 225000, "description": "Program for up to 5 sites. Adds custom tooling for asset discovery or protocol inspection, design and stand-up of 24/7 OT monitoring processes, OT incident response playbooks with 2 exercises, and program governance. More sites are scoped separately.", "includes": [ "Everything in the Advanced tier, for up to 5 sites", "Custom tooling for asset discovery or protocol inspection", "24/7 OT monitoring process design and stand-up with the client's SOC or provider", "OT incident response playbooks and 2 tabletop exercises", "Program governance and metrics" ], "excludes": [ "Staffing of the 24/7 monitoring function", "Monitoring licences and hardware", "More than 5 sites (scoped separately)" ], "limits": { "locations": 5, "months": 6, "scenarios": 2 } } ], "scope": [ "ICS network assessment", "SCADA system security review", "PLC security hardening", "Industrial IoT evaluation", "OT/IT convergence analysis" ], "deliverables": [ "OT security architecture", "Network segmentation design", "Security controls matrix", "Incident response procedures", "Compliance documentation", "Training materials" ], "scope_url": "https://cisomarketplace.services/scope?service=industrial-control-systems-security-program" }, { "slug": "major-international-events-security", "title": "Major International Events Security Program", "url": "https://cisomarketplace.services/services/major-international-events-security", "md_url": "https://cisomarketplace.services/services/major-international-events-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security program for high-profile international sporting events and championships, including multi-venue coordination, international threat intelligence, and large-scale access control systems.", "from_price_usd": 250000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core International Event Security", "price_usd": 250000, "description": "Essential security program for major events covering basic multi-venue coordination and international security protocols", "includes": [], "excludes": [ "Implementation and on-site delivery", "Threat intelligence feeds and social media monitoring", "VIP, media and broadcast protection plans", "Event-time operations staffing" ], "limits": { "locations": 3 } }, { "id": "advanced", "name": "Advanced International Event Security", "price_usd": 500000, "description": "Comprehensive program including detailed threat intelligence, advanced VIP protection, and complete security implementation", "includes": [], "excludes": [ "Real-time monitoring during the event", "Custom tooling", "Overall security program management office" ], "limits": { "locations": 8 } }, { "id": "premium", "name": "Enterprise International Event Security", "price_usd": 1000000, "description": "Full-scope international event security with custom tools, real-time monitoring, and complete program management for major global events", "includes": [], "excludes": [ "Guard force, protective details and law enforcement functions", "Counter-drone and screening equipment", "Venue construction or physical works" ], "limits": {} } ], "scope": [ "Multi-venue security coordination", "International threat intelligence integration", "Cross-border security operations", "VIP protection protocols", "Media operations security", "International broadcasting security", "Transportation network protection", "Accommodation security systems", "Credentialing system security", "Public safety integration", "Counter-drone operations", "Social media monitoring", "Cyber threat detection", "Infrastructure protection" ], "deliverables": [ "Comprehensive event security architecture", "Multi-agency coordination framework", "International security protocols", "VIP protection strategies", "Media security procedures", "Broadcast protection systems", "Transportation security matrix", "Credentialing system design", "Public safety integration plan", "Counter-drone procedures", "Social media monitoring framework", "Cyber defense playbook", "Infrastructure protection plan", "After-action analysis" ], "scope_url": "https://cisomarketplace.services/scope?service=major-international-events-security" }, { "slug": "oil-gas-cybersecurity-assessment", "title": "Oil & Gas Cybersecurity Assessment", "url": "https://cisomarketplace.services/services/oil-gas-cybersecurity-assessment", "md_url": "https://cisomarketplace.services/services/oil-gas-cybersecurity-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security assessment for oil and gas operations, addressing the unique challenges of securing upstream, midstream, and downstream operations. Our comprehensive evaluation examines operational technology, SCADA systems, field devices, and IT/OT convergence points while ensuring compliance with industry regulations and standards.", "from_price_usd": 52000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Oil & Gas Security Assessment", "price_usd": 52000, "description": "Assessment of 1 operating site in one segment: OT/ICS and SCADA security evaluation, field device review on a sample of up to 25 devices, IT/OT boundary review, incident response capability check, and review against 1 regulatory standard.", "includes": [ "OT/ICS and SCADA security evaluation at 1 site", "Field device security review, sample of up to 25 devices", "IT/OT convergence point review", "Incident response capability check", "Regulatory review against 1 standard", "Report with implementation prioritization" ], "excludes": [ "Pipeline monitoring and refinery control system deep-dives", "IT/OT segmentation architecture design", "Physical security integration", "Third-party risk assessment" ], "limits": { "locations": 1, "devices": 25, "frameworks": 1 } }, { "id": "advanced", "name": "Comprehensive Oil & Gas Security Program", "price_usd": 95000, "description": "Assessment of up to 3 sites across up to 2 segments, up to 75 field devices sampled. Adds pipeline monitoring and refinery control system assessment, IT/OT segmentation architecture, SCADA protection strategy, physical security integration, third-party risk, and a compliance roadmap.", "includes": [ "Everything in the Essential tier, for up to 3 sites", "Pipeline monitoring and refinery control system assessment", "IT/OT segmentation architecture", "SCADA protection strategy", "Physical-cyber security integration plan", "Third-party risk assessment of up to 10 vendors" ], "excludes": [ "Implementation support", "Security governance model", "More than 3 sites" ], "limits": { "locations": 3, "devices": 75, "frameworks": 2, "vendors": 10 } }, { "id": "enterprise", "name": "Enterprise Energy Security Transformation", "price_usd": 150000, "description": "Full-spectrum security program for large energy operations with custom architecture, implementation support, and governance", "includes": [], "excludes": [ "Remediation hardware and licences", "Operations above 5 sites (scoped separately)" ], "limits": { "locations": 5, "devices": 200, "frameworks": 3, "vendors": 25 } } ], "scope": [ "OT/ICS security assessment", "SCADA system security evaluation", "Field device security review", "Pipeline monitoring system security", "Refinery control system assessment", "IT/OT convergence security", "Physical security integration", "Regulatory compliance verification", "Third-party risk assessment", "Incident response capability" ], "deliverables": [ "Oil & gas security assessment report", "OT/ICS security recommendations", "SCADA protection strategy", "Field device security framework", "IT/OT segmentation architecture", "Regulatory compliance roadmap", "Physical-cyber security integration plan", "Critical infrastructure protection strategy", "Implementation prioritization" ], "scope_url": "https://cisomarketplace.services/scope?service=oil-gas-cybersecurity-assessment" }, { "slug": "pharmaceutical-industry-security", "title": "Pharmaceutical Industry Security Assessment", "url": "https://cisomarketplace.services/services/pharmaceutical-industry-security", "md_url": "https://cisomarketplace.services/services/pharmaceutical-industry-security.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive security assessment designed specifically for pharmaceutical organizations, addressing the unique security challenges of drug development, clinical trials, manufacturing, and distribution. Our specialized assessment examines intellectual property protection, research data security, regulatory compliance, and supply chain integrity to secure your most valuable assets and ensure compliance with industry regulations.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Pharmaceutical Security Assessment", "price_usd": 45000, "description": "Research and compliance focus: up to 250 employees, 1 site and up to 5 research partners. Covers IP protection controls, research and clinical trial data security, patient data protection and a regulatory gap analysis. Interviews and document review.", "includes": [ "IP protection controls assessment", "Research and clinical trial data security review", "Patient data protection review", "Regulatory compliance gap analysis", "Assessment report with remediation priority matrix" ], "excludes": [ "Manufacturing and lab system security evaluation", "Supply chain integrity verification", "Security architecture design", "Penetration testing" ], "limits": { "employees": 250, "locations": 1, "vendors": 5 } }, { "id": "comprehensive", "name": "Comprehensive Pharmaceutical Security Program", "price_usd": 75000, "description": "Up to 1,000 employees, up to 3 sites and up to 10 research partners. Adds lab environment and manufacturing system security, drug safety systems, research collaboration security and supply chain integrity, with clinical trial security procedures.", "includes": [ "Everything in the research and compliance tier", "Lab and manufacturing system security evaluation", "Supply chain integrity verification", "Third-party research partner assessments (up to 10)", "Clinical trial security procedures and manufacturing enhancement plan" ], "excludes": [ "Multi-country operations assessment", "Target security architecture design", "Integrated compliance framework across regulations", "Penetration testing of plant or lab networks" ], "limits": { "employees": 1000, "locations": 3, "vendors": 10 } }, { "id": "enterprise", "name": "Enterprise Pharmaceutical Security Framework", "price_usd": 120000, "description": "Up to 2,500 employees, up to 10 sites across countries and up to 25 research partners. Adds a global operations assessment, a target security architecture for research, clinical and manufacturing environments, and one integrated compliance framework.", "includes": [ "Everything in the comprehensive tier", "Global, multi-site operations assessment", "Target security architecture document", "Integrated compliance framework mapping all applicable requirements", "Executive and board-level briefing" ], "excludes": [ "Implementation of the architecture", "Penetration testing and red teaming", "Ongoing compliance monitoring", "Organizations above 2,500 employees (scoped separately)" ], "limits": { "employees": 2500, "locations": 10, "vendors": 25 } } ], "scope": [ "IP protection controls assessment", "Clinical trial data security", "Lab environment security evaluation", "Manufacturing system security", "FDA compliance assessment", "Supply chain integrity verification", "Research collaboration security", "Drug safety systems review", "Third-party research partner assessment", "Patient data protection review" ], "deliverables": [ "Pharmaceutical security assessment report", "Regulatory compliance gap analysis", "IP protection framework", "Research data security roadmap", "Manufacturing security enhancement plan", "Clinical trial security procedures", "Supply chain security recommendations", "Remediation priority matrix" ], "scope_url": "https://cisomarketplace.services/scope?service=pharmaceutical-industry-security" }, { "slug": "phase-0-enterprise-ai-risk-assessment", "title": "Phase 0 — Enterprise AI Risk Assessment", "url": "https://cisomarketplace.services/services/phase-0-enterprise-ai-risk-assessment", "md_url": "https://cisomarketplace.services/services/phase-0-enterprise-ai-risk-assessment.md", "practice": "AI Security", "category_group": "Advisory / vCISO", "description": "The six pillars of the AI security program are not sold off a shelf — they are built into your ecosystem, and that requires knowing the ecosystem first. Phase 0 is a scoped, fixed-fee assessment that maps your environment end to end: every AI system in use (sanctioned and shadow), the DevSecOps reality, the data and identity stack, the SIEM / EDR / tooling landscape, and where testing should start. It defines how each pillar gets built for you (BYOK and open-source first, commercial upgrades where they earn their place), designs the integration seams into what you already run, and plans the deployment topology for distributed sites. The output is the current-state map, the future-state design and a sequenced build plan — and only then does the program get a number. CISO Marketplace members get the Phase 0 fee credited toward the program if they proceed.", "from_price_usd": 17500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Phase 0", "price_usd": 17500, "description": "One business unit or platform, up to ~250 employees, delivered remotely: footprint map, pillar model and sequenced build plan", "includes": [], "excludes": [ "On-site week", "Sibling entities or additional platforms", "Distributed collection-plane design" ], "limits": { "employees": 250, "locations": 1 } }, { "id": "advanced", "name": "Standard Phase 0", "price_usd": 30000, "description": "The standard engagement: 10 business days with week 1 on site, the full ecosystem map, integration seams, deployment topology and the executive readout", "includes": [], "excludes": [ "Sibling entities or additional platforms", "Board-level readout" ], "limits": { "employees": 2500, "locations": 5 } }, { "id": "enterprise", "name": "Enterprise Phase 0", "price_usd": 45000, "description": "Multi-site, multi-entity or regulated enterprises: adds sibling entities or platforms, the distributed collection-plane design and a board-level readout", "includes": [], "excludes": [], "limits": { "employees": 25000, "locations": 50 } } ], "scope": [ "AI and security footprint map: sanctioned and shadow AI, data, identity, SIEM / EDR and tooling", "Functional model for each of the six pillars (BYOK and open-source first)", "Integration seams into the platforms and tools you already run", "Deployment topology for distributed sites and segments", "Sequenced, risk-ordered build plan for the pillars" ], "deliverables": [ "Current-state ecosystem map", "Future-state program architecture", "Sequenced build plan with the entry-point pillars", "Executive readout and build vault hand-over" ], "scope_url": "https://cisomarketplace.services/scope?service=phase-0-enterprise-ai-risk-assessment" }, { "slug": "satellite-communications-security-assessment", "title": "Satellite Communications Security Assessment", "url": "https://cisomarketplace.services/services/satellite-communications-security-assessment", "md_url": "https://cisomarketplace.services/services/satellite-communications-security-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Advanced security testing for satellite communication systems, ground stations, and related space-based infrastructure.", "from_price_usd": 55000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core SATCOM Security Assessment", "price_usd": 55000, "description": "One ground station and up to 2 satellite links: ground station security testing, control system assessment, communication protocol review and encryption configuration review. SATCOM security report with a retest.", "includes": [ "1 ground station, up to 2 links", "Up to 10 ground-segment devices tested", "Control system security assessment", "Communication protocol review", "Encryption configuration review", "90-day retest" ], "excludes": [ "Signal interference testing", "Uplink/downlink RF analysis", "Emergency shutdown testing", "Additional ground stations" ], "limits": { "locations": 1, "devices": 10 } }, { "id": "advanced", "name": "Advanced SATCOM Security Program", "price_usd": 95000, "description": "Up to 3 ground stations and up to 5 links: all seven scope items including uplink/downlink analysis, signal interference testing, encryption implementation review, protocol testing and emergency shutdown testing, with up to 25 devices.", "includes": [ "Up to 3 ground stations, up to 5 links", "Uplink/downlink analysis", "Signal interference testing", "Encryption implementation review", "Emergency shutdown testing", "90-day retest" ], "excludes": [ "Custom test tooling for proprietary protocols", "Monitoring after the assessment", "Emergency response support" ], "limits": { "locations": 3, "devices": 25 } }, { "id": "premium", "name": "Enterprise SATCOM Security Solution", "price_usd": 150000, "description": "Full-scope SATCOM security including custom testing tools, continuous monitoring, and emergency response", "includes": [], "excludes": [ "Testing of on-orbit spacecraft buses", "Transmission outside licensed or authorized test windows", "Hardware replacement" ], "limits": { "locations": 5, "devices": 50 } } ], "scope": [ "Ground station security testing", "Satellite uplink/downlink analysis", "Communication protocol review", "Signal interference testing", "Encryption implementation review", "Control system security assessment", "Emergency shutdown testing" ], "deliverables": [ "SATCOM security report", "Signal vulnerability analysis", "Protocol security findings", "Encryption assessment results", "Control system recommendations", "Emergency response guidance", "90-day retest period" ], "scope_url": "https://cisomarketplace.services/scope?service=satellite-communications-security-assessment" }, { "slug": "secure-aiml-infrastructure-assessment", "title": "Secure AI/ML Infrastructure Assessment", "url": "https://cisomarketplace.services/services/secure-aiml-infrastructure-assessment", "md_url": "https://cisomarketplace.services/services/secure-aiml-infrastructure-assessment.md", "practice": "AI Security", "category_group": "Specialized", "description": "Comprehensive security assessment and hardening program for artificial intelligence and machine learning infrastructures, focusing on model security, data protection, and adversarial defense.", "from_price_usd": 16500, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 16500, "description": "Point-in-time audit of 1 AI system (one model or one LLM application) in 1 cloud account: threat model, adversarial testing of the deployed endpoint, and a data-exposure check. Findings report only.", "includes": [ "1 AI system", "Threat model", "Adversarial testing of the deployed endpoint", "Data exposure check", "Findings report with fixes" ], "excludes": [ "Training pipeline review", "Infrastructure hardening", "AI security architecture document", "Retest" ], "limits": { "ai_systems": 1, "cloud_accounts": 1 } }, { "id": "basic", "name": "Core AI/ML Security Assessment", "price_usd": 75000, "description": "Up to 3 AI systems in 1 cloud account: model security assessment, training pipeline review, data privacy evaluation, adversarial testing of each system and hosting infrastructure hardening review. Delivers all six documents.", "includes": [ "Up to 3 AI systems", "Training pipeline security review", "Data privacy evaluation", "Adversarial testing per system", "AI security architecture document", "Implementation roadmap" ], "excludes": [ "MLOps toolchain and CI/CD testing", "Multi-layer testing of RAG and agent components", "Custom protection tooling", "Hands-on hardening work" ], "limits": { "ai_systems": 3, "cloud_accounts": 1 } }, { "id": "advanced", "name": "Advanced AI/ML Security Program", "price_usd": 125000, "description": "Up to 5 AI systems across up to 3 cloud accounts: adds adversarial testing across application, RAG and agent layers, training pipeline and MLOps toolchain testing, poisoning and model-theft scenarios, and one retest.", "includes": [ "Up to 5 AI systems", "App, RAG and agent layer adversarial testing", "MLOps and training pipeline testing", "Poisoning and model-theft scenarios", "One retest", "Adversarial defense playbook" ], "excludes": [ "Custom detection or guardrail tooling", "Monitoring implementation", "Hands-on infrastructure hardening" ], "limits": { "ai_systems": 5, "cloud_accounts": 3 } }, { "id": "premium", "name": "Enterprise AI/ML Security Platform", "price_usd": 195000, "description": "Up to 10 AI systems across up to 5 cloud accounts: Advanced scope plus custom guardrail and detection tooling, security monitoring implemented for the model estate, and hands-on hardening of the ML infrastructure.", "includes": [ "Up to 10 AI systems", "Custom guardrail and detection tooling", "Monitoring framework implemented", "Hands-on infrastructure hardening", "Everything in the Advanced tier" ], "excludes": [ "Ongoing managed monitoring after handover", "Tool licence costs", "Model retraining" ], "limits": { "ai_systems": 10, "cloud_accounts": 5 } } ], "scope": [ "Model security assessment", "Training pipeline security", "Data privacy evaluation", "Adversarial attack testing", "Infrastructure hardening" ], "deliverables": [ "AI security architecture document", "Model protection guidelines", "Data security controls", "Adversarial defense playbook", "Security monitoring framework", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=secure-aiml-infrastructure-assessment" }, { "slug": "security-technology-selection-advisory", "title": "Security Technology Selection Advisory", "url": "https://cisomarketplace.services/services/security-technology-selection-advisory", "md_url": "https://cisomarketplace.services/services/security-technology-selection-advisory.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Vendor-neutral guidance for organizations navigating complex security technology decisions. Our expert advisory service helps security leaders define requirements, evaluate solutions, and select technologies that align with their security strategy and business needs, avoiding costly procurement mistakes and ensuring optimal return on security investments.", "from_price_usd": 40000, "price_cadence": "engagement", "tiers": [ { "id": "single", "name": "Single Technology Selection", "price_usd": 40000, "description": "Selection of 1 security technology category (for example EDR or SIEM): needs assessment, requirements document, evaluation criteria, up to 5 vendors compared, proof-of-concept test criteria, cost-of-ownership comparison and a selection recommendation.", "includes": [ "1 technology category", "Requirements document", "Up to 5 vendors compared", "Proof-of-concept criteria", "TCO comparison and recommendation" ], "excludes": [ "Running the proof of concept", "More than 1 category", "Contract negotiation on the client's behalf", "Implementation" ], "limits": { "vendors": 5 } }, { "id": "program", "name": "Security Program Technology Selection", "price_usd": 75000, "description": "Selection of up to 4 related technology categories within 1 security domain, up to 15 vendors in total. Adds current stack review, integration fit between the chosen products, RFP guidance, negotiation guidance and an implementation roadmap.", "includes": [ "Up to 4 categories in 1 domain", "Up to 15 vendors compared", "Current stack review", "Integration fit analysis", "RFP and negotiation guidance", "Implementation roadmap" ], "excludes": [ "Enterprise-wide architecture strategy", "Multi-year technology roadmap", "Running proofs of concept", "Implementation" ], "limits": { "vendors": 15 } }, { "id": "enterprise", "name": "Enterprise Security Technology Strategy", "price_usd": 120000, "description": "Enterprise-wide technology strategy with no fixed category or vendor cap (scoped at kickoff): full stack review, consolidation opportunities, a reusable selection framework, multi-year technology roadmap, integration strategy, procurement strategy and contract review guidance.", "includes": [ "Scope set at kickoff, no fixed cap", "Full security stack review", "Reusable selection framework", "Multi-year technology roadmap", "Integration and procurement strategy", "Contract review guidance" ], "excludes": [ "Running proofs of concept", "Implementation or migration work", "Legal review of contracts" ], "limits": {} } ], "scope": [ "Security needs assessment", "Current technology stack review", "Requirements definition framework", "Solution evaluation methodology", "Vendor shortlist development", "POC/testing criteria development", "TCO and ROI analysis", "Implementation considerations", "Vendor negotiation guidance", "Technology roadmap alignment" ], "deliverables": [ "Technology requirements document", "Evaluation framework and criteria", "Vendor landscape analysis", "RFP development guidance", "Solution comparison matrix", "Selection recommendation report", "Implementation roadmap", "Procurement strategy", "Contract review guidance", "Technology integration considerations" ], "scope_url": "https://cisomarketplace.services/scope?service=security-technology-selection-advisory" }, { "slug": "space-systems-security", "title": "Space Systems Security Assessment", "url": "https://cisomarketplace.services/services/space-systems-security", "md_url": "https://cisomarketplace.services/services/space-systems-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Specialized security assessment for space systems including satellite control systems, ground stations, and space-based communications.", "from_price_usd": 85000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Space Systems Assessment", "price_usd": 85000, "description": "One ground station and 1 mission control system: infrastructure and control system security assessment, communication protocol design review, and threat analysis for orbital assets. Report and remediation plan.", "includes": [ "1 ground station", "1 mission or spacecraft control system", "Control system security assessment", "Communication protocol design review", "Vulnerability analysis and remediation plan" ], "excludes": [ "RF analysis of uplink and downlink", "Hands-on protocol testing", "Continuous monitoring", "Additional ground stations" ], "limits": { "locations": 1, "devices": 1 } }, { "id": "advanced", "name": "Advanced Space Security Program", "price_usd": 150000, "description": "Up to 3 ground stations and up to 3 mission control systems: adds RF analysis of uplink, downlink and telemetry links, hands-on command-and-control protocol testing, and an orbital asset protection strategy.", "includes": [ "Up to 3 ground stations", "Up to 3 mission control systems", "RF analysis of command and telemetry links", "Hands-on protocol testing", "Orbital asset protection strategy" ], "excludes": [ "Custom test tooling", "Continuous monitoring", "Constellation-wide coverage" ], "limits": { "locations": 3, "devices": 3 } }, { "id": "premium", "name": "Enterprise Space Security Solution", "price_usd": 250000, "description": "Full-scope space systems security program including custom tools and continuous monitoring", "includes": [], "excludes": [ "Live testing against on-orbit assets without operator authorization", "Launch vehicle security", "Hardware replacement" ], "limits": {} } ], "scope": [ "Assessment of space system infrastructure", "control systems", "communication protocols", "orbital asset security" ], "deliverables": [ "Comprehensive security assessment report", "vulnerability analysis", "orbital asset protection strategy", "remediation plan" ], "scope_url": "https://cisomarketplace.services/scope?service=space-systems-security" }, { "slug": "stadium-sports-security", "title": "Stadium and Sports Team Security Program", "url": "https://cisomarketplace.services/services/stadium-sports-security", "md_url": "https://cisomarketplace.services/services/stadium-sports-security.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Advanced security assessment for sports venues and professional teams, covering facility infrastructure, game-day operations, and team asset protection.", "from_price_usd": 65000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Stadium Security Assessment", "price_usd": 65000, "description": "Essential stadium and team security covering basic infrastructure and game-day operations", "includes": [], "excludes": [], "limits": {} }, { "id": "advanced", "name": "Advanced Stadium Security Program", "price_usd": 110000, "description": "Comprehensive assessment including detailed venue analysis and complete security implementation", "includes": [], "excludes": [], "limits": {} }, { "id": "premium", "name": "Enterprise Stadium Security Solution", "price_usd": 175000, "description": "Full-scope stadium and team security with custom tools, continuous monitoring, and complete program management", "includes": [], "excludes": [], "limits": {} } ], "scope": [ "Stadium infrastructure security", "Game-day operations protection", "Team travel security", "Player data protection", "Fan engagement system security", "Ticketing system security" ], "deliverables": [ "Venue security architecture", "Game-day security procedures", "Team security framework", "Data protection strategy", "Emergency response plans", "Access control system design" ], "scope_url": "https://cisomarketplace.services/scope?service=stadium-sports-security" }, { "slug": "telecommunications-infrastructure", "title": "Telecommunications Infrastructure Security Program", "url": "https://cisomarketplace.services/services/telecommunications-infrastructure", "md_url": "https://cisomarketplace.services/services/telecommunications-infrastructure.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Advanced security assessment for telecommunications infrastructure, including 5G networks, fiber optics, and cellular systems.", "from_price_usd": 85000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Telecom Security Assessment", "price_usd": 85000, "description": "One core site and up to 50 network elements: core network security assessment, configuration review of 5G or cellular core functions, management-plane access review and fiber infrastructure review. Architecture and protection strategy.", "includes": [ "1 core site, up to 50 network elements", "Core network security assessment", "Core function configuration review", "Management-plane access review", "Telecom security architecture" ], "excludes": [ "Radio access network testing", "Hands-on signalling and interconnect testing", "Custom tooling", "Hardening work" ], "limits": { "locations": 1, "internal_hosts": 50 } }, { "id": "advanced", "name": "Advanced Telecom Security Program", "price_usd": 145000, "description": "Up to 3 sites and up to 250 network elements: all five scope areas including RAN testing at sampled cell sites, signalling and interconnect testing, fiber infrastructure security, plus the monitoring framework and emergency response procedures.", "includes": [ "Up to 3 sites, up to 250 network elements", "Radio access network testing", "Signalling and interconnect testing", "Monitoring framework", "Emergency response procedures" ], "excludes": [ "Custom protection tooling", "Hands-on hardening of network elements", "Network-wide coverage" ], "limits": { "locations": 3, "internal_hosts": 250 } }, { "id": "premium", "name": "Enterprise Telecom Security Solution", "price_usd": 225000, "description": "No fixed cap on sites or network elements (scoped at kickoff): Advanced scope plus custom detection tooling for signalling and core traffic, hands-on hardening of cellular and core systems with the operator's engineers, and one retest.", "includes": [ "Sites and elements scoped at kickoff", "Custom detection tooling", "Hands-on hardening with operator engineers", "One retest", "Everything in the Advanced tier" ], "excludes": [ "Vendor equipment replacement", "24/7 monitoring operations", "Lawful-intercept system review unless separately authorized" ], "limits": {} } ], "scope": [ "5G network security assessment", "Core network protection", "Radio access network testing", "Fiber infrastructure security", "Cellular system hardening" ], "deliverables": [ "Telecom security architecture", "Network protection strategy", "Infrastructure security analysis", "Monitoring framework", "Emergency response procedures" ], "scope_url": "https://cisomarketplace.services/scope?service=telecommunications-infrastructure" }, { "slug": "transportation-systems", "title": "Transportation Systems Security Program", "url": "https://cisomarketplace.services/services/transportation-systems", "md_url": "https://cisomarketplace.services/services/transportation-systems.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Advanced security assessment for transportation infrastructure, including rail systems, traffic management, and logistics networks.", "from_price_usd": 70000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Transportation Security Assessment", "price_usd": 70000, "description": "One system type (e.g. traffic management) at 1 operations center: security assessment of control systems and supporting networks, up to 25 field devices sampled. Security architecture and network protection strategy.", "includes": [ "1 transport system type", "1 operations center", "Up to 25 field devices sampled", "Transportation security architecture", "Network protection strategy" ], "excludes": [ "Signal system assessment", "Safety integration framework", "Additional system types", "Hardening work" ], "limits": { "locations": 1, "devices": 25 } }, { "id": "advanced", "name": "Advanced Transportation Security Program", "price_usd": 120000, "description": "Up to 3 system types across up to 3 sites, up to 100 field devices sampled: adds signal system assessment, fleet and logistics network review, a safety integration framework and emergency procedures.", "includes": [ "Up to 3 system types, up to 3 sites", "Signal system assessment", "Fleet and logistics network review", "Safety integration framework", "Emergency procedures" ], "excludes": [ "Custom protection tooling", "Hands-on hardening", "Network-wide coverage" ], "limits": { "locations": 3, "devices": 100 } }, { "id": "premium", "name": "Enterprise Transportation Security Solution", "price_usd": 185000, "description": "All five scope areas with no fixed site or device cap (scoped at kickoff): Advanced scope plus custom detection tooling for control and signalling networks, hands-on hardening with the operator's engineers, and one retest.", "includes": [ "All five system types", "Sites and devices scoped at kickoff", "Custom detection tooling", "Hands-on hardening with operator engineers", "One retest" ], "excludes": [ "Safety certification of signalling systems", "Equipment replacement", "24/7 monitoring operations" ], "limits": {} } ], "scope": [ "Rail system security", "Traffic management systems", "Logistics network protection", "Fleet management security", "Signal system assessment" ], "deliverables": [ "Transportation security architecture", "Network protection strategy", "System security analysis", "Safety integration framework", "Emergency procedures" ], "scope_url": "https://cisomarketplace.services/scope?service=transportation-systems" }, { "slug": "zero-trust-architecture-implementation", "title": "Zero Trust Architecture Implementation", "url": "https://cisomarketplace.services/services/zero-trust-architecture-implementation", "md_url": "https://cisomarketplace.services/services/zero-trust-architecture-implementation.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Comprehensive zero trust security architecture design and implementation service tailored for enterprise environments. Includes network segmentation, identity-based access controls, and continuous monitoring setup.", "from_price_usd": 75000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Zero Trust Implementation", "price_usd": 75000, "description": "Zero trust design and implementation for up to 500 users, up to 2 locations and 1 cloud environment: IAM integration with 1 identity provider, microsegmentation of up to 10 application groups, baseline monitoring.", "includes": [ "Up to 500 users, up to 2 locations", "Architecture blueprint and roadmap", "1 identity provider integrated", "Microsegmentation of up to 10 application groups", "Baseline monitoring and post-implementation assessment" ], "excludes": [ "Custom access policies per application", "Policy automation", "Product licences and hardware", "Multi-cloud segmentation" ], "limits": { "users": 500, "locations": 2, "cloud_accounts": 1 } }, { "id": "advanced", "name": "Advanced Zero Trust Program", "price_usd": 125000, "description": "Zero trust program for up to 2,500 users, up to 5 locations and up to 3 cloud environments: segmentation of up to 30 application groups, custom access-control policies per group, security team training and IR playbooks.", "includes": [ "Up to 2,500 users, up to 5 locations", "Up to 3 cloud environments plus on-prem", "Segmentation of up to 30 application groups", "Custom access-control policy framework", "Team training and monitoring/IR playbooks" ], "excludes": [ "Custom policy automation", "Behavioral analytics build-out", "Product licences and hardware", "Post-go-live operations" ], "limits": { "users": 2500, "locations": 5, "cloud_accounts": 3 } }, { "id": "premium", "name": "Enterprise Zero Trust Platform", "price_usd": 195000, "description": "Full-scope zero trust implementation with custom automation, advanced analytics, and complete security transformation support", "includes": [], "excludes": [ "Product licences and hardware", "Managed operation beyond the support period", "Application refactoring" ], "limits": {} } ], "scope": [ "Network architecture review and redesign", "Identity and access management integration", "Microsegmentation implementation", "Security monitoring and analytics setup", "Cloud and on-premise infrastructure" ], "deliverables": [ "Detailed zero trust architecture blueprint", "Implementation roadmap and timeline", "Security policies and procedures documentation", "Training materials for security team", "Monitoring and incident response playbooks", "Post-implementation security assessment report" ], "scope_url": "https://cisomarketplace.services/scope?service=zero-trust-architecture-implementation" }, { "slug": "dark-web-credential-exposure-monitoring", "title": "Dark Web & Credential Exposure Monitoring", "url": "https://cisomarketplace.services/services/dark-web-credential-exposure-monitoring", "md_url": "https://cisomarketplace.services/services/dark-web-credential-exposure-monitoring.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Stolen credentials and infostealer logs are the most common way in. We monitor breach corpuses, infostealer markets, paste sites and criminal forums for your domains, executives and key vendors, validate what we find, and tell you what to reset and why — analyst-reviewed alerts rather than a raw feed.", "from_price_usd": 500, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Essential Exposure Monitoring", "price_usd": 500, "description": "One primary domain: credential and breach monitoring with monthly report", "includes": [], "excludes": [], "limits": { "domains": 1 } }, { "id": "advanced", "name": "Advanced Exposure Monitoring", "price_usd": 1500, "description": "Up to 5 domains plus 10 executives: adds infostealer and session exposure, forum mentions and 24-hour alerting", "includes": [], "excludes": [], "limits": { "domains": 5, "subjects": 10 } }, { "id": "enterprise", "name": "Enterprise Exposure Monitoring", "price_usd": 4000, "description": "Unlimited domains, key vendors and VIPs: adds takedown coordination, brand impersonation monitoring and analyst on call", "includes": [], "excludes": [], "limits": { "domains": 50, "subjects": 50 } } ], "scope": [ "Domain and email credential exposure monitoring", "Infostealer log and session-cookie exposure", "Executive and VIP personal-email monitoring", "Criminal forum and marketplace mentions", "Analyst validation and response guidance" ], "deliverables": [ "Validated exposure alerts", "Monthly exposure report", "Password-reset and session-revocation guidance", "Quarterly threat briefing" ], "scope_url": "https://cisomarketplace.services/scope?service=dark-web-credential-exposure-monitoring" }, { "slug": "domain-profiler-osint", "title": "Domain Profiler (OSINT) External", "url": "https://cisomarketplace.services/services/domain-profiler-osint", "md_url": "https://cisomarketplace.services/services/domain-profiler-osint.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Domain Profiler (OSINT) - External is a tool that provides a comprehensive footprint analysis of your domain, identifying exposed data and vulnerabilities across multiple public sources.", "from_price_usd": 2500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Domain Profile", "price_usd": 2500, "description": "Passive external footprint of 1 root domain and its subdomains: public DNS records, externally visible hosts and services from public sources, third-party data exposure, asset inventory and findings summary with remediation steps.", "includes": [ "DNS record and subdomain discovery for 1 root domain", "External asset inventory list", "Third-party and public source exposure findings", "Threat landscape snapshot", "Footprint report with remediation recommendations" ], "excludes": [ "Active vulnerability scanning or penetration testing", "Additional domains, brands or subsidiaries", "Cross-domain correlation of shared infrastructure", "Ongoing monitoring after delivery" ], "limits": { "domains": 1 } }, { "id": "premium", "name": "Premium Domain Profile", "price_usd": 5000, "description": "Passive external footprint of up to 5 root domains with their subdomains, plus cross-domain correlation of shared infrastructure, lookalike domain check, per-domain findings and one consolidated asset inventory with a readout call.", "includes": [ "Everything in the basic tier for up to 5 root domains", "Cross-domain correlation of shared hosts and providers", "Lookalike and typosquat domain check", "Consolidated asset inventory", "One findings readout call" ], "excludes": [ "Active vulnerability scanning or penetration testing", "More than 5 root domains", "Ongoing monitoring after delivery" ], "limits": { "domains": 5 } } ], "scope": [ "Public DNS records discovery", "Domain exposure footprint", "Third-party data analysis", "External asset mapping", "Threat landscape snapshot" ], "deliverables": [ "OSINT Domain Footprint Report", "Asset inventory list", "Exposure findings summary", "Remediation recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=domain-profiler-osint" }, { "slug": "healthcare-university-osint", "title": "Healthcare & University OSINT Assessment", "url": "https://cisomarketplace.services/services/healthcare-university-osint", "md_url": "https://cisomarketplace.services/services/healthcare-university-osint.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Sector-specific OSINT assessment focused on healthcare institutions and universities, providing exposure analysis and external threat mapping.", "from_price_usd": 6500, "price_cadence": "engagement", "tiers": [ { "id": "healthcare", "name": "Healthcare Assessment", "price_usd": 6500, "description": "Passive OSINT for one healthcare organization with up to 3 root domains and up to 5 facilities: exposed patient-data indicators, clinical and staff portal exposure, leaked staff credentials, vendor-related exposure, and healthcare threat actor activity.", "includes": [ "Healthcare data exposure review", "External asset and portal mapping for up to 3 root domains", "Leaked staff credential search", "Healthcare sector threat assessment", "Sector-specific report with mitigation strategies" ], "excludes": [ "Active scanning or penetration testing", "Medical device security testing", "Compliance assessment of any kind", "Health systems with more than 5 facilities" ], "limits": { "domains": 3, "locations": 5 } }, { "id": "university", "name": "University Assessment", "price_usd": 6500, "description": "Passive OSINT for one academic institution with up to 3 root domains and up to 5 campuses: research asset mapping, exposed student and faculty data, departmental shadow IT on subdomains, leaked credentials, and academic-sector threat activity.", "includes": [ "University open-source intelligence scan", "Research asset and lab exposure mapping", "Departmental subdomain and shadow IT discovery", "Leaked student and faculty credential search", "Sector-specific report with mitigation strategies" ], "excludes": [ "Active scanning or penetration testing", "Assessment of individual researchers or executives", "Compliance assessment of any kind", "University systems with more than 5 campuses" ], "limits": { "domains": 3, "locations": 5 } } ], "scope": [ "Healthcare data exposure review", "University open-source intelligence scan", "Research asset mapping", "Public exposure snapshot", "Sector-specific threat assessment" ], "deliverables": [ "Sector-Specific OSINT Report", "Exposure findings", "Risk mitigation strategies" ], "scope_url": "https://cisomarketplace.services/scope?service=healthcare-university-osint" }, { "slug": "mergers-acquisitions-osint-assessment", "title": "Mergers & Acquisitions OSINT Pre-Assessment", "url": "https://cisomarketplace.services/services/mergers-acquisitions-osint-assessment", "md_url": "https://cisomarketplace.services/services/mergers-acquisitions-osint-assessment.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Provides critical pre-acquisition intelligence by assessing a target organizations public exposure, risks, and external footprint before finalizing M&A deals.", "from_price_usd": 15000, "price_cadence": "engagement", "tiers": [ { "id": "standard", "name": "Standard Pre-Assessment", "price_usd": 15000, "description": "Outside-in OSINT on 1 target company with up to 5 root domains: public exposure, reputation risk, corporate footprint, IP exposure check and visible third-party risk. No access to target systems, staff or documents.", "includes": [ "Public exposure and external footprint analysis", "Breach history and reputation risk discovery", "Intellectual property exposure check", "Visible third-party and supplier risk", "Pre-assessment report with risk profile and remediation guidance" ], "excludes": [ "Access to target systems, documents or data room", "Stakeholder interviews", "Active scanning or penetration testing", "Remediation cost estimates" ], "limits": { "subjects": 1, "domains": 5 } }, { "id": "multi", "name": "Multi-Target Pre-Assessment", "price_usd": 40000, "description": "Outside-in OSINT on up to 3 target companies with up to 15 root domains in total: a separate report per target plus a side-by-side risk comparison for the deal team. No access to target systems, staff or documents.", "includes": [ "Standard pre-assessment for up to 3 targets", "Separate report and risk profile per target", "Side-by-side risk comparison", "One deal-team briefing" ], "excludes": [ "Access to target systems, documents or data room", "Stakeholder interviews", "Active scanning or penetration testing", "More than 3 targets" ], "limits": { "subjects": 3, "domains": 15 } } ], "scope": [ "Public exposure analysis", "Reputation risk discovery", "Corporate footprint mapping", "Intellectual property exposure check", "Third-party risk assessment" ], "deliverables": [ "M&A OSINT Pre-Assessment Report", "Risk profile", "Exposure overview", "Remediation guidance" ], "scope_url": "https://cisomarketplace.services/scope?service=mergers-acquisitions-osint-assessment" }, { "slug": "name-your-price-osint", "title": "Name Your Price: OSINT Assessment", "url": "https://cisomarketplace.services/services/name-your-price-osint", "md_url": "https://cisomarketplace.services/services/name-your-price-osint.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Custom OSINT assessment service where clients can define their needs and budget, allowing for a flexible and tailored open-source intelligence project.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "custom", "name": "Custom OSINT Service", "price_usd": null, "description": "Buyer states the focus areas and budget; a written scope fixes the analyst hours, sources and deliverable before work starts. Passive open-source research only, by one OSINT consultant. No fixed cap - every limit is set at scoping.", "includes": [ "Scoping call and written scope statement", "Passive open-source research on client-specified focus areas", "Custom OSINT report in the agreed format", "Hours and deliverables matched to the agreed budget" ], "excludes": [ "Active scanning, social engineering or any intrusive testing", "Work outside the written scope statement", "Ongoing monitoring unless written into the scope" ], "limits": {} } ], "scope": [ "Flexible OSINT research", "Customizable deliverables", "Budget-aligned services", "Client-specified focus areas" ], "deliverables": [ "Custom OSINT Report", "Client-defined outputs" ], "scope_url": "https://cisomarketplace.services/scope?service=name-your-price-osint" }, { "slug": "retail-osint-assessment", "title": "Retail OSINT Assessment", "url": "https://cisomarketplace.services/services/retail-osint-assessment", "md_url": "https://cisomarketplace.services/services/retail-osint-assessment.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Security threat landscape analysis designed for retail organizations, identifying public exposure, risks, and digital vulnerabilities.", "from_price_usd": 4500, "price_cadence": "engagement", "tiers": [ { "id": "single", "name": "Single Store Assessment", "price_usd": 4500, "description": "Passive OSINT for 1 store location under 1 brand and 1 root domain: retail asset inventory, customer data exposure check, social media risk analysis, public threat identification and a competitor snapshot.", "includes": [ "Retail asset inventory for 1 location and 1 domain", "Customer data exposure check", "Social media risk analysis", "Competitor intelligence snapshot", "Threat report with mitigation recommendations" ], "excludes": [ "Additional stores, brands or domains", "Active scanning or penetration testing", "Point-of-sale or in-store network testing", "Ongoing brand monitoring" ], "limits": { "locations": 1, "domains": 1 } }, { "id": "chain", "name": "Chain Assessment", "price_usd": 12000, "description": "Passive OSINT for up to 25 store locations and up to 5 brands or root domains: per-brand asset inventory, customer data exposure, brand impersonation and social media risk across the chain, and a consolidated threat report. Larger chains are scoped separately.", "includes": [ "Everything in the single tier across up to 25 locations", "Per-brand asset inventory for up to 5 domains", "Brand impersonation and fake storefront check", "Consolidated risk summary with per-brand findings", "One findings readout call" ], "excludes": [ "Active scanning or penetration testing", "Point-of-sale or in-store network testing", "Ongoing brand monitoring", "More than 25 locations" ], "limits": { "locations": 25, "domains": 5 } } ], "scope": [ "Retail asset inventory", "Customer data exposure check", "Social media risk analysis", "Publicly available threat identification", "Competitor intelligence snapshot" ], "deliverables": [ "Retail OSINT Threat Report", "Risk summary", "Mitigation recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=retail-osint-assessment" }, { "slug": "physical-security-ssae-assessment", "title": "Physical Security Assessment: SSAE 16/18", "url": "https://cisomarketplace.services/services/physical-security-ssae-assessment", "md_url": "https://cisomarketplace.services/services/physical-security-ssae-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "In an era where cybersecurity threats dominate headlines, physical security remains a cornerstone of comprehensive risk management. This assessment evaluates physical access controls, surveillance, and response capabilities following SSAE 16/18 standards.", "from_price_usd": 12000, "price_cadence": "engagement", "tiers": [ { "id": "standard", "name": "Standard Assessment", "price_usd": 12000, "description": "Physical security assessment of one facility against SSAE-relevant controls.", "includes": [ "Facility walkthrough", "Control evidence review", "Findings report" ], "excludes": [ "Covert entry testing", "More than one facility" ], "limits": { "locations": 1 } }, { "id": "enterprise", "name": "Enterprise Assessment", "price_usd": 30000, "description": "Up to 4 facilities, including data-centre cages, with a consolidated report for auditors.", "includes": [ "Up to four facilities", "Consolidated auditor-ready report" ], "excludes": [ "Covert entry testing" ], "limits": { "locations": 4 } } ], "scope": [ "Access control review", "Surveillance system analysis", "Physical intrusion detection assessment", "Employee security awareness evaluation", "SSAE 16/18 compliance check" ], "deliverables": [ "Physical Security Assessment Report", "Gap analysis", "Recommendations for improvements", "SSAE 16/18 audit preparation support" ], "scope_url": "https://cisomarketplace.services/scope?service=physical-security-ssae-assessment" }, { "slug": "physical-social-engineering-assessment", "title": "Physical Social Engineering Assessment", "url": "https://cisomarketplace.services/services/physical-social-engineering-assessment", "md_url": "https://cisomarketplace.services/services/physical-social-engineering-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "A Physical Social Engineering Assessment evaluates the vulnerability of your staff and physical premises to social engineering tactics, combining physical penetration testing and employee response assessments.", "from_price_usd": 15000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Physical SE Assessment", "price_usd": 15000, "description": "On-site testing at one facility during business hours, with a findings report.", "includes": [ "One facility", "Business-hours testing", "Findings report and debrief" ], "excludes": [ "After-hours testing", "More than one facility" ], "limits": { "locations": 1 } }, { "id": "advanced", "name": "Advanced Physical SE Assessment", "price_usd": 35000, "description": "On-site testing at up to 3 facilities, including after-hours testing at one of them.", "includes": [ "Up to three facilities", "After-hours testing at one facility", "Executive debrief" ], "excludes": [ "More than three facilities — scoped" ], "limits": { "locations": 3 } } ], "scope": [ "Physical entry attempts", "Employee interaction tests", "Tailgating assessments", "Badge cloning tests", "Physical security culture evaluation" ], "deliverables": [ "Physical Social Engineering Report", "Incident findings", "Training recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=physical-social-engineering-assessment" }, { "slug": "dr-ir-bcp-trifecta-tabletop-exercise", "title": "DR/IR/BCP Trifecta Tabletop Exercise", "url": "https://cisomarketplace.services/services/dr-ir-bcp-trifecta-tabletop-exercise", "md_url": "https://cisomarketplace.services/services/dr-ir-bcp-trifecta-tabletop-exercise.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive multi-scenario tabletop exercise program that integrates Disaster Recovery, Incident Response, and Business Continuity Planning into a unified preparedness assessment. Our specialized approach tests your organization's ability to handle cascading incidents that impact technology infrastructure, security operations, and business operations simultaneously, providing a holistic view of organizational resilience and cross-functional coordination capabilities.", "from_price_usd": 9500, "price_cadence": "engagement", "tiers": [ { "id": "entry", "name": "Entry — market-sized scope", "price_usd": 9500, "description": "Scoped like the market's version of this work (AI-facilitated tabletop (async format)): a fixed, smaller engagement that leads into the Essential Trifecta Exercise tier.", "includes": [], "excludes": [ "Review of existing DR, IR or BCP plans", "Custom scenario development", "Live multi-day facilitated exercise", "Maturity assessment and improvement roadmap" ], "limits": { "participants": 10, "scenarios": 1, "sessions": 1 } }, { "id": "essential", "name": "Essential Trifecta Exercise", "price_usd": 55000, "description": "Current-state review of DR, IR and BCP plans, then 2 live facilitated cascading scenarios over 2 sessions for up to 20 participants. Report with integrated maturity ratings, roadmap and a 180-day follow-up plan.", "includes": [ "DR, IR and BCP current-state assessment", "2 cascading scenarios built for the organization", "2 live facilitated exercise sessions", "Cross-functional gap analysis and roadmap", "25-30 page report and executive briefing" ], "excludes": [ "Separate executive crisis simulation", "Delivery of the 180-day follow-up review (plan only)", "Cascading incident playbook authoring", "More than 20 participants" ], "limits": { "participants": 20, "scenarios": 2, "sessions": 2, "hours": 72 } }, { "id": "comprehensive", "name": "Comprehensive Trifecta Program", "price_usd": 85000, "description": "Up to 3 scenarios over 4 sessions for up to 40 participants, including a dedicated executive crisis simulation, per-department coordination analysis, a cascading-incident playbook, and the 180-day follow-up review delivered. 115 consulting hours.", "includes": [ "Everything in the Essential tier", "Dedicated executive crisis simulation session", "Per-department coordination and communication analysis", "Cascading incident response playbook", "180-day follow-up assessment session" ], "excludes": [ "Recurring quarterly exercises", "Crisis simulation gaming platform access", "Executive one-to-one coaching" ], "limits": { "participants": 40, "scenarios": 3, "sessions": 4, "hours": 115, "months": 6 } }, { "id": "enterprise", "name": "Enterprise Resilience Transformation", "price_usd": 135000, "description": "Advanced multi-domain program with custom scenario development, crisis simulation gaming platform, quarterly integrated exercises, executive coaching, and ongoing organizational resilience optimization", "includes": [], "excludes": [ "Live technical failover or recovery testing", "Rewriting the DR, IR and BCP plans themselves", "Incident response retainer hours" ], "limits": { "participants": 75, "scenarios": 6, "sessions": 8 } } ], "scope": [ "Integrated assessment of DR", "IR", "and BCP current state capabilities (12 hours)", "Cross-functional team readiness evaluation and role validation (8 hours)", "Multi-domain threat landscape analysis and cascading scenario development (10 hours)", "Comprehensive tabletop exercise facilitation with escalating scenarios (8 hours)", "Real-time decision-making assessment across technical and business functions (6 hours)", "Cross-departmental communication and coordination testing (4 hours)", "Executive crisis management and decision authority validation (4 hours)", "Resource allocation and priority assessment during multi-domain incidents (4 hours)", "Vendor and third-party coordination during complex scenarios (3 hours)", "Regulatory compliance and reporting requirements during cascading incidents (3 hours)", "Recovery coordination between IT systems and business operations (4 hours)", "Post-exercise comprehensive analysis and improvement planning (6 hours)" ], "deliverables": [ "Comprehensive trifecta assessment report (25-30 pages)", "Integrated maturity assessment across DR", "IR", "and BCP domains", "Cross-functional capability gap analysis with prioritized recommendations", "Multi-scenario exercise findings with timeline analysis", "Executive decision-making effectiveness assessment", "Inter-departmental coordination and communication evaluation", "Integrated improvement roadmap with cross-domain dependencies", "Resource allocation optimization recommendations", "Vendor and third-party coordination enhancement plan", "Regulatory compliance readiness across all domains", "Cascading incident response playbook development", "Executive briefing with board-ready metrics and ROI analysis", "180-day follow-up assessment and progress review plan" ], "scope_url": "https://cisomarketplace.services/scope?service=dr-ir-bcp-trifecta-tabletop-exercise" }, { "slug": "cryptocurrency-recovery-service", "title": "Cryptocurrency Recovery Service", "url": "https://cisomarketplace.services/services/cryptocurrency-recovery-service", "md_url": "https://cisomarketplace.services/services/cryptocurrency-recovery-service.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Professional assistance in recovering lost or inaccessible cryptocurrency assets, including wallet recovery, seed phrase reconstruction, and hardware wallet troubleshooting.", "from_price_usd": 3500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Crypto Recovery", "price_usd": 3500, "description": "Essential crypto recovery service covering basic wallet recovery, seed phrase assistance, and hardware wallet troubleshooting", "includes": [], "excludes": [ "Exchange account recovery", "Password brute-forcing of encrypted wallet files", "Tracing stolen or scammed funds", "Any guarantee that funds are recovered" ], "limits": { "wallets": 1 } }, { "id": "advanced", "name": "Advanced Crypto Recovery", "price_usd": 6500, "description": "Comprehensive recovery including advanced wallet analysis, exchange account recovery, and detailed forensics", "includes": [], "excludes": [ "Smart contract or DeFi position recovery", "Custom recovery tooling", "Tracing stolen funds or law-enforcement reporting packages", "Any guarantee that funds are recovered" ], "limits": { "wallets": 3 } }, { "id": "premium", "name": "Premium Crypto Recovery", "price_usd": 12000, "description": "Full-scope recovery program with custom tools, smart contract interaction recovery, and complete blockchain forensics", "includes": [], "excludes": [ "Theft, scam or ransomware fund tracing investigations", "Expert witness or litigation support", "Negotiation with exchanges or counterparties", "Any guarantee that funds are recovered" ], "limits": { "wallets": 5 } } ], "scope": [ "Wallet access analysis", "Private key recovery", "Seed phrase reconstruction", "Hardware wallet issues", "Exchange account recovery", "Smart contract interaction issues", "Transaction analysis" ], "deliverables": [ "Recovery feasibility report", "Technical recovery plan", "Step-by-step recovery documentation", "Security recommendations", "Future protection guidelines", "Asset recovery confirmation", "Secure storage recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=cryptocurrency-recovery-service" }, { "slug": "nft-asset-recovery-analysis", "title": "NFT Asset Recovery & Analysis", "url": "https://cisomarketplace.services/services/nft-asset-recovery-analysis", "md_url": "https://cisomarketplace.services/services/nft-asset-recovery-analysis.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Specialized service for recovering compromised or lost NFT assets and analyzing NFT-related smart contracts for security vulnerabilities.", "from_price_usd": 2800, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core NFT Recovery", "price_usd": 2800, "description": "One wallet on one chain, up to 5 NFTs: ownership history verification, transfer tracing on one marketplace, review of 1 smart contract interaction, and a recovery action plan. 15 analyst hours.", "includes": [ "Ownership history for up to 5 NFTs", "Transfer tracing on 1 chain and 1 marketplace", "Review of 1 contract interaction (approvals, malicious signatures)", "Recovery action plan with marketplace report templates", "Wallet security recommendations" ], "excludes": [ "Cross-chain or bridge tracing", "Line-by-line smart contract audit", "Any guarantee that assets are recovered", "Legal action or law-enforcement filing on the client's behalf" ], "limits": { "wallets": 1, "hours": 15 } }, { "id": "advanced", "name": "Advanced NFT Recovery", "price_usd": 5500, "description": "Up to 3 wallets and up to 25 NFTs across up to 2 chains: cross-chain tracking, investigation on up to 3 marketplaces, and vulnerability analysis of up to 3 smart contracts. 30 analyst hours.", "includes": [ "Everything in the basic tier", "Cross-chain tracking across up to 2 chains", "Investigation on up to 3 marketplaces", "Vulnerability analysis of up to 3 contracts", "Evidence package for marketplace and exchange reports" ], "excludes": [ "Chain forensics through mixers or many-hop laundering", "Marketplace integration security audit", "Any guarantee that assets are recovered" ], "limits": { "wallets": 3, "hours": 30 } }, { "id": "premium", "name": "Premium NFT Recovery", "price_usd": 9500, "description": "Up to 10 wallets across up to 4 chains: end-to-end chain forensics of the stolen assets, custom contract analysis scripts, audit of up to 5 contracts, and a security review of the client's marketplace integration. 50 analyst hours.", "includes": [ "Everything in the advanced tier", "End-to-end chain forensics with flow diagrams", "Custom contract analysis scripts", "Audit report on up to 5 contracts", "Marketplace integration security review", "Future protection strategy" ], "excludes": [ "Any guarantee that assets are recovered", "Legal representation or court filings", "Ongoing wallet monitoring after delivery" ], "limits": { "wallets": 10, "hours": 50 } } ], "scope": [ "NFT ownership history", "Smart contract interactions", "Marketplace transactions", "Transfer patterns", "Wallet security", "Gas optimization", "Marketplace integration" ], "deliverables": [ "NFT recovery assessment", "Smart contract audit report", "Security vulnerability analysis", "Recovery action plan", "Marketplace security review", "Future protection strategy", "NFT management best practices" ], "scope_url": "https://cisomarketplace.services/scope?service=nft-asset-recovery-analysis" }, { "slug": "ai-powered-compliance-suite", "title": "AI-Powered Compliance Analysis Suite", "url": "https://cisomarketplace.services/services/ai-powered-compliance-suite", "md_url": "https://cisomarketplace.services/services/ai-powered-compliance-suite.md", "practice": "AI Security", "category_group": "Advisory / vCISO", "description": "AI-driven solution to navigate complex regulatory compliance landscapes, offering automated analysis and recommendations for compliance management.", "from_price_usd": 3500, "price_cadence": "month", "tiers": [ { "id": "single", "name": "Single Framework License", "price_usd": 3500, "description": "Monthly subscription covering 1 regulatory framework: automated control monitoring, gap identification, control-effectiveness analysis and regulatory change tracking for that framework, with dashboard, alerts and one monthly report.", "includes": [ "1 framework monitored", "Compliance dashboard and automated alerts", "Monthly compliance report with KPIs", "Remediation recommendations for identified gaps", "Regulatory change tracking for that framework" ], "excludes": [ "Second or further frameworks", "Cross-framework control mapping", "Audit or certification fees and auditor liaison", "Hands-on remediation of gaps" ], "limits": { "frameworks": 1 } }, { "id": "multi", "name": "Multi-Framework License", "price_usd": 7500, "description": "Monthly subscription covering up to 3 regulatory frameworks, with shared controls mapped across them so one piece of evidence is analysed once. Dashboard, alerts and a monthly report per framework plus a consolidated gap list.", "includes": [ "Up to 3 frameworks monitored", "Cross-framework control mapping", "Consolidated gap and remediation list", "Monthly report per framework", "Regulatory change tracking across all 3" ], "excludes": [ "Fourth or further frameworks", "Custom or internal control frameworks", "Audit or certification fees", "Hands-on remediation of gaps" ], "limits": { "frameworks": 3 } }, { "id": "unlimited", "name": "Unlimited Framework License", "price_usd": 15000, "description": "Monthly subscription with no fixed cap on frameworks; the framework list is scoped at onboarding and can be extended during the term. Adds custom or internal control sets mapped alongside the regulatory frameworks, and a consolidated monthly report.", "includes": [ "No fixed framework cap, scoped at onboarding", "Custom and internal control frameworks", "Cross-framework control mapping", "Consolidated monthly report and KPIs", "New frameworks added during the term" ], "excludes": [ "Audit or certification fees", "Hands-on remediation of gaps", "Acting as the named compliance officer" ], "limits": {} } ], "scope": [ "Automated compliance monitoring", "Regulatory change tracking", "Risk assessment automation", "Control effectiveness analysis", "Compliance gap identification" ], "deliverables": [ "Monthly compliance reports", "Real-time compliance dashboard", "Automated alerts and notifications", "Remediation recommendations", "Compliance metrics and KPIs" ], "scope_url": "https://cisomarketplace.services/scope?service=ai-powered-compliance-suite" }, { "slug": "ai-soc-managed-agentic-security-services-mass", "title": "AI-SOC / Managed Agentic Security Services (MASS)", "url": "https://cisomarketplace.services/services/ai-soc-managed-agentic-security-services-mass", "md_url": "https://cisomarketplace.services/services/ai-soc-managed-agentic-security-services-mass.md", "practice": "AI Security", "category_group": "Incident Response & Recovery", "description": "An AI-native managed detection & response service: AI agents handle triage/investigation with identity + business context, human threat hunters and responders own escalation and response — beyond traditional MDR.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Core AI-SOC monitoring + triage", "includes": [], "excludes": [ "Human-led threat hunting", "Incident response and containment actions", "Custom detection engineering" ], "limits": { "devices": 500, "users": 500 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "Full MASS with human hunters + IR", "includes": [], "excludes": [ "Dedicated analyst pod", "On-site incident response and forensics", "Security tooling licences" ], "limits": { "devices": 2500, "users": 2500 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Enterprise AI-SOC with dedicated pod + 24/7", "includes": [], "excludes": [ "Security tooling and data platform licences", "Legal, PR and breach notification services", "On-site forensics beyond the agreed IR scope" ], "limits": {} } ], "scope": [ "AI-assisted alert triage & investigation", "Identity + business-context enrichment", "Human-led threat hunting", "Incident response & containment", "Detection engineering" ], "deliverables": [ "Managed AI-SOC service", "Monthly detection/response reports", "Threat hunt findings", "IR coordination" ], "scope_url": "https://cisomarketplace.services/scope?service=ai-soc-managed-agentic-security-services-mass" }, { "slug": "attack-surface-management-program", "title": "Attack Surface Management Program", "url": "https://cisomarketplace.services/services/attack-surface-management-program", "md_url": "https://cisomarketplace.services/services/attack-surface-management-program.md", "practice": "Offensive Security", "category_group": "Advisory / vCISO", "description": "Continuous discovery, monitoring, and assessment of your organization's external attack surface and digital footprint. Our ongoing service provides real-time visibility into internet-exposed assets, shadow IT, misconfigurations, and newly emerging vulnerabilities, enabling proactive risk reduction before attackers can exploit these weaknesses.", "from_price_usd": 7500, "price_cadence": "month", "tiers": [ { "id": "standard", "name": "Standard Attack Surface Monitoring", "price_usd": 7500, "description": "Continuous external discovery and vulnerability scanning for up to 5 root domains, up to 250 external IPs and up to 3 cloud accounts. Standard alert rules, critical exposure notifications and one monthly trend report.", "includes": [ "Asset discovery and inventory with subdomain tracking", "Continuous external vulnerability scanning", "Certificate and exposed-credential monitoring", "Critical exposure notifications", "Monthly vulnerability trend report" ], "excludes": [ "Custom alert rules and risk scoring", "Analyst-validated findings and remediation verification", "Quarterly attack surface reduction plan", "Penetration testing or exploitation of findings" ], "limits": { "domains": 5, "external_ips": 250, "cloud_accounts": 3 } }, { "id": "advanced", "name": "Advanced Attack Surface Management", "price_usd": 12500, "description": "Continuous monitoring for up to 15 root domains, up to 1,000 external IPs and up to 10 cloud accounts. Analysts validate findings, rank them by risk, verify fixes, tune custom alerts and deliver a quarterly attack surface reduction plan.", "includes": [ "Everything in Standard at the larger footprint", "Analyst validation and risk-ranked findings", "Remediation guidance and fix verification", "Custom alert rules", "Shadow IT and exposed API monitoring", "Quarterly attack surface reduction plan" ], "excludes": [ "Threat intelligence integration", "Custom risk scoring model", "Named dedicated analyst", "Penetration testing or exploitation of findings" ], "limits": { "domains": 15, "external_ips": 1000, "cloud_accounts": 10 } }, { "id": "enterprise", "name": "Enterprise Attack Surface Intelligence", "price_usd": 20000, "description": "No fixed cap on domains, IPs or cloud accounts; footprint is scoped at onboarding, including subsidiaries and third-party connections. Adds threat intelligence integration, a custom risk scoring model, a named analyst and monthly executive risk summaries.", "includes": [ "Footprint scoped at onboarding, no fixed cap", "Subsidiary and third-party connection tracking", "Threat intelligence integration", "Custom risk scoring model", "Named analyst", "Monthly executive risk summary" ], "excludes": [ "Penetration testing or exploitation of findings", "Hands-on remediation in client systems", "Internal network vulnerability scanning" ], "limits": {} } ], "scope": [ "External asset discovery and inventory", "Continuous vulnerability scanning", "Cloud resource monitoring", "Domain and subdomain tracking", "Certificate management", "Shadow IT discovery", "Exposed credentials monitoring", "API security monitoring", "Third-party connection tracking", "Priority alert notifications" ], "deliverables": [ "Real-time attack surface dashboard", "Monthly vulnerability trend reports", "Critical exposure notifications", "Remediation guidance and verification", "Executive risk summaries", "Shadow IT alerts", "Quarterly attack surface reduction plans", "Risk prioritization framework", "Continuous improvement recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=attack-surface-management-program" }, { "slug": "cco-as-a-service", "title": "CCO-as-a-Service Subscription", "url": "https://cisomarketplace.services/services/cco-as-a-service", "md_url": "https://cisomarketplace.services/services/cco-as-a-service.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Outsourced Chief Compliance Officer service providing ongoing compliance management and governance support.", "from_price_usd": 6500, "price_cadence": "month", "tiers": [ { "id": "startup", "name": "Startup CCO Service", "price_usd": 6500, "description": "CCO services for startups and small businesses", "includes": [], "excludes": [ "Board presentations", "On-site audit or regulator exam support", "Second regulatory regime", "Compliance manager and analyst support beyond the CCO" ], "limits": { "employees": 50, "frameworks": 1 } }, { "id": "growth", "name": "Growth Company CCO Service", "price_usd": 12000, "description": "CCO services for growing mid-market companies", "includes": [], "excludes": [ "Multi-entity or multi-jurisdiction programmes", "Dedicated regulatory analyst", "Legal advice or representation in enforcement matters" ], "limits": { "employees": 500, "frameworks": 3 } }, { "id": "enterprise", "name": "Enterprise CCO Service", "price_usd": 20000, "description": "CCO services for large enterprises", "includes": [], "excludes": [ "Legal advice or representation in enforcement matters", "Compliance software licences", "Data Protection Officer designation (separate service)" ], "limits": { "employees": 2500, "frameworks": 5 } } ], "scope": [ "Compliance program management", "Policy development and maintenance", "Regulatory monitoring", "Compliance training oversight", "Board and management reporting" ], "deliverables": [ "Monthly compliance reports", "Policy updates", "Training materials", "Compliance dashboards", "Board presentations", "Audit support" ], "scope_url": "https://cisomarketplace.services/scope?service=cco-as-a-service" }, { "slug": "ciso-cco-executive-coaching", "title": "CISO & CCO Executive Training and Life Coaching Subscription", "url": "https://cisomarketplace.services/services/ciso-cco-executive-coaching", "md_url": "https://cisomarketplace.services/services/ciso-cco-executive-coaching.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Executive-level training and coaching services for Chief Information Security Officers and Chief Compliance Officers, including leadership development.", "from_price_usd": 3500, "price_cadence": "month", "tiers": [ { "id": "individual", "name": "Individual Executive Coaching", "price_usd": 3500, "description": "One-to-one coaching for 1 CISO or CCO: 1 session of 90 minutes each month, a personal development plan set in month one, and a progress assessment every quarter.", "includes": [ "1 coaching session per month (90 minutes)", "Personal development plan", "Quarterly progress assessment", "Training materials" ], "excludes": [ "Weekly sessions", "Coach contact between sessions", "Coaching of direct reports or the wider team", "Preparation support for specific board meetings" ], "limits": { "participants": 1, "sessions": 1 } }, { "id": "intensive", "name": "Intensive Executive Development", "price_usd": 7500, "description": "One-to-one coaching for 1 executive: 4 sessions of 60 minutes each month (weekly), message access to the coach between sessions, preparation support for board and executive presentations, and a monthly progress review.", "includes": [ "4 coaching sessions per month (weekly)", "Coach contact between sessions", "Board and executive presentation preparation", "Monthly progress review", "Access to an industry mentor" ], "excludes": [ "Coaching for more than one person", "Team workshops", "Technical security training" ], "limits": { "participants": 1, "sessions": 4 } }, { "id": "group", "name": "Group Executive Program", "price_usd": 12000, "description": "Group coaching for leadership teams", "includes": [], "excludes": [ "Weekly one-to-one sessions for each participant", "Coaching for more than 8 people", "Technical security training" ], "limits": { "participants": 8, "sessions": 4 } } ], "scope": [ "Leadership development", "Executive presence coaching", "Strategic thinking training", "Communication skills enhancement", "Work-life balance coaching" ], "deliverables": [ "Monthly coaching sessions", "Personalized development plans", "Training materials", "Progress assessments", "Networking opportunities" ], "scope_url": "https://cisomarketplace.services/scope?service=ciso-cco-executive-coaching" }, { "slug": "continuous-security-validation", "title": "Continuous Security Validation Service", "url": "https://cisomarketplace.services/services/continuous-security-validation", "md_url": "https://cisomarketplace.services/services/continuous-security-validation.md", "practice": "Offensive Security", "category_group": "Advisory / vCISO", "description": "Subscription-based ongoing testing of your security controls, detection capabilities, and response procedures against real-world attack techniques. Our continuous validation approach provides evidence-based assessment of security effectiveness beyond traditional point-in-time assessments, ensuring your defenses work as expected against evolving threats.", "from_price_usd": 8500, "price_cadence": "month", "tiers": [ { "id": "essential", "name": "Essential Security Validation", "price_usd": 8500, "description": "Monthly test cycle: up to 10 MITRE ATT&CK-based scenarios per cycle run from up to 5 test hosts against core prevention and detection controls (endpoint, email, network). Monthly report with detection gaps and 1 purple team session per year.", "includes": [ "1 test cycle per month", "Up to 10 ATT&CK scenarios per cycle", "Prevention and detection control validation", "Monthly report and technique coverage map", "1 purple team session per year" ], "excludes": [ "Lateral movement and data exfiltration simulation", "Evasion technique testing", "Custom scenarios", "Detection rule writing in the client's SIEM" ], "limits": { "scenarios": 10, "internal_hosts": 5, "sessions": 1 } }, { "id": "advanced", "name": "Advanced Security Validation Program", "price_usd": 15000, "description": "Bi-weekly test cycles: up to 25 scenarios per cycle from up to 15 test hosts. Adds lateral movement, exfiltration and evasion testing, security tool configuration validation, response-time analytics and 4 purple team sessions per year.", "includes": [ "2 test cycles per month", "Up to 25 scenarios per cycle", "Lateral movement, exfiltration and evasion tests", "Security tool configuration validation", "Response-time analytics", "4 purple team sessions per year" ], "excludes": [ "Custom scenarios built for the client's threat profile", "Full kill-chain simulations", "Named dedicated engineers", "Detection rule writing in the client's SIEM" ], "limits": { "scenarios": 25, "internal_hosts": 15, "sessions": 4 } }, { "id": "enterprise", "name": "Enterprise Continuous Validation", "price_usd": 25000, "description": "Continuous testing with no fixed scenario cap, from up to 50 test hosts. Adds custom scenarios built to the client's threat profile, full kill-chain simulations, named security engineers, monthly purple team sessions and executive dashboards.", "includes": [ "Continuous testing, no fixed scenario cap", "Custom threat-profile scenarios", "Full kill-chain simulations", "Named security engineers", "12 purple team sessions per year", "Executive dashboards" ], "excludes": [ "Full-scope red team engagement with physical or social engineering", "Licences for the client's own security tools", "24/7 monitoring or incident response" ], "limits": { "internal_hosts": 50, "sessions": 12 } } ], "scope": [ "Automated security control testing", "MITRE ATT&CK-based scenarios", "Detection capability validation", "Prevention control validation", "Response procedure testing", "Purple team exercises", "Evasion technique testing", "Security tool configuration validation", "Lateral movement simulation", "Data exfiltration testing" ], "deliverables": [ "Monthly validation reports", "Control effectiveness metrics", "Detection gap analysis", "Prevention bypass findings", "Security improvement recommendations", "MITRE technique coverage mapping", "Response time analytics", "Executive dashboards", "Security ROI validation", "Continuous improvement roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=continuous-security-validation" }, { "slug": "continuous-threat-exposure-management-ctem-program", "title": "Continuous Threat Exposure Management (CTEM) Program", "url": "https://cisomarketplace.services/services/continuous-threat-exposure-management-ctem-program", "md_url": "https://cisomarketplace.services/services/continuous-threat-exposure-management-ctem-program.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "A packaged CTEM program: continuous attack-surface discovery, threat-led validation (incl. pen test/red team), exposure prioritization, and measurable remediation — replacing point-in-time vuln scanning.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Core CTEM cycle (discover + validate + prioritize)", "includes": [], "excludes": [ "Monthly validation" ], "limits": { "devices": 1000 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "Up to 5,000 assets with monthly validation.", "includes": [ "Monthly validation", "Remediation tracking" ], "excludes": [ "24/7 monitoring" ], "limits": { "devices": 5000, "months": 12 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Up to 25,000 assets across business units, with an embedded program lead.", "includes": [ "Embedded program lead", "Executive exposure reporting" ], "excludes": [ "Managed detection and response" ], "limits": { "devices": 25000, "months": 12 } } ], "scope": [ "Continuous attack surface discovery", "Threat-led validation (pentest/red team)", "Exposure scoping & prioritization", "Remediation tracking & metrics", "Continuous re-validation" ], "deliverables": [ "CTEM program plan", "Exposure dashboard", "Prioritized remediation backlog", "Validation reports" ], "scope_url": "https://cisomarketplace.services/scope?service=continuous-threat-exposure-management-ctem-program" }, { "slug": "data-protection-compliance-officer-services", "title": "Data Protection & Compliance Officer Advisory Services", "url": "https://cisomarketplace.services/services/data-protection-compliance-officer-services", "md_url": "https://cisomarketplace.services/services/data-protection-compliance-officer-services.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Specialized advisory service providing organizations with expert Data Protection Officer (DPO) and/or Chief Compliance Officer (CCO) capabilities without the overhead of full-time executive hires. Our experienced professionals serve as your designated privacy and compliance leadership, fulfilling regulatory requirements while implementing effective data protection and compliance programs tailored to your organization's specific needs.", "from_price_usd": 8500, "price_cadence": "month", "tiers": [ { "id": "advisory", "name": "Compliance Officer Advisory Services", "price_usd": 8500, "description": "Expert guidance and support for your existing privacy and compliance teams with regular consulting and program oversight", "includes": [], "excludes": [ "Acting as the named DPO or CCO", "Contact with regulators on the client's behalf", "Handling individual data subject requests", "Board presentations" ], "limits": { "employees": 250, "frameworks": 2 } }, { "id": "fractional", "name": "Fractional DPO & CCO Service", "price_usd": 15000, "description": "Part-time designated Data Protection Officer and/or Compliance Officer providing leadership, regulatory representation, and program management", "includes": [], "excludes": [ "Day-to-day processing of every data subject request", "Dedicated supporting team", "Legal representation in enforcement proceedings", "Privacy tooling licences" ], "limits": { "employees": 1000, "frameworks": 4 } }, { "id": "enterprise", "name": "Enterprise Privacy & Compliance Leadership", "price_usd": 25000, "description": "Full outsourced privacy and compliance function with dedicated team, comprehensive program management, and executive representation", "includes": [], "excludes": [ "Legal representation in enforcement proceedings", "Privacy tooling licences", "Security operations or technical incident response" ], "limits": {} } ], "scope": [ "Data protection program management", "Privacy impact assessment oversight", "Regulatory monitoring and updates", "Compliance program administration", "Board and executive reporting", "Regulatory liaison services", "Data subject request management", "Employee training program oversight", "Audit preparation and supervision", "Privacy by design implementation", "Incident response coordination", "Vendor compliance management", "Program documentation maintenance", "Regulatory filing preparation" ], "deliverables": [ "Monthly compliance status reports", "Data protection strategy guidance", "Executive briefing materials", "Regulatory compliance roadmaps", "Audit preparation documentation", "Incident response guidance", "Policy and procedure updates", "Employee training materials", "Regulatory submission drafts", "Risk assessment reports", "Board presentation materials", "Compliance metrics dashboard" ], "scope_url": "https://cisomarketplace.services/scope?service=data-protection-compliance-officer-services" }, { "slug": "incident-response-readiness-program", "title": "Incident Response Readiness Program", "url": "https://cisomarketplace.services/services/incident-response-readiness-program", "md_url": "https://cisomarketplace.services/services/incident-response-readiness-program.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "For organizations that need to show — to a board, a customer or a cyber insurer — that they are ready for an incident, without paying for a full response retainer. The program builds or refreshes the incident response plan, runs a tabletop every year, keeps contact trees and playbooks current, and holds prepaid responder hours that convert to proactive work if unused. It is the step below the Incident Response Retainer, which adds contractual response SLAs.", "from_price_usd": 1500, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Essential IR Readiness", "price_usd": 1500, "description": "IR plan build or refresh, one leadership tabletop a year, two playbooks and 10 prepaid responder hours a year. For organizations up to 250 employees and a single site team.", "includes": [], "excludes": [], "limits": { "employees": 250, "scenarios": 1, "hours": 10 } }, { "id": "advanced", "name": "Advanced IR Readiness", "price_usd": 4500, "description": "Adds quarterly check-ins, five playbooks, 40 prepaid hours per year and next-business-day responder access", "includes": [], "excludes": [], "limits": { "employees": 1000, "scenarios": 1, "hours": 40 } }, { "id": "enterprise", "name": "Enterprise IR Readiness", "price_usd": 9500, "description": "Adds two tabletops a year (technical and executive), 100 prepaid hours, forensic-readiness review and priority access to the response team", "includes": [], "excludes": [], "limits": { "employees": 5000, "scenarios": 2, "hours": 100 } } ], "scope": [ "Incident response plan build or refresh", "Annual tabletop exercise with leadership", "Ransomware and business email compromise playbooks", "Prepaid responder hours (convertible to proactive work)", "Quarterly readiness check-in and contact-tree upkeep" ], "deliverables": [ "Incident response plan and playbooks", "Annual tabletop after-action report", "Insurer / customer-ready readiness attestation letter", "Quarterly readiness report" ], "scope_url": "https://cisomarketplace.services/scope?service=incident-response-readiness-program" }, { "slug": "managed-security-awareness-phishing-simulation", "title": "Managed Security Awareness & Phishing Simulation", "url": "https://cisomarketplace.services/services/managed-security-awareness-phishing-simulation", "md_url": "https://cisomarketplace.services/services/managed-security-awareness-phishing-simulation.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Buying an awareness platform is easy; running it well every month is what nobody has time for. We run the whole program on the platform of your choice: monthly phishing simulations written against current lures, targeted training for repeat clickers, new-hire onboarding, and the metrics your auditor and insurer ask for — reviewed by a CISO, not just scheduled by a tool.", "from_price_usd": 450, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Essential Awareness Program", "price_usd": 450, "description": "Up to 50 users: monthly simulations, annual training and compliance reporting", "includes": [], "excludes": [], "limits": { "users": 50 } }, { "id": "advanced", "name": "Advanced Awareness Program", "price_usd": 1200, "description": "Up to 250 users: adds role-based training, repeat-clicker coaching and quarterly briefing", "includes": [], "excludes": [], "limits": { "users": 250 } }, { "id": "enterprise", "name": "Enterprise Awareness Program", "price_usd": 2800, "description": "Up to 1,000 users: adds executive spear-phishing, vishing scenarios, custom content and human-risk scoring", "includes": [], "excludes": [], "limits": { "users": 1000 } } ], "scope": [ "Monthly phishing simulations based on current lures", "Role-based and remedial training assignments", "New-hire onboarding track", "Executive and finance-team spear-phishing scenarios", "Audit- and insurer-ready reporting" ], "deliverables": [ "Monthly campaign results and trend report", "Repeat-clicker remediation plan", "Annual training completion evidence", "Quarterly human-risk briefing" ], "scope_url": "https://cisomarketplace.services/scope?service=managed-security-awareness-phishing-simulation" }, { "slug": "penetration-testing-as-a-service-subscription", "title": "Penetration Testing as a Service (PTaaS) Subscription", "url": "https://cisomarketplace.services/services/penetration-testing-as-a-service-subscription", "md_url": "https://cisomarketplace.services/services/penetration-testing-as-a-service-subscription.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "An annual subscription that replaces the once-a-year pentest: a baseline test, then testing of new features and releases through the year, unlimited retests, findings delivered into your ticketing system and a standing attestation letter that is always current. It is the recurring form of the Penetration Testing service and the delivery model behind the PTaaS pillar of the program.", "from_price_usd": 2000, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Essential PTaaS", "price_usd": 2000, "description": "One application: annual baseline plus quarterly incremental testing and unlimited retests", "includes": [], "excludes": [], "limits": { "web_apps": 1, "apis": 2 } }, { "id": "advanced", "name": "Advanced PTaaS", "price_usd": 3500, "description": "Up to three applications or one app plus infrastructure: monthly testing cadence, ticketing integration and quarterly review", "includes": [], "excludes": [], "limits": { "web_apps": 3, "apis": 6, "external_ips": 100 } }, { "id": "enterprise", "name": "Enterprise PTaaS", "price_usd": 6000, "description": "Portfolio coverage with a dedicated testing pod, release-gated testing, threat modelling of major features and an annual red-team-style scenario", "includes": [], "excludes": [], "limits": { "web_apps": 12, "apis": 25, "external_ips": 500 } } ], "scope": [ "Annual baseline penetration test", "Release and feature testing on a monthly or quarterly cadence", "Unlimited retests of fixed findings", "Findings delivered to Jira / GitHub / Linear", "Always-current attestation letter" ], "deliverables": [ "Baseline and incremental test reports", "Live findings in your ticketing system", "Quarterly security posture summary", "Attestation letter on demand" ], "scope_url": "https://cisomarketplace.services/scope?service=penetration-testing-as-a-service-subscription" }, { "slug": "pe-portfolio-cyber-oversight-program", "title": "Private Equity Portfolio Cyber Oversight Program", "url": "https://cisomarketplace.services/services/pe-portfolio-cyber-oversight-program", "md_url": "https://cisomarketplace.services/services/pe-portfolio-cyber-oversight-program.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Sponsors carry cyber risk across every platform and add-on they own, usually with no consistent view of it. This program gives the fund a portfolio CISO: a common baseline assessment for each company, quarterly scorecards for operating partners and LPs, pre-close cyber diligence on new deals, 100-day plans after close and incident escalation support. Priced per portfolio after scoping — the number of companies, their size and the diligence cadence drive it.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential Portfolio Oversight", "price_usd": null, "description": "Up to 5 portfolio companies: annual baselines, semi-annual scorecards and diligence on demand", "includes": [], "excludes": [], "limits": {} }, { "id": "advanced", "name": "Advanced Portfolio Oversight", "price_usd": null, "description": "Up to 15 companies: quarterly scorecards, 100-day plans for new acquisitions and a named portfolio CISO", "includes": [], "excludes": [], "limits": {} }, { "id": "enterprise", "name": "Enterprise Portfolio Oversight", "price_usd": null, "description": "Large or multi-fund portfolios: embedded team, continuous monitoring, incident response coordination and LP reporting", "includes": [], "excludes": [], "limits": {} } ], "scope": [ "Common cyber baseline for every portfolio company", "Quarterly portfolio scorecards and board reporting", "Pre-close cyber due diligence on new deals and add-ons", "Post-close 100-day security plans", "Incident escalation and insurer coordination" ], "deliverables": [ "Portfolio cyber risk dashboard", "Per-company baseline reports and roadmaps", "Diligence reports per transaction", "Quarterly operating-partner and LP briefing" ], "scope_url": "https://cisomarketplace.services/scope?service=pe-portfolio-cyber-oversight-program" }, { "slug": "smb-continuous-security", "title": "SMB Continuous Security", "url": "https://cisomarketplace.services/services/smb-continuous-security", "md_url": "https://cisomarketplace.services/services/smb-continuous-security.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Ongoing security monitoring and assessment program.", "from_price_usd": 2000, "price_cadence": "month", "tiers": [], "scope": [ "Weekly vulnerability scans", "Monthly phishing campaigns", "Quarterly penetration tests", "Bi-weekly security advisory", "Incident response support", "Security metrics dashboard", "Annual risk assessment" ], "deliverables": [ "Monthly security scorecard", "Quarterly executive summary", "Annual security posture report", "Real-time dashboard access", "4 hours monthly advisory" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-continuous-security" }, { "slug": "security-program-development", "title": "Security Program Development", "url": "https://cisomarketplace.services/services/security-program-development", "md_url": "https://cisomarketplace.services/services/security-program-development.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Build and mature your security program with expert guidance", "from_price_usd": 5000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Security Program Development", "price_usd": 5000, "description": "Up to 20 consulting hours a month with 1 guidance session monthly: programme gap review, core policy set drafted from templates, and a prioritised plan for baseline controls with follow-up on progress.", "includes": [ "Up to 20 hours per month", "1 guidance session per month", "Core policy set from templates", "Baseline controls plan", "Programme roadmap" ], "excludes": [ "Security architecture design", "Mapping to a specific compliance framework", "Board reporting", "Hands-on tool implementation" ], "limits": { "hours": 20, "sessions": 1 } }, { "id": "advanced", "name": "Advanced Security Program Development", "price_usd": 8500, "description": "Up to 40 consulting hours a month with weekly guidance sessions. Adds security architecture review and target design, adaptation of 1 control framework to the organisation, compliance mapping, risk analysis and a maintained risk register.", "includes": [ "Up to 40 hours per month", "Weekly guidance sessions", "Security architecture review and design", "1 control framework adapted", "Compliance mapping", "Risk register" ], "excludes": [ "Named dedicated consultant", "More than 1 framework", "Board presentations", "Hands-on tool implementation" ], "limits": { "hours": 40, "sessions": 4 } }, { "id": "premium", "name": "Enterprise Security Program Development", "price_usd": 15000, "description": "Up to 80 consulting hours a month with a named consultant and up to 8 sessions monthly. Adds implementation of up to 3 frameworks, programme metrics, a quarterly programme review with leadership and continuous roadmap updates.", "includes": [ "Up to 80 hours per month", "Named consultant", "Up to 3 frameworks implemented", "Programme metrics", "Quarterly leadership review", "Continuous roadmap updates" ], "excludes": [ "Acting as the named CISO (see vCISO services)", "Hands-on engineering and tool deployment", "Audit or certification fees" ], "limits": { "hours": 80, "sessions": 8 } } ], "scope": [ "Security Architecture Review", "Controls Assessment", "Risk Analysis", "Compliance Mapping", "Security Program Evaluation" ], "deliverables": [ "Detailed Assessment Report", "Executive Summary", "Recommendations Document", "Implementation Roadmap", "Follow-up Consultation" ], "scope_url": "https://cisomarketplace.services/scope?service=security-program-development" }, { "slug": "security-questionnaire-rfp-response-service", "title": "Security Questionnaire & RFP Response Service", "url": "https://cisomarketplace.services/services/security-questionnaire-rfp-response-service", "md_url": "https://cisomarketplace.services/services/security-questionnaire-rfp-response-service.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Every enterprise deal arrives with a security questionnaire — SIG, CAIQ, a customer spreadsheet or an RFP security section. We build your answer library from your real controls, complete questionnaires inside an agreed turnaround, have a CISO review every submission, and stand up a trust center so many requests never need a questionnaire at all. AI-assisted drafting keeps it fast; a named practitioner keeps it accurate.", "from_price_usd": 950, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Essential Questionnaire Support", "price_usd": 950, "description": "Up to 3 questionnaires a month, 5-business-day turnaround, answer library and a basic trust center page. Limit key 'sessions' = questionnaires per month.", "includes": [], "excludes": [], "limits": { "sessions": 3 } }, { "id": "advanced", "name": "Advanced Questionnaire Support", "price_usd": 2500, "description": "Up to 10 a month, 3-day turnaround, gated trust center with document requests and quarterly gap report", "includes": [], "excludes": [], "limits": { "sessions": 10 } }, { "id": "enterprise", "name": "Enterprise Questionnaire Desk", "price_usd": 6500, "description": "Fair-use volume up to 40 questionnaires a month, 48-hour turnaround, RFP security sections and live customer security calls with a CISO.", "includes": [], "excludes": [], "limits": { "sessions": 40 } } ], "scope": [ "Answer library built from your policies, controls and audit reports", "Questionnaire completion (SIG, CAIQ, custom spreadsheets, portals)", "CISO review of every submission", "Trust center setup and upkeep", "Gap log: questions you cannot yet answer 'yes' to" ], "deliverables": [ "Maintained answer library", "Completed questionnaires within the agreed turnaround", "Public or gated trust center", "Quarterly gap report that feeds your security roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=security-questionnaire-rfp-response-service" }, { "slug": "sr-engineer-as-a-service", "title": "Sr Engineer-as-a-Service Subscription", "url": "https://cisomarketplace.services/services/sr-engineer-as-a-service", "md_url": "https://cisomarketplace.services/services/sr-engineer-as-a-service.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Access to senior-level engineering expertise on a subscription basis for cybersecurity implementation and support.", "from_price_usd": 8500, "price_cadence": "month", "tiers": [ { "id": "parttime", "name": "Part-Time Engineer", "price_usd": 8500, "description": "20 hours per week of senior engineering support", "includes": [], "excludes": [ "Full-time availability", "More than 1 engineer or specialism at once", "On-call or after-hours support", "Tool and cloud licence costs" ], "limits": {} }, { "id": "fulltime", "name": "Full-Time Engineer", "price_usd": 16000, "description": "40 hours per week of senior engineering support", "includes": [], "excludes": [ "Parallel workstreams across several specialisms", "On-call or after-hours support", "Tool and cloud licence costs" ], "limits": {} }, { "id": "team", "name": "Engineering Team", "price_usd": 28000, "description": "Access to a team of senior engineers", "includes": [], "excludes": [ "Security leadership or vCISO duties", "Tool and cloud licence costs" ], "limits": {} } ], "scope": [ "Security architecture design", "Tool implementation and configuration", "Security automation development", "Infrastructure hardening", "Technical mentoring" ], "deliverables": [ "Monthly engineering reports", "Implemented security controls", "Automation scripts and tools", "Architecture documentation", "Knowledge transfer sessions" ], "scope_url": "https://cisomarketplace.services/scope?service=sr-engineer-as-a-service" }, { "slug": "technical-writer-subscription", "title": "Technical Writer & Report Proofer Subscription", "url": "https://cisomarketplace.services/services/technical-writer-subscription", "md_url": "https://cisomarketplace.services/services/technical-writer-subscription.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Professional technical writing services for cybersecurity documentation, reports, and compliance materials.", "from_price_usd": 4500, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Basic Documentation Support", "price_usd": 4500, "description": "Up to 10 documents a month and up to 40 writer hours: editing and proofing of security reports, policy and procedure drafting from client input, 1 revision round per document, 5-business-day turnaround.", "includes": [ "Up to 10 documents per month", "Up to 40 writer hours", "Report editing and proofing", "Policy and procedure drafting", "1 revision round per document" ], "excludes": [ "Style guide creation and upkeep", "Rush turnaround", "Subject-matter technical review of findings", "More than 1 revision round" ], "limits": { "hours": 40 } }, { "id": "professional", "name": "Professional Documentation Support", "price_usd": 8500, "description": "Up to 25 documents a month and up to 80 writer hours. Adds a maintained style guide, technical guides and compliance documentation, 2 revision rounds per document and 3-business-day turnaround.", "includes": [ "Up to 25 documents per month", "Up to 80 writer hours", "Maintained style guide", "Technical guides and compliance documentation", "2 revision rounds per document" ], "excludes": [ "Named dedicated writer", "Same-week rush on large reports", "Subject-matter technical review of findings" ], "limits": { "hours": 80 } }, { "id": "enterprise", "name": "Enterprise Documentation Support", "price_usd": 15000, "description": "Unlimited documentation support", "includes": [], "excludes": [ "Translation", "Subject-matter technical review of findings", "Graphic design beyond diagrams and tables" ], "limits": {} } ], "scope": [ "Security documentation creation", "Report writing and editing", "Policy and procedure development", "Technical content review", "Compliance documentation support" ], "deliverables": [ "Monthly documentation deliverables", "Edited reports", "Policy documents", "Technical guides", "Style guide maintenance" ], "scope_url": "https://cisomarketplace.services/scope?service=technical-writer-subscription" }, { "slug": "virtual-fractional-ciso-services", "title": "Virtual & Fractional CISO Services", "url": "https://cisomarketplace.services/services/virtual-fractional-ciso-services", "md_url": "https://cisomarketplace.services/services/virtual-fractional-ciso-services.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Expert security leadership for organizations that need executive-level cybersecurity guidance without the cost of a full-time CISO. Our Virtual/Fractional CISO service provides experienced security executives who integrate with your team to develop and manage your security program, guide strategic initiatives, communicate with your board, and ensure security aligns with business objectives.", "from_price_usd": 9500, "price_cadence": "month", "tiers": [ { "id": "advisory", "name": "CISO Advisory Services", "price_usd": 9500, "description": "Strategic security guidance and advisory support for organizations with existing security teams that need executive expertise", "includes": [], "excludes": [ "Presenting to the board", "Managing the security team day to day", "Incident response leadership", "Vendor security reviews" ], "limits": { "employees": 250 } }, { "id": "fractional", "name": "Fractional CISO Program", "price_usd": 17500, "description": "Dedicated part-time CISO providing hands-on security leadership, board reporting, and program management on a regular cadence", "includes": [], "excludes": [ "Supporting architect or governance specialists", "Hands-on engineering" ], "limits": { "employees": 1000 } }, { "id": "enterprise", "name": "Enterprise Security Leadership Program", "price_usd": 28000, "description": "Comprehensive security leadership with dedicated CISO and supporting team, providing full executive security function for complex organizations", "includes": [], "excludes": [ "Hands-on engineering and tool deployment", "SOC monitoring", "Hours beyond the monthly allotment" ], "limits": {} } ], "scope": [ "Security program development and oversight", "Board and executive reporting", "Security strategy development", "Budget planning and management", "Security team leadership", "Risk assessment and management", "Vendor security management", "Regulatory compliance guidance", "Policy and standards development", "Security architecture review", "Security metrics program", "Incident response leadership", "Security awareness program oversight", "Technology selection advisory" ], "deliverables": [ "Monthly security status reports", "Executive briefing materials", "Board presentations", "Security roadmap development", "Budget recommendations", "Security policies and procedures", "Risk register and analysis", "Vendor security requirements", "Compliance tracking dashboard", "Security metrics reporting", "Security architecture guidance", "Incident response coordination", "Strategic technology planning" ], "scope_url": "https://cisomarketplace.services/scope?service=virtual-fractional-ciso-services" }, { "slug": "vulnerability-management-as-a-service", "title": "Vulnerability Management as a Service", "url": "https://cisomarketplace.services/services/vulnerability-management-as-a-service", "md_url": "https://cisomarketplace.services/services/vulnerability-management-as-a-service.md", "practice": "Offensive Security", "category_group": "Compliance & GRC", "description": "Most organizations own a scanner and still carry a backlog nobody triages. We run authenticated internal and external scanning, prioritize by exploitability and business context rather than CVSS alone, open and track remediation tickets with your IT team or MSP, verify fixes and report the trend leadership and auditors want to see.", "from_price_usd": 1500, "price_cadence": "month", "tiers": [ { "id": "basic", "name": "Essential VMaaS", "price_usd": 1500, "description": "Up to 150 assets: monthly scanning, prioritized remediation list and monthly report", "includes": [], "excludes": [], "limits": { "devices": 150 } }, { "id": "advanced", "name": "Advanced VMaaS", "price_usd": 3500, "description": "Up to 750 assets: adds weekly scanning, ticketing integration, fix verification and exception management", "includes": [], "excludes": [], "limits": { "devices": 750 } }, { "id": "enterprise", "name": "Enterprise VMaaS", "price_usd": 7500, "description": "Up to 3,000 assets across cloud and on-prem: adds cloud posture findings, remediation SLAs and a named remediation lead", "includes": [], "excludes": [], "limits": { "devices": 3000 } } ], "scope": [ "Authenticated internal and external vulnerability scanning", "Risk-based prioritization (KEV, EPSS, asset criticality)", "Remediation ticketing and tracking with IT or your MSP", "Fix verification and exception management", "Monthly trend and SLA reporting" ], "deliverables": [ "Monthly prioritized remediation list", "Open-risk and SLA dashboard", "Exception register", "Quarterly executive summary" ], "scope_url": "https://cisomarketplace.services/scope?service=vulnerability-management-as-a-service" }, { "slug": "disaster-recovery-assessment-planning", "title": "Disaster Recovery Assessment & Planning", "url": "https://cisomarketplace.services/services/disaster-recovery-assessment-planning", "md_url": "https://cisomarketplace.services/services/disaster-recovery-assessment-planning.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive evaluation of your organization's disaster recovery capabilities and recovery readiness through thorough analysis of current DR plans, infrastructure assessment, and recovery objective validation. Our specialized approach combines vulnerability identification with practical recovery solutions to enhance your organization's resilience against cyberattacks, natural disasters, and system failures.", "from_price_usd": 8100, "price_cadence": "engagement", "tiers": [ { "id": "essential", "name": "Essential DR Assessment", "price_usd": 8100, "description": "Review of one existing DR plan for a single site: up to 15 critical systems, RPO/RTO analysis, backup and restore process check, and up to 5 recovery vendors. 50 consulting hours, 15-20 page report and a prioritized roadmap.", "includes": [ "Gap analysis of the current DR plan", "RPO/RTO analysis for up to 15 critical systems", "Backup and restoration process review", "Recovery prioritization matrix", "15-20 page assessment report with roadmap" ], "excludes": [ "Recovery testing framework and test schedule", "Cost-benefit analysis of DR investments", "Second site or cloud DR evaluation", "Implementation support after the report" ], "limits": { "locations": 1, "vendors": 5, "hours": 50 } }, { "id": "comprehensive", "name": "Comprehensive DR Program", "price_usd": 15400, "description": "Complete disaster recovery assessment with detailed testing framework, vendor analysis, cost-benefit evaluation, and implementation support", "includes": [], "excludes": [ "Cloud DR migration planning", "Design of automated failover or recovery runbooks", "Facilitating a live recovery test", "Support beyond the included hours" ], "limits": { "locations": 3, "vendors": 15 } }, { "id": "enterprise", "name": "Enterprise DR Transformation", "price_usd": 27000, "description": "Advanced disaster recovery program with multi-site assessment, cloud migration planning, automated recovery solutions, and ongoing optimization support", "includes": [], "excludes": [ "Building or operating the DR environment", "Hardware, software or cloud hosting costs", "Business continuity planning for non-IT functions" ], "limits": {} } ], "scope": [ "Current disaster recovery plan assessment and gap analysis (6 hours)", "Critical systems and infrastructure evaluation (8 hours)", "Recovery Point Objective (RPO) and Recovery Time Objective (RTO) analysis (4 hours)", "Backup and restoration process validation (6 hours)", "Data replication and storage assessment (4 hours)", "Recovery site evaluation and capacity planning (6 hours)", "Vendor and third-party recovery dependencies review (4 hours)", "Recovery testing methodology development (3 hours)", "Cost-benefit analysis of DR investments (3 hours)", "Risk assessment against various disaster scenarios (4 hours)", "Recovery prioritization framework development (2 hours)" ], "deliverables": [ "Comprehensive disaster recovery assessment report (15-20 pages)", "Current state vs. desired state analysis", "Recovery objectives recommendations (RPO/RTO)", "Infrastructure resilience evaluation", "Backup and recovery process optimization plan", "Recovery site recommendations and capacity planning", "Vendor dependency analysis and alternatives", "Recovery testing framework and schedule", "DR investment roadmap with cost-benefit analysis", "Risk-based recovery prioritization matrix", "Implementation timeline with milestones" ], "scope_url": "https://cisomarketplace.services/scope?service=disaster-recovery-assessment-planning" }, { "slug": "board-executive-cyber-risk-education", "title": "Board & Executive Cyber Risk Education Program", "url": "https://cisomarketplace.services/services/board-executive-cyber-risk-education", "md_url": "https://cisomarketplace.services/services/board-executive-cyber-risk-education.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Specialized education program designed to help boards of directors and executive teams understand, govern, and communicate about cybersecurity risks and their fiduciary responsibilities. Our expert-led program addresses the growing regulatory requirements for cyber risk oversight, SEC disclosure obligations, and provides practical frameworks for effective security governance at the highest organizational levels.", "from_price_usd": 45000, "price_cadence": "engagement", "tiers": [ { "id": "essential", "name": "Essential Board Cyber Education", "price_usd": 45000, "description": "Core education program with fundamental cyber risk governance training and basic reporting frameworks", "includes": [], "excludes": [ "Cyber risk quantification with the organisation's own figures", "Custom governance playbook and committee charter recommendations", "Peer comparison analysis", "Advisory support after the final session" ], "limits": { "participants": 12, "sessions": 4, "scenarios": 1 } }, { "id": "comprehensive", "name": "Comprehensive Board Governance Program", "price_usd": 75000, "description": "Complete education program with detailed risk quantification, sophisticated reporting, and customized governance frameworks", "includes": [], "excludes": [ "Quarterly briefings after the programme ends", "On-call advisory to the board or committee chair", "Industry benchmarking refresh", "Drafting of actual SEC filings" ], "limits": { "participants": 15, "sessions": 6, "scenarios": 2 } }, { "id": "premium", "name": "Premium Board & Executive Cyber Program", "price_usd": 125000, "description": "Advanced program with ongoing advisory support, quarterly updates, industry benchmarking, and tailored committee structures", "includes": [], "excludes": [ "Drafting of actual SEC filings or legal opinions", "Serving as a board member or named CISO", "Security awareness training for general staff" ], "limits": { "participants": 20, "sessions": 10, "scenarios": 4 } } ], "scope": [ "Board cyber governance assessment", "SEC disclosure requirements review", "Cyber risk quantification training", "Board reporting framework development", "Crisis response role-playing", "Legal and fiduciary responsibility education", "Cyber risk communication workshop", "Industry-specific threat briefings", "Comparative peer analysis", "Executive tabletop scenario" ], "deliverables": [ "Board cyber governance playbook", "Executive briefing materials", "Cyber risk dashboard templates", "SEC disclosure guidance", "Crisis communication framework", "Board committee charter recommendations", "Governance maturity assessment", "Quarterly reporting templates", "Year-long education roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=board-executive-cyber-risk-education" }, { "slug": "celebrity-complete-protection-assessment", "title": "Celebrity Complete Protection Assessment", "url": "https://cisomarketplace.services/services/celebrity-complete-protection-assessment", "md_url": "https://cisomarketplace.services/services/celebrity-complete-protection-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive 360° security assessment designed specifically for high-profile celebrities, public figures, and ultra-high-net-worth individuals. Our integrated approach addresses the unique vulnerabilities where personal, professional, and public lives intersect, providing holistic protection across digital, physical, and reputational domains to safeguard your privacy, safety, and public image.", "from_price_usd": 125000, "price_cadence": "engagement", "tiers": [ { "id": "standard", "name": "Complete Protection Assessment", "price_usd": 125000, "description": "One principal plus family, up to 5 people, up to 2 residences and up to 25 personal devices. Assessment across residence, smart home, devices, online presence, business entities, staff and travel, with a remediation roadmap. Includes a verification check afterwards.", "includes": [ "On-site evaluation of up to 2 residences including smart home systems", "Hardening plan for up to 25 personal devices and cloud accounts", "Social media, location privacy and stalker threat review", "Business entity and personal staff vetting review", "Crisis management playbook and 90-day verification" ], "excludes": [ "Hands-on implementation of remediation", "Ongoing monitoring and threat intelligence", "Global travel security operations", "Reassessments" ], "limits": { "subjects": 5, "locations": 2, "devices": 25 } }, { "id": "premium", "name": "Premium Protection Program", "price_usd": 175000, "description": "Up to 8 people, up to 3 residences and up to 50 devices: everything in the standard tier, hands-on implementation support, integration with the existing security team, and 12 months of monitoring and threat intelligence during business hours.", "includes": [ "Everything in the standard tier", "Hands-on implementation support for the roadmap", "Security team integration framework", "12 months of online monitoring and threat intelligence", "Staff and family security training" ], "excludes": [ "24/7 monitoring by a dedicated operations center", "Global travel security support", "Quarterly reassessments", "Physical protection personnel" ], "limits": { "subjects": 8, "locations": 3, "devices": 50, "months": 12 } }, { "id": "elite", "name": "Elite Protection System", "price_usd": 250000, "description": "Complete protection ecosystem with dedicated security operation center, 24/7 monitoring, global travel security, and quarterly reassessments", "includes": [], "excludes": [ "Bodyguards or armed protection personnel", "Security hardware and installation costs", "Legal representation" ], "limits": { "subjects": 10, "locations": 5, "devices": 100, "sessions": 4 } } ], "scope": [ "Residential security evaluation", "Smart home technology security assessment", "Personal digital device hardening", "Family protection framework", "Business entity security review", "Production company IP protection", "Wealth management security assessment", "Social media and online presence hardening", "Media relationship security protocols", "Event security planning framework", "Digital communications encryption", "Transportation security protocols", "Stalker and threat management", "Personal staff security vetting", "Location data privacy controls", "Content protection strategies", "Personal cloud security architecture", "Crisis management planning", "Travel security assessment", "Global residence security integration" ], "deliverables": [ "Comprehensive security architecture blueprint", "Domain-specific security vulnerability reports", "Cross-domain threat modeling documentation", "Visual security dashboard for all properties and platforms", "Prioritized remediation roadmap", "Security vendor selection recommendations", "Technical implementation support plan", "Staff and family security training materials", "90-day implementation verification process", "Privacy-enhanced lifestyle design guide", "Crisis management playbook", "Security team integration framework", "Technical and executive security summaries", "Photographic documentation of physical vulnerabilities", "Secure communications implementation guide" ], "scope_url": "https://cisomarketplace.services/scope?service=celebrity-complete-protection-assessment" }, { "slug": "executive-family-digital-protection-subscription", "title": "Executive & Family Digital Protection Subscription", "url": "https://cisomarketplace.services/services/executive-family-digital-protection-subscription", "md_url": "https://cisomarketplace.services/services/executive-family-digital-protection-subscription.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Executives, founders and high-net-worth families are targeted through their personal lives, not the corporate network. This per-person annual subscription removes them from data brokers and people-search sites and keeps them removed, monitors the dark web and social platforms for exposure and impersonation, hardens personal devices and accounts, and gives the family a named specialist to call. It is the continuous form of the one-time executive OSINT and VIP assessments.", "from_price_usd": 3500, "price_cadence": "year", "tiers": [ { "id": "basic", "name": "Essential Protection", "price_usd": 3500, "description": "Per person, per year: data-broker removal, breach and impersonation monitoring, account hardening", "includes": [], "excludes": [], "limits": { "subjects": 1 } }, { "id": "advanced", "name": "Advanced Protection", "price_usd": 7500, "description": "Per principal, per year, covering the principal plus up to 3 family members: adds device and home-network hardening and social media lock-down.", "includes": [], "excludes": [], "limits": { "subjects": 4 } }, { "id": "enterprise", "name": "Enterprise / Family Office Protection", "price_usd": 15000, "description": "Per principal, per year: adds a full OSINT baseline, travel briefings, household staff guidance and priority incident response", "includes": [], "excludes": [], "limits": { "subjects": 10 } } ], "scope": [ "Data-broker and people-search removal, re-checked continuously", "Dark-web, breach and impersonation monitoring", "Personal account and device hardening", "Home network review", "Named specialist for incidents and questions" ], "deliverables": [ "Initial exposure report", "Quarterly removal and exposure report", "Hardened accounts and devices checklist", "Incident support when something surfaces" ], "scope_url": "https://cisomarketplace.services/scope?service=executive-family-digital-protection-subscription" }, { "slug": "executive-management-osint-risk-assessment", "title": "Executive Management OSINT Risk Assessment", "url": "https://cisomarketplace.services/services/executive-management-osint-risk-assessment", "md_url": "https://cisomarketplace.services/services/executive-management-osint-risk-assessment.md", "practice": "Specialized & Industry", "category_group": "OSINT", "description": "Detailed Open Source Intelligence (OSINT) assessment for executive teams and business leaders, identifying and analyzing public digital footprints and potential security risks.", "from_price_usd": 750, "price_cadence": "engagement", "tiers": [ { "id": "rapid-exposure-assessment", "name": "Rapid Exposure Assessment", "price_usd": 750, "description": "One executive, 1 analyst hour: a time-boxed search for immediately discoverable information (addresses, phones, emails, social accounts) delivered as a short exposure summary. No removal guidance beyond top findings.", "includes": [ "1-hour time-boxed open-source search", "Exposure summary of 1-2 pages", "Top findings flagged by severity" ], "excludes": [ "Public records and asset ownership research", "Family members", "Removal instructions per finding", "Monitoring" ], "limits": { "subjects": 1, "hours": 1 } }, { "id": "basic", "name": "Basic Check", "price_usd": 2500, "description": "One executive: home address, phone numbers, email accounts, social media, public records, affiliations and asset ownership, with a risk profile and step-by-step removal and protection instructions the client carries out. 12 analyst hours.", "includes": [ "Digital exposure report for 1 executive", "Executive risk profile", "Public records, affiliations and asset ownership research", "Step-by-step removal and privacy instructions", "Travel security guidelines" ], "excludes": [ "Family members", "Alerts for new exposures", "Removal requests submitted on the client's behalf", "Reassessment" ], "limits": { "subjects": 1, "hours": 12 } }, { "id": "advanced", "name": "Family Shield", "price_usd": 4500, "description": "One executive plus up to 4 family members: everything in Basic for each person, family protection recommendations, alerts for new information leaks, and guided protection steps for 3 months. 22 analyst hours.", "includes": [ "Everything in Basic", "Exposure review for up to 4 family members", "Family protection recommendations", "New-exposure alerts for 3 months", "Guided protection steps for 3 months" ], "excludes": [ "Removal requests submitted on the client's behalf", "Emergency response to new exposures", "Quarterly reassessments" ], "limits": { "subjects": 5, "hours": 22, "months": 3 } }, { "id": "premium", "name": "Complete Protection", "price_usd": 7500, "description": "One executive plus up to 4 family members for 12 months: removal requests submitted on the client's behalf, continuous monitoring, emergency response to new exposures, and 4 quarterly reassessments. 40 analyst hours.", "includes": [ "Everything in Family Shield", "Removal and opt-out requests handled for the client", "Continuous monitoring for 12 months", "Emergency response to new exposures", "4 quarterly reassessments" ], "excludes": [ "Physical security or executive protection staffing", "Device hardening and home network work", "Guaranteed removal from sources that refuse requests" ], "limits": { "subjects": 5, "hours": 40, "months": 12, "sessions": 4 } } ], "scope": [ "Public records", "Social media presence", "Corporate affiliations", "Speaking engagements", "Publications", "Personal and family connections", "Asset ownership", "Online activities", "Dark web and breach exposure search", "Executive team roll-up report (when several executives are assessed)" ], "deliverables": [ "Executive risk profile", "Digital exposure report", "Privacy enhancement recommendations", "Security posture assessment", "Travel security guidelines", "Family protection recommendations", "Digital footprint reduction plan", "Ongoing monitoring recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=executive-management-osint-risk-assessment" }, { "slug": "high-net-worth-individual-assessment", "title": "High Net Worth Individual Assessment", "url": "https://cisomarketplace.services/services/high-net-worth-individual-assessment", "md_url": "https://cisomarketplace.services/services/high-net-worth-individual-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Tailored security assessment for high-net-worth individuals covering physical security, digital privacy, and personal cybersecurity measures to protect assets and maintain privacy.", "from_price_usd": 5000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core HNWI Security Assessment", "price_usd": 5000, "description": "Assessment for 1 principal: digital footprint and data-broker exposure review, up to 5 personal devices, 1 home network, account security review, and a written threat assessment with privacy protection plan.", "includes": [ "Digital footprint and data-broker exposure report for 1 person", "Security review of up to 5 personal devices", "Home network review at 1 residence (remote)", "Account, email and password-manager hardening guide", "Threat assessment report and privacy protection plan" ], "excludes": [ "Family members and household staff", "Additional residences and on-site physical security walk-through", "Travel security procedures", "Ongoing monitoring" ], "limits": { "subjects": 1, "locations": 1, "devices": 5 } }, { "id": "advanced", "name": "Advanced HNWI Protection Program", "price_usd": 8500, "description": "Covers the principal plus family, up to 4 people, up to 2 residences and up to 15 devices. Adds family member footprint reviews, on-site estate/home network and physical security assessment, data-broker removal requests, and an emergency response plan.", "includes": [ "Everything in the Core tier, for up to 4 people", "On-site network and physical security assessment of up to 2 residences", "Data-broker opt-out and removal requests", "Family security protocols, including minors' social media exposure", "Emergency response plan" ], "excludes": [ "Family office systems and staff", "Travel security procedures and pre-trip briefings", "Ongoing digital monitoring" ], "limits": { "subjects": 4, "locations": 2, "devices": 15 } }, { "id": "premium", "name": "Elite HNWI Security Solution", "price_usd": 15000, "description": "Full-scope security program including family office protection, travel security, and 24/7 digital monitoring", "includes": [], "excludes": [ "Physical protective details / bodyguard services", "Incident response retainer" ], "limits": { "subjects": 8, "locations": 4, "devices": 30 } } ], "scope": [ "Digital footprint", "Personal devices", "Home network", "Travel security", "Asset protection", "Family security" ], "deliverables": [ "Threat assessment report", "Privacy protection plan", "Security protocol documentation", "Digital security guide", "Travel security procedures", "Emergency response plan" ], "scope_url": "https://cisomarketplace.services/scope?service=high-net-worth-individual-assessment" }, { "slug": "malware-analysis-services", "title": "Malware Analysis Services", "url": "https://cisomarketplace.services/services/malware-analysis-services", "md_url": "https://cisomarketplace.services/services/malware-analysis-services.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Specialized security service providing in-depth analysis of suspected malware to understand capabilities, behavior, and impact. Our expert analysis combines static, dynamic, and memory forensics techniques to identify indicators of compromise, attribution details, and remediation strategies.", "from_price_usd": 30000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Malware Analysis", "price_usd": 30000, "description": "Analysis of one malware family, up to 3 related samples: static and sandboxed dynamic analysis, capability summary, network and host IOCs, and MITRE ATT&CK mapping. One host memory image. 80 analyst hours.", "includes": [ "Static and dynamic analysis of up to 3 samples", "Memory analysis of 1 host image", "IOC list (hashes, domains, IPs, file and registry artifacts)", "MITRE ATT&CK mapping", "Tactical remediation guidance" ], "excludes": [ "Full reverse engineering of packed or obfuscated code", "Custom detection rule development", "C2 infrastructure and attribution analysis", "Incident response on affected systems" ], "limits": { "devices": 1, "hours": 80 } }, { "id": "advanced", "name": "Advanced Malware Investigation", "price_usd": 50000, "description": "Up to 10 samples across up to 2 families with code-level reverse engineering, anti-analysis and exploit mechanism review, C2 protocol analysis, complete IOC set, and custom detection rules. Up to 3 host memory images. 140 analyst hours.", "includes": [ "Everything in the basic tier", "Code-level reverse engineering including unpacking", "Anti-analysis and exploit mechanism review", "C2 protocol and infrastructure analysis", "Custom host and network detection rules" ], "excludes": [ "Campaign-wide analysis across the environment", "Threat actor profile", "Enterprise-wide detection rollout strategy" ], "limits": { "devices": 3, "hours": 140 } }, { "id": "incident", "name": "Incident-Based Malware Response", "price_usd": 85000, "description": "Malware work tied to an active or recent incident: up to 25 samples, memory and network captures from up to 10 hosts, campaign timeline, threat actor profile, and a detection strategy for the whole environment. 240 analyst hours.", "includes": [ "Everything in the advanced tier", "Campaign analysis linking samples, hosts and infrastructure", "Threat actor profile and attribution assessment", "Enterprise-wide detection and hunting strategy", "Briefings for the incident response team" ], "excludes": [ "Containment, eradication and system rebuilds", "Full disk forensics of every affected host", "Expert witness testimony" ], "limits": { "devices": 10, "hours": 240 } } ], "scope": [ "Static code analysis", "Dynamic behavior analysis", "Memory forensics", "Network traffic analysis", "Anti-analysis technique identification", "Exploit mechanism review", "C2 infrastructure analysis", "Attribution assessment" ], "deliverables": [ "Detailed malware analysis report", "Indicators of compromise (IOCs)", "MITRE ATT&CK mapping", "Tactical remediation guidance", "Strategic defense recommendations", "Detection rule development", "Threat actor profile" ], "scope_url": "https://cisomarketplace.services/scope?service=malware-analysis-services" }, { "slug": "smart-home-security-assessment", "title": "Smart Home Security Assessment", "url": "https://cisomarketplace.services/services/smart-home-security-assessment", "md_url": "https://cisomarketplace.services/services/smart-home-security-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive evaluation of your smart home ecosystem security, including IoT devices, network infrastructure, and automation systems to identify vulnerabilities and provide hardening recommendations.", "from_price_usd": 2500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Smart Home Assessment", "price_usd": 2500, "description": "One residence with up to 25 connected devices: device inventory, home network and WiFi review, configuration checks on cameras, locks, voice assistants and the automation hub, and a written report with recommendations.", "includes": [ "1 residence, up to 25 devices", "Device inventory", "Home network and WiFi security analysis", "Camera, lock and hub configuration checks", "Recommendations report" ], "excludes": [ "Hands-on device vulnerability testing", "Privacy impact assessment", "Configuration changes made for you", "Follow-up support" ], "limits": { "locations": 1, "devices": 25 } }, { "id": "advanced", "name": "Advanced Smart Home Security", "price_usd": 4500, "description": "One residence with up to 50 devices: adds hands-on vulnerability testing of devices, network segmentation and secure configurations applied by the team, and a privacy impact assessment of cameras, voice assistants and vendor cloud accounts.", "includes": [ "1 residence, up to 50 devices", "Hands-on device testing", "Network segmentation configured", "Privacy impact assessment", "Implementation roadmap" ], "excludes": [ "Monitoring setup", "Support after handover", "Second residence" ], "limits": { "locations": 1, "devices": 50 } }, { "id": "premium", "name": "Premium Smart Home Protection", "price_usd": 7500, "description": "Full-scope smart home security program with custom monitoring setup, advanced automation security, and ongoing support", "includes": [], "excludes": [ "Hardware purchase", "Personal digital footprint or account review" ], "limits": { "locations": 2, "devices": 100 } } ], "scope": [ "Smart home devices", "Home automation systems", "Network infrastructure", "Security cameras", "Smart locks", "Voice assistants" ], "deliverables": [ "Detailed device inventory", "Vulnerability assessment report", "Network security analysis", "Privacy impact assessment", "Security recommendations", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=smart-home-security-assessment" }, { "slug": "smart-office-security-assessment", "title": "Smart Office Security Assessment", "url": "https://cisomarketplace.services/services/smart-office-security-assessment", "md_url": "https://cisomarketplace.services/services/smart-office-security-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security evaluation for modern smart offices, including shared spaces and multi-tenant buildings. Covers IoT devices, access control systems, and network infrastructure security.", "from_price_usd": 8500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Smart Office Assessment", "price_usd": 8500, "description": "One office with up to 50 connected devices: physical access control audit, IoT configuration and network exposure review, and shared infrastructure review. Report, remediation roadmap and policy templates.", "includes": [ "1 office, up to 50 devices", "Access control audit", "IoT configuration review", "Shared infrastructure review", "Remediation roadmap", "Security policy templates" ], "excludes": [ "Hands-on IoT exploitation testing", "Multi-tenant isolation testing", "Emergency response and environmental controls", "Re-validation" ], "limits": { "locations": 1, "devices": 50 } }, { "id": "advanced", "name": "Advanced Smart Office Security", "price_usd": 15000, "description": "One office or multi-tenant floor plate with up to 100 devices: all eight scope areas, hands-on IoT testing, tenant isolation testing on shared networks, badge and visitor system analysis, and staff training guidelines.", "includes": [ "1 location, up to 100 devices", "All eight scope areas", "Hands-on IoT testing", "Multi-tenant isolation testing", "Visitor and badge system analysis", "Staff training guidelines" ], "excludes": [ "Building automation protocol testing", "Monitoring setup", "Re-validation after fixes", "Additional locations" ], "limits": { "locations": 1, "devices": 100 } }, { "id": "premium", "name": "Enterprise Smart Office Program", "price_usd": 25000, "description": "Full-scope smart office security including custom monitoring, advanced building automation security, and continuous validation", "includes": [], "excludes": [ "Corporate IT network penetration test", "Hardware replacement" ], "limits": { "locations": 3, "devices": 250, "sessions": 2 } } ], "scope": [ "Physical access controls", "Smart building systems", "Shared infrastructure", "IoT devices", "Environmental controls", "Surveillance systems", "Visitor management systems", "Emergency response systems" ], "deliverables": [ "Detailed security architecture review", "IoT vulnerability assessment", "Access control audit", "Smart building systems security report", "Multi-tenant security recommendations", "Remediation roadmap", "Security policy templates", "Staff training guidelines" ], "scope_url": "https://cisomarketplace.services/scope?service=smart-office-security-assessment" }, { "slug": "social-media-influencer-risk-assessment", "title": "Social Media Influencer Risk Assessment", "url": "https://cisomarketplace.services/services/social-media-influencer-risk-assessment", "md_url": "https://cisomarketplace.services/services/social-media-influencer-risk-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive security and privacy assessment for social media influencers, focusing on digital presence protection, reputation management, and personal security measures.", "from_price_usd": 3000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Influencer Protection", "price_usd": 3000, "description": "Essential digital presence protection covering basic account security, privacy assessment, and brand monitoring", "includes": [], "excludes": [], "limits": {} }, { "id": "advanced", "name": "Advanced Influencer Security", "price_usd": 5500, "description": "Comprehensive protection including detailed privacy controls, crisis management planning, and advanced monitoring", "includes": [], "excludes": [], "limits": {} }, { "id": "premium", "name": "Premium Influencer Protection", "price_usd": 9000, "description": "Full-scope protection program with 24/7 monitoring, complete brand protection, and custom security tools", "includes": [], "excludes": [], "limits": {} } ], "scope": [ "Social media accounts", "Personal brand assets", "Digital communications", "Content management systems", "Collaboration platforms", "Payment systems" ], "deliverables": [ "Digital presence audit report", "Privacy enhancement plan", "Account security recommendations", "Crisis management playbook", "Brand protection strategy", "Security awareness training" ], "scope_url": "https://cisomarketplace.services/scope?service=social-media-influencer-risk-assessment" }, { "slug": "startup-security-readiness-assessment", "title": "Startup Security Readiness Assessment", "url": "https://cisomarketplace.services/services/startup-security-readiness-assessment", "md_url": "https://cisomarketplace.services/services/startup-security-readiness-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Specialized security assessment designed for startups at every growth stage, from angel funding through Series A and beyond. Our tailored approach addresses the unique security challenges of rapidly evolving startups, balancing innovation speed with essential security controls. We help founders and startup teams build security foundations that enable growth, satisfy investor expectations, and prepare for enterprise customer requirements without slowing down product development.", "from_price_usd": 18000, "price_cadence": "engagement", "tiers": [ { "id": "angel", "name": "Angel/Pre-Seed Security Foundations", "price_usd": 18000, "description": "Pre-seed teams: up to 10 employees, up to 5 developers and 1 cloud account. Review of cloud configuration, authentication, data protection and code pipeline basics, with a prioritized 90-day security roadmap and a lightweight policy template set.", "includes": [ "Cloud infrastructure security review (1 account)", "Authentication and identity strategy review", "Data protection controls check", "Lightweight security policy templates", "Prioritized 90-day security roadmap" ], "excludes": [ "Security questionnaire response templates", "Enterprise customer readiness report", "Compliance roadmap", "Penetration testing" ], "limits": { "employees": 10, "developers": 5, "cloud_accounts": 1 } }, { "id": "seed", "name": "Seed Stage Security Program", "price_usd": 30000, "description": "Seed-stage: up to 25 employees, up to 15 developers and up to 2 cloud accounts. Adds DevSecOps pipeline assessment, customer security requirements readiness, security questionnaire response templates and cloud configuration templates.", "includes": [ "Everything in the pre-seed tier", "DevSecOps implementation assessment and guidance", "Security questionnaire response templates", "Customer security readiness report", "Cloud security configuration templates" ], "excludes": [ "Compliance framework preparation (SOC 2, ISO 27001)", "Security hiring and resource plan", "Investor due diligence package", "Penetration testing" ], "limits": { "employees": 25, "developers": 15, "cloud_accounts": 2 } }, { "id": "series-a", "name": "Series A Security Scaling Program", "price_usd": 45000, "description": "Series A: up to 100 employees, up to 40 developers and up to 5 cloud accounts. Adds a compliance roadmap and preparation checklist for 1 framework, technical debt evaluation, investor due diligence preparation and a security hiring and resource plan.", "includes": [ "Everything in the seed tier", "Compliance roadmap and preparation checklist for 1 framework", "Technical debt evaluation", "Investor due diligence preparation", "Security hiring and resource plan" ], "excludes": [ "The compliance readiness project or audit itself", "Penetration testing", "Ongoing vCISO support", "Companies above 100 employees (use the general assessments)" ], "limits": { "employees": 100, "developers": 40, "cloud_accounts": 5 } } ], "scope": [ "Security architecture foundations review", "DevSecOps implementation assessment", "Cloud infrastructure security evaluation", "Authentication and identity strategy review", "Data protection controls assessment", "Security policy framework development", "Customer security requirements readiness", "Security questionnaire preparation", "Compliance roadmap planning", "Technical debt evaluation", "Security resource planning", "Investor due diligence preparation" ], "deliverables": [ "Startup security roadmap", "Growth-stage security framework", "Security control priorities by funding stage", "DevSecOps implementation guidance", "Cloud security configuration templates", "Lightweight security policy templates", "Enterprise customer security readiness report", "Security questionnaire response templates", "Compliance preparation checklist", "Security hiring and resource planning" ], "scope_url": "https://cisomarketplace.services/scope?service=startup-security-readiness-assessment" }, { "slug": "api-security-assessment", "title": "API Security Assessment", "url": "https://cisomarketplace.services/services/api-security-assessment", "md_url": "https://cisomarketplace.services/services/api-security-assessment.md", "practice": "Offensive Security", "category_group": "Cloud & AppSec", "description": "Comprehensive testing of API endpoints and integrations", "from_price_usd": 12000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core API Assessment", "price_usd": 12000, "description": "Manual and automated security testing of 1 API with up to 25 endpoints and up to 2 user roles, against common API vulnerability classes (broken authorisation and authentication, injection, data exposure). Report plus 1 retest of fixed findings.", "includes": [ "1 API, up to 25 endpoints", "Up to 2 user roles", "Common API vulnerability classes", "Findings report with fix guidance", "1 retest round" ], "excludes": [ "Third-party and internal integration testing", "Detailed authentication and token flow review", "Business logic abuse testing", "Custom exploit development" ], "limits": { "apis": 1 } }, { "id": "advanced", "name": "Advanced API Assessment", "price_usd": 20000, "description": "Testing of up to 3 APIs with up to 75 endpoints in total and up to 4 user roles. Adds detailed review of authentication and token flows, business logic abuse, rate limiting, and testing of integration points such as webhooks and third-party connections.", "includes": [ "Up to 3 APIs, 75 endpoints total", "Up to 4 user roles", "Authentication and token flow review", "Business logic and rate-limit testing", "Integration point testing", "1 retest round" ], "excludes": [ "Custom exploit development and chained attacks", "API gateway and design architecture review", "More than 1 retest round" ], "limits": { "apis": 3 } }, { "id": "premium", "name": "Enterprise API Assessment", "price_usd": 35000, "description": "Testing of up to 10 APIs with up to 250 endpoints in total, all roles and all integrations. Adds custom exploit development, chained attack paths across services, API gateway configuration review and 2 retest rounds.", "includes": [ "Up to 10 APIs, 250 endpoints total", "All user roles and integrations", "Custom exploit development", "Chained attack paths across services", "API gateway configuration review", "2 retest rounds" ], "excludes": [ "Web or mobile front-end testing", "Source code review", "Denial-of-service load testing", "Continuous API monitoring" ], "limits": { "apis": 10 } } ], "scope": [ "API inventory and documentation review (OpenAPI / GraphQL schemas)", "Authentication and token handling (OAuth 2.0, JWT, API keys)", "Object- and function-level authorization testing (OWASP API Security Top 10)", "Input validation, mass assignment and injection testing", "Rate limiting, quotas and abuse resistance", "Gateway, logging and monitoring configuration review" ], "deliverables": [ "API security report mapped to the OWASP API Security Top 10", "Reproducible findings with requests and responses", "Remediation guidance for developers and platform teams", "Executive summary", "Retest of fixed findings" ], "scope_url": "https://cisomarketplace.services/scope?service=api-security-assessment" }, { "slug": "business-continuity-assessment", "title": "Business Continuity Assessment", "url": "https://cisomarketplace.services/services/business-continuity-assessment", "md_url": "https://cisomarketplace.services/services/business-continuity-assessment.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive evaluation of your organization's business continuity planning, capabilities, and readiness to maintain critical operations during disruptions. We assess operational resilience, recovery strategies, and provide actionable recommendations to enhance your continuity posture.", "from_price_usd": 32000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Business Continuity Assessment", "price_usd": 32000, "description": "Up to 250 employees and 1 site. Review of the existing BIA, BC documentation, recovery strategies and crisis procedures, identifying up to 10 critical functions. Capability report, gap analysis and BC program roadmap.", "includes": [ "Review of existing BIA and BC documentation", "Critical function identification (up to 10)", "Recovery strategy and crisis procedure assessment", "Gap analysis and recommendations", "BC program development roadmap" ], "excludes": [ "Conducting a new BIA", "Writing recovery strategies or BC plans", "Supply chain resilience review", "Exercises and testing" ], "limits": { "employees": 250, "locations": 1 } }, { "id": "standard", "name": "Standard BC Program Development", "price_usd": 55000, "description": "Up to 1,000 employees and up to 3 sites. We run a new BIA for up to 25 critical functions with RTO/RPO targets, develop recovery strategies per function, review alternate site capability and BC governance, and update BC policies and procedures.", "includes": [ "Everything in the core assessment", "New BIA for up to 25 critical functions", "Recovery strategy development per function", "Alternate site and BC governance review", "BC policy and procedure enhancements" ], "excludes": [ "Integrated IT disaster recovery planning", "Supply chain resilience program", "Crisis management exercise", "Live testing" ], "limits": { "employees": 1000, "locations": 3 } }, { "id": "enterprise", "name": "Enterprise Resilience Program", "price_usd": 90000, "description": "Up to 2,500 employees and up to 10 sites. BIA for up to 50 critical functions, integrated BC/DR planning with IT, crisis management improvement plan with 1 facilitated crisis exercise, and supply chain resilience review of up to 15 critical suppliers.", "includes": [ "Everything in the standard tier", "BIA for up to 50 critical functions", "Integrated BC/DR planning with IT recovery owners", "One facilitated crisis management exercise", "Supply chain resilience review (up to 15 suppliers)" ], "excludes": [ "Technical DR failover testing", "BC software platform licences", "Ongoing program management", "Organizations above 2,500 employees (scoped separately)" ], "limits": { "employees": 2500, "locations": 10, "scenarios": 1, "vendors": 15 } } ], "scope": [ "Business impact analysis review", "Critical function identification", "Recovery strategy assessment", "BC documentation evaluation", "Crisis management procedures", "BC governance framework", "Alternate site capabilities", "Supply chain resilience" ], "deliverables": [ "Business continuity capability report", "Gap analysis and recommendations", "Business impact analysis update", "BC program development roadmap", "Crisis management improvement plan", "BC policy and procedure enhancements" ], "scope_url": "https://cisomarketplace.services/scope?service=business-continuity-assessment" }, { "slug": "cloud-security-assessment", "title": "Cloud Security Assessment", "url": "https://cisomarketplace.services/services/cloud-security-assessment", "md_url": "https://cisomarketplace.services/services/cloud-security-assessment.md", "practice": "Offensive Security", "category_group": "Cloud & AppSec", "description": "Security evaluation of cloud infrastructure and configurations", "from_price_usd": 12000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Cloud Assessment", "price_usd": 12000, "description": "Configuration review of 1 cloud provider, up to 3 accounts/subscriptions: IAM, network security groups, storage exposure and logging. Read-only access, tool-assisted plus manual validation.", "includes": [ "1 cloud provider, up to 3 accounts/subscriptions", "IAM, network security group and storage configuration review", "Read-only, non-intrusive review", "Findings report with risk mitigation plan" ], "excludes": [ "Container and Kubernetes review", "Benchmark mapping against a named framework", "Active exploitation of cloud attack paths", "Second cloud provider" ], "limits": { "cloud_accounts": 3 } }, { "id": "advanced", "name": "Advanced Cloud Assessment", "price_usd": 20000, "description": "Configuration review of 1 cloud provider, up to 10 accounts/subscriptions, adding container workload review, architecture recommendations and a control-by-control check against 1 named framework.", "includes": [ "1 cloud provider, up to 10 accounts/subscriptions", "Container and registry configuration review", "Check against 1 named benchmark/framework", "Architecture recommendations", "Configuration assessment document per account" ], "excludes": [ "Second or third cloud provider", "Active exploitation / cloud penetration testing", "Remediation work in your accounts" ], "limits": { "cloud_accounts": 10, "frameworks": 1 } }, { "id": "enterprise", "name": "Enterprise Cloud Assessment", "price_usd": 35000, "description": "Multi-cloud assessment: up to 3 cloud providers and up to 25 accounts/subscriptions, with active testing of privilege-escalation and cross-account attack paths, container review and checks against up to 2 frameworks.", "includes": [ "Up to 3 cloud providers, up to 25 accounts/subscriptions", "Active testing of IAM privilege-escalation and cross-account paths", "Container and orchestration review", "Checks against up to 2 frameworks", "Cross-cloud architecture recommendations" ], "excludes": [ "Continuous monitoring after the engagement (see Cloud Security Monitoring)", "Application-layer penetration testing of hosted apps", "Remediation implementation" ], "limits": { "cloud_accounts": 25, "frameworks": 2 } } ], "scope": [ "Cloud Infrastructure Review", "Container Security Assessment", "IAM Configuration Analysis", "Network Security Groups Evaluation", "Data Storage Security Review" ], "deliverables": [ "Cloud Security Report", "Configuration Assessment Document", "Security Best Practices Guide", "Risk Mitigation Plan", "Architecture Recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=cloud-security-assessment" }, { "slug": "compliance-assessment", "title": "Compliance Assessment", "url": "https://cisomarketplace.services/services/compliance-assessment", "md_url": "https://cisomarketplace.services/services/compliance-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Evaluate and achieve compliance with major security frameworks", "from_price_usd": 10000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Compliance Assessment", "price_usd": 10000, "description": "Essential compliance assessment covering primary frameworks, basic controls evaluation, and fundamental gap analysis", "includes": [], "excludes": [ "Second or additional frameworks", "Cross-framework control mapping", "Policy writing or remediation work", "Technical testing (scans, penetration tests)" ], "limits": { "frameworks": 1, "employees": 100, "locations": 1 } }, { "id": "advanced", "name": "Advanced Compliance Program", "price_usd": 18000, "description": "Comprehensive assessment including multiple frameworks, detailed controls mapping, and implementation planning", "includes": [], "excludes": [ "Custom or merged control framework", "Progress reviews after delivery", "Remediation and policy writing", "Technical testing" ], "limits": { "frameworks": 3, "employees": 500, "locations": 3 } }, { "id": "premium", "name": "Enterprise Compliance Solution", "price_usd": 35000, "description": "Full-scope compliance program with custom framework adaptation, continuous monitoring, and automated compliance tracking", "includes": [], "excludes": [ "Certification or attestation audit itself", "Hands-on remediation of controls", "Licences for GRC or monitoring software", "Technical testing" ], "limits": { "frameworks": 5, "employees": 2500, "locations": 10 } } ], "scope": [ "Security Architecture Review", "Controls Assessment", "Risk Analysis", "Compliance Mapping", "Security Program Evaluation" ], "deliverables": [ "Detailed Assessment Report", "Executive Summary", "Recommendations Document", "Implementation Roadmap", "Follow-up Consultation" ], "scope_url": "https://cisomarketplace.services/scope?service=compliance-assessment" }, { "slug": "compliance-penetration-test", "title": "Compliance Penetration Test", "url": "https://cisomarketplace.services/services/compliance-penetration-test", "md_url": "https://cisomarketplace.services/services/compliance-penetration-test.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Startups and smaller companies often need a real penetration test for an audit or a customer contract, not a multi-week offensive campaign. This is a fixed-scope, human-led test of one application or external perimeter with a report auditors accept, a retest of fixed findings and an attestation letter — the entry point to the Penetration Testing and Red Team services.", "from_price_usd": 5500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Compliance Pentest", "price_usd": 5500, "description": "ONE target: a single web application or API with up to 2 user roles — alternatively an external perimeter of up to 25 IPs instead of the application, never both. Report, one retest and an attestation letter.", "includes": [], "excludes": [ "Internal network testing", "Social engineering and physical testing", "More than one target — that is the Advanced tier" ], "limits": { "web_apps": 1, "apis": 1, "external_ips": 25 } }, { "id": "advanced", "name": "Advanced Compliance Pentest", "price_usd": 9500, "description": "Web app plus API, or app plus external perimeter; adds cloud configuration spot-check and a findings walkthrough", "includes": [], "excludes": [ "Internal network testing", "Social engineering and physical testing" ], "limits": { "web_apps": 1, "apis": 2, "external_ips": 50 } }, { "id": "enterprise", "name": "Enterprise Compliance Pentest", "price_usd": 14500, "description": "Up to three applications or environments tested together, with a consolidated report for multiple frameworks", "includes": [], "excludes": [ "Internal network testing beyond a single segment", "Red-team style objectives — see Red Team Assessment" ], "limits": { "web_apps": 3, "apis": 5, "external_ips": 100 } } ], "scope": [ "One web application or API, or an external perimeter up to 25 IPs", "Manual testing against OWASP Top 10 / ASVS and common misconfigurations", "Authenticated testing with two user roles", "Retest of remediated findings", "Auditor- and customer-ready attestation letter" ], "deliverables": [ "Penetration test report with reproducible findings", "Remediation guidance for developers", "Retest results", "Attestation letter" ], "scope_url": "https://cisomarketplace.services/scope?service=compliance-penetration-test" }, { "slug": "cyber-insurance-readiness", "title": "Cyber Insurance Readiness Assessment", "url": "https://cisomarketplace.services/services/cyber-insurance-readiness", "md_url": "https://cisomarketplace.services/services/cyber-insurance-readiness.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Prepare your organization for cyber insurance applications and renewals by evaluating compliance with insurer requirements, identifying control gaps, and implementing documentation to support favorable coverage terms and rates.", "from_price_usd": 25000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Insurance Readiness", "price_usd": 25000, "description": "Readiness assessment for up to 250 employees at 1 location against 1 carrier questionnaire (new application / renewal): control mapping to insurer requirements, evidence check of existing documents, incident response capability review, readiness report and gap analysis.", "includes": [ "Insurer requirement analysis for 1 application", "Control mapping and validation against that questionnaire", "Review of existing security documentation", "Incident response capability review", "Insurance readiness report and control gap analysis" ], "excludes": [ "Writing missing policies or evidence", "Remediation guidance beyond the gap list", "Underwriter calls or responses", "More than 1 carrier application" ], "limits": { "employees": 250, "locations": 1 } }, { "id": "standard", "name": "Standard Insurance Preparation Program", "price_usd": 45000, "description": "For up to 1,000 employees and up to 3 locations, covering up to 3 carrier applications. Adds a documentation enhancement plan with drafted policies and evidence, completed application answers, and a remediation plan for gaps that affect insurability.", "includes": [ "Everything in Basic, for up to 3 carrier applications", "Drafted policies and evidence for missing documentation", "Completed application / questionnaire answers", "Gap remediation plan with priorities and owners", "Governance and risk management review" ], "excludes": [ "Attending underwriter or broker calls", "Coverage strategy and premium reduction plan", "Hands-on technical remediation" ], "limits": { "employees": 1000, "locations": 3 } }, { "id": "premium", "name": "Premium Coverage Optimization", "price_usd": 75000, "description": "For organizations beyond the Standard limits on employees and locations; no fixed cap - scoped at kickoff. Adds a coverage strategy, underwriter response preparation with attendance on underwriter and broker calls, and a premium reduction plan tied to specific controls.", "includes": [ "Everything in Standard", "Coverage strategy across carriers and limits", "Underwriter response preparation and call attendance", "Broker coordination through quote stage", "Premium reduction plan tied to specific controls" ], "excludes": [ "Acting as the insurance broker or binding coverage", "Legal review of policy wording", "Hands-on technical remediation", "Any guarantee of coverage terms or premium" ], "limits": {} } ], "scope": [ "Insurance requirement analysis", "Cyber control mapping", "Security documentation review", "Policy compliance assessment", "Incident response capability", "Risk management evaluation", "Security governance review" ], "deliverables": [ "Insurance readiness report", "Control gap analysis", "Documentation enhancement plan", "Insurance application support", "Premium reduction recommendations", "Underwriter response preparation" ], "scope_url": "https://cisomarketplace.services/scope?service=cyber-insurance-readiness" }, { "slug": "digital-forensics-readiness-assessment", "title": "Digital Forensics Readiness Assessment", "url": "https://cisomarketplace.services/services/digital-forensics-readiness-assessment", "md_url": "https://cisomarketplace.services/services/digital-forensics-readiness-assessment.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive evaluation of your organization's ability to collect, preserve, and analyze digital evidence following security incidents. Our assessment examines logging configurations, evidence collection processes, and forensic capabilities to ensure your organization can support investigations, legal proceedings, and regulatory requirements.", "from_price_usd": 32000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Forensic Readiness Review", "price_usd": 32000, "description": "Up to 250 employees and 1 site. Reviews log retention on up to 10 critical log sources, evidence collection and chain of custody practice, and current forensic tooling. Readiness report with logging and evidence collection recommendations.", "includes": [ "Log retention review for up to 10 critical sources", "Evidence collection and chain of custody process review", "Forensic tool evaluation", "Forensic readiness report", "Logging enhancement recommendations" ], "excludes": [ "Writing evidence collection procedures", "Investigation playbooks", "Memory capture and network recording capability review", "Legal hold process design" ], "limits": { "employees": 250, "locations": 1 } }, { "id": "standard", "name": "Comprehensive Forensic Readiness Program", "price_usd": 55000, "description": "Up to 1,000 employees and up to 3 sites, up to 25 log sources. Adds memory capture and network traffic recording review, and we write the evidence collection framework, chain of custody procedures and 5 investigation playbooks including insider threat.", "includes": [ "Everything in the readiness review", "Memory capture and network recording capability review", "Evidence collection framework and chain of custody procedures", "5 investigation playbooks (including insider threat)", "Training recommendations for IT staff" ], "excludes": [ "Custom collection scripts or tooling", "Logging infrastructure design", "Legal hold process integration with counsel", "Performing an actual investigation" ], "limits": { "employees": 1000, "locations": 3 } }, { "id": "enterprise", "name": "Enterprise Forensic Investigation Framework", "price_usd": 85000, "description": "Up to 2,500 employees and up to 10 sites, up to 50 log sources. Adds custom evidence collection scripts for your platforms, a target logging architecture for forensic retention, 10 playbooks, and legal hold procedures designed with your counsel.", "includes": [ "Everything in the standard tier", "Custom evidence collection scripts", "Target logging architecture for forensic retention", "10 investigation playbooks", "Legal hold procedures and regulatory evidence guidance" ], "excludes": [ "Deploying logging infrastructure or buying tools", "Incident response or forensic investigation retainer", "Legal advice (provided by the client's counsel)", "Organizations above 2,500 employees (scoped separately)" ], "limits": { "employees": 2500, "locations": 10 } } ], "scope": [ "Log retention configuration", "Evidence collection procedures", "Forensic tool evaluation", "Chain of custody processes", "Digital evidence preservation capabilities", "Memory capture mechanisms", "Network traffic recording", "Legal hold procedures", "Forensic investigation playbooks", "Insider threat investigation capabilities" ], "deliverables": [ "Forensic readiness report", "Logging enhancement recommendations", "Evidence collection framework", "Chain of custody procedures", "Forensic tool recommendations", "Investigation playbook development", "Training recommendations for IT staff", "Legal and regulatory compliance guidance" ], "scope_url": "https://cisomarketplace.services/scope?service=digital-forensics-readiness-assessment" }, { "slug": "disaster-recovery-assessment", "title": "Disaster Recovery Assessment", "url": "https://cisomarketplace.services/services/disaster-recovery-assessment", "md_url": "https://cisomarketplace.services/services/disaster-recovery-assessment.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive evaluation of your organization's disaster recovery capabilities, testing recovery procedures, and ensuring business continuity in the event of catastrophic incidents or outages.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core DR Assessment", "price_usd": 35000, "description": "Up to 250 employees and 1 primary site. DR plan, backup configuration and RTO/RPO targets reviewed for up to 10 critical systems, with one witnessed backup restore test. DR capability report, gap analysis and improvement roadmap.", "includes": [ "DR plan and documentation analysis", "Backup system evaluation", "RTO/RPO validation for up to 10 critical systems", "One witnessed backup restore test", "Gap analysis and recovery improvement roadmap" ], "excludes": [ "Tabletop exercises", "Recovery testing beyond one restore", "Rewriting DR documentation", "Failover validation" ], "limits": { "employees": 250, "locations": 1 } }, { "id": "standard", "name": "Standard DR Program", "price_usd": 60000, "description": "Up to 1,000 employees and up to 3 sites, up to 25 critical systems. Adds 2 facilitated DR tabletop scenarios, recovery tests of up to 3 systems measured against RTO/RPO, crisis communication review, and updated DR documentation and recovery procedures.", "includes": [ "Everything in the core assessment", "2 facilitated DR tabletop scenarios", "Recovery tests of up to 3 systems with measured results", "Crisis communication review", "Updated DR documentation and critical system recovery procedures" ], "excludes": [ "Live failover of production", "Automated failover validation", "Crisis management program development", "Remediation of backup or DR infrastructure" ], "limits": { "employees": 1000, "locations": 3, "scenarios": 2 } }, { "id": "enterprise", "name": "Enterprise DR Solution", "price_usd": 95000, "description": "Up to 2,500 employees and up to 10 sites, up to 50 critical systems. Adds live recovery testing of up to 5 systems including a planned failover to the recovery site, automated failover validation, 3 tabletop scenarios and a crisis management exercise with executives.", "includes": [ "Everything in the standard tier", "Live recovery test of up to 5 systems with planned failover", "Automated failover validation", "3 tabletop scenarios including an executive crisis exercise", "Recovery test results report against RTO/RPO" ], "excludes": [ "Building or buying DR infrastructure", "Business-side continuity planning (see Business Continuity Assessment)", "Ongoing DR test program management", "Organizations above 2,500 employees (scoped separately)" ], "limits": { "employees": 2500, "locations": 10, "scenarios": 3 } } ], "scope": [ "Recovery plan assessment", "Backup system evaluation", "RTO/RPO validation", "DR testing procedures", "Technical recovery capabilities", "Crisis communication review", "DR documentation analysis" ], "deliverables": [ "Detailed DR capability report", "Gap analysis and recommendations", "Recovery test results", "Updated DR documentation", "Recovery improvement roadmap", "Critical system recovery procedures" ], "scope_url": "https://cisomarketplace.services/scope?service=disaster-recovery-assessment" }, { "slug": "email-security-assessment", "title": "Email Security Assessment", "url": "https://cisomarketplace.services/services/email-security-assessment", "md_url": "https://cisomarketplace.services/services/email-security-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive evaluation of your organization's email infrastructure, security controls, and policies to protect against phishing, business email compromise, and data loss. Our assessment identifies vulnerabilities and provides actionable recommendations to enhance your email security posture.", "from_price_usd": 25000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Email Security Assessment", "price_usd": 25000, "description": "Email security review for up to 500 mailboxes and 3 sending domains on one platform (Microsoft 365 or Google Workspace).", "includes": [ "Platform configuration review", "SPF, DKIM and DMARC review", "Prioritized hardening plan" ], "excludes": [ "Staff email exercises", "More than one email platform" ], "limits": { "users": 500, "domains": 3 } }, { "id": "advanced", "name": "Advanced Email Defense Program", "price_usd": 45000, "description": "Up to 2,500 mailboxes and 10 domains, including one staff email exercise and a review of mail-flow rules and third-party senders.", "includes": [ "Everything in Basic", "One staff email exercise", "Third-party sender review" ], "excludes": [ "Ongoing DMARC management — see Managed DMARC" ], "limits": { "users": 2500, "domains": 10 } }, { "id": "enterprise", "name": "Enterprise Email Protection Suite", "price_usd": 75000, "description": "Up to 10,000 mailboxes and 25 domains across multiple tenants or platforms; larger estates are scoped at kickoff.", "includes": [ "Multi-tenant or hybrid mail estates", "Two staff email exercises", "Executive readout" ], "excludes": [ "Migration or implementation work" ], "limits": { "users": 10000, "domains": 25 } } ], "scope": [ "Authentication protocol verification (SPF", "DKIM", "DMARC)", "Anti-phishing control assessment", "Email gateway configuration review", "Data loss prevention analysis", "Email retention policy evaluation", "Account security assessment", "Third-party integration review", "User awareness testing" ], "deliverables": [ "Email security assessment report", "Configuration improvement guide", "Authentication protocol implementation plan", "Phishing defense roadmap", "Email security architecture recommendations", "User awareness training recommendations", "Policy enhancement guide" ], "scope_url": "https://cisomarketplace.services/scope?service=email-security-assessment" }, { "slug": "embedded-systems-security-assessment", "title": "Embedded Systems Security Assessment", "url": "https://cisomarketplace.services/services/embedded-systems-security-assessment", "md_url": "https://cisomarketplace.services/services/embedded-systems-security-assessment.md", "practice": "Offensive Security", "category_group": "Specialized", "description": "Deep-dive security evaluation of embedded systems, focusing on firmware security, hardware interfaces, and communication protocols specific to embedded devices.", "from_price_usd": 22000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Embedded Systems Assessment", "price_usd": 22000, "description": "One device model and 1 firmware image: hardware interface and debug port testing, firmware extraction and reverse engineering, boot sequence and protocol review. Includes a retest.", "includes": [ "Hardware interface and debug port analysis (UART, JTAG, SWD)", "Firmware extraction and reverse engineering", "Boot sequence security review", "Communication protocol review", "60-day retest window" ], "excludes": [ "Side-channel attack testing", "Secure boot bypass attempts", "Memory protection deep dive", "Companion app or cloud backend testing" ], "limits": { "devices": 1 } }, { "id": "advanced", "name": "Advanced Embedded Security Program", "price_usd": 38000, "description": "Up to 2 device models: everything in the basic tier, side-channel testing (power and timing), secure boot verification with bypass attempts, and memory protection assessment.", "includes": [ "Everything in the basic tier", "Side-channel attack testing", "Secure boot verification and bypass attempts", "Memory protection assessment", "Secure boot implementation guide" ], "excludes": [ "Fault injection campaigns", "Custom test fixtures and tooling", "Secure development guidance for the product team" ], "limits": { "devices": 2 } }, { "id": "premium", "name": "Enterprise Embedded Security Solution", "price_usd": 65000, "description": "Full-scope embedded security including custom testing tools, hardware security modules, and secure development guidance", "includes": [], "excludes": [ "Companion mobile app and cloud backend testing", "Product certification lab testing", "Firmware remediation" ], "limits": { "devices": 4 } } ], "scope": [ "Hardware interface testing", "Firmware reverse engineering", "Debug port analysis", "Boot sequence security review", "Memory protection assessment", "Secure boot verification", "Side-channel attack testing" ], "deliverables": [ "Technical findings report", "Hardware security analysis", "Firmware vulnerability assessment", "Debug protection recommendations", "Secure boot implementation guide", "Memory protection strategy", "60-day retest window" ], "scope_url": "https://cisomarketplace.services/scope?service=embedded-systems-security-assessment" }, { "slug": "identity-threat-detection-response-itdr", "title": "Identity Threat Detection & Response (ITDR)", "url": "https://cisomarketplace.services/services/identity-threat-detection-response-itdr", "md_url": "https://cisomarketplace.services/services/identity-threat-detection-response-itdr.md", "practice": "Advisory / vCISO", "category_group": "Advisory / vCISO", "description": "Identity-centric threat detection and response across Active Directory / Entra ID — privilege escalation, lateral movement, account takeover, and identity misconfiguration detection + response playbooks.", "from_price_usd": null, "price_cadence": null, "tiers": [ { "id": "basic", "name": "Essential", "price_usd": null, "description": "Point-in-time review for up to 1,000 users in 1 AD forest and 1 Entra ID tenant: identity misconfiguration review and attack-path analysis to privileged groups. Report with attack-path map and ranked fixes.", "includes": [ "1 AD forest and 1 Entra ID tenant", "Identity misconfiguration review", "Attack-path map to privileged accounts", "Ranked remediation list", "1 readout" ], "excludes": [ "Detection rule engineering", "Identity incident response playbooks", "Review of existing detection coverage", "Ongoing monitoring" ], "limits": { "users": 1000 } }, { "id": "advanced", "name": "Advanced", "price_usd": null, "description": "Assessment for up to 5,000 users across up to 3 AD forests and Entra tenants. Adds a detection gap review for privilege escalation, lateral movement and account takeover, detection logic written for the client's SIEM, and identity incident response playbooks.", "includes": [ "Up to 3 forests and tenants", "Attack-path analysis and misconfiguration review", "Detection gap analysis", "Detection logic for the client's SIEM", "Identity incident response playbooks", "Retest of fixed attack paths (1 round)" ], "excludes": [ "Ongoing detection monitoring and tuning", "24/7 response to identity alerts", "SIEM or ITDR product licences" ], "limits": { "users": 5000 } }, { "id": "enterprise", "name": "Enterprise", "price_usd": null, "description": "Managed ITDR program with continuous detection", "includes": [], "excludes": [ "SIEM or ITDR product licences", "Hands-on remediation in AD or Entra ID" ], "limits": {} } ], "scope": [ "AD/Entra attack-path analysis", "Privilege escalation & lateral movement detection", "Account takeover detection", "Identity misconfiguration review", "IR playbooks for identity attacks" ], "deliverables": [ "ITDR assessment report", "Identity attack-path map", "Detection gaps & recommendations", "Identity IR playbooks" ], "scope_url": "https://cisomarketplace.services/scope?service=identity-threat-detection-response-itdr" }, { "slug": "insider-threat-assessment", "title": "Insider Threat Assessment", "url": "https://cisomarketplace.services/services/insider-threat-assessment", "md_url": "https://cisomarketplace.services/services/insider-threat-assessment.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Comprehensive evaluation of your organization's ability to prevent, detect, and respond to threats originating from within. Our assessment examines technical controls, behavioral indicators, access management, and organizational culture to identify and mitigate insider risks.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Insider Risk Assessment", "price_usd": 35000, "description": "Insider risk assessment for up to 500 employees: privileged access review, authorization and separation-of-duties analysis for up to 3 critical systems, logging and monitoring capability review, HR policy review, and a control gap report.", "includes": [ "Privileged access review", "Authorization and separation-of-duties analysis for up to 3 critical systems", "Logging and monitoring capability review", "HR and offboarding policy review", "Insider risk assessment report and control gap analysis" ], "excludes": [ "DLP and user behavior analytics evaluation", "Insider threat program design", "Detection playbook", "Culture assessment" ], "limits": { "employees": 500 } }, { "id": "standard", "name": "Comprehensive Insider Threat Program", "price_usd": 60000, "description": "Insider risk assessment for up to 2,500 employees and up to 10 critical systems. Adds DLP assessment, user behavior analytics evaluation, existing program evaluation, behavioral indicator framework, program roadmap, and a detection playbook.", "includes": [ "Everything in the Essential tier, for up to 10 critical systems", "Data loss prevention assessment", "User behavior analytics evaluation", "Behavioral indicator framework", "Insider threat program roadmap", "Insider threat detection playbook" ], "excludes": [ "Custom analytics and detection rule development", "Integration of monitoring tools", "Organizational culture assessment" ], "limits": { "employees": 2500 } }, { "id": "enterprise", "name": "Enterprise Insider Risk Management", "price_usd": 95000, "description": "No fixed headcount cap - scoped to the organization. Adds custom detection analytics (up to 15 use cases) in the client's SIEM/UBA, integration of HR, access and DLP signals into monitoring, and an organizational culture assessment with staff interviews.", "includes": [ "Everything in the Comprehensive tier", "Up to 15 custom insider detection use cases built in the client's tooling", "Integration design for HR, identity and DLP signals", "Organizational culture assessment with surveys and interviews", "Governance model with legal, HR and security roles" ], "excludes": [ "Monitoring tool licences", "Ongoing insider threat analyst staffing", "Individual employee investigations" ], "limits": {} } ], "scope": [ "Privileged access review", "Data loss prevention assessment", "User behavior analytics evaluation", "Authorization control review", "Separation of duties analysis", "Logging and monitoring capabilities", "Insider threat program evaluation", "HR policy review" ], "deliverables": [ "Insider risk assessment report", "Control gap analysis", "Insider threat program roadmap", "Behavioral indicator framework", "Technical control recommendations", "Policy enhancement guide", "Insider threat detection playbook" ], "scope_url": "https://cisomarketplace.services/scope?service=insider-threat-assessment" }, { "slug": "internal-network-assessment", "title": "Internal Network Assessment", "url": "https://cisomarketplace.services/services/internal-network-assessment", "md_url": "https://cisomarketplace.services/services/internal-network-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive onsite evaluation of internal network infrastructure and security controls", "from_price_usd": 20000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Network Assessment", "price_usd": 20000, "description": "Internal network assessment of up to 250 hosts at one site, delivered remotely through a provided jump host or appliance.", "includes": [ "Internal network and directory review", "Prioritized findings report", "Remediation workshop" ], "excludes": [ "External testing", "More than one site", "Retest" ], "limits": { "internal_hosts": 250, "locations": 1 } }, { "id": "advanced", "name": "Advanced Network Assessment", "price_usd": 35000, "description": "Up to 1,000 hosts across up to 3 sites, including segmentation checks between sites and one retest.", "includes": [ "Internal network and directory review", "Segmentation checks", "One retest" ], "excludes": [ "External testing", "Cloud environments" ], "limits": { "internal_hosts": 1000, "locations": 3 } }, { "id": "premium", "name": "Enterprise Network Assessment", "price_usd": 50000, "description": "Up to 2,500 hosts across up to 5 sites, with a follow-up validation after the report.", "includes": [ "Everything in Advanced", "Follow-up validation at 90 days" ], "excludes": [ "Continuous monitoring — this is a point-in-time engagement" ], "limits": { "internal_hosts": 2500, "locations": 5 } } ], "scope": [ "Internal Network Architecture Review", "Active Directory Assessment", "Network Segmentation Testing", "Privilege Escalation Testing" ], "deliverables": [ "Comprehensive Security Report", "Network Architecture Review", "Security Controls Assessment", "Remediation Roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=internal-network-assessment" }, { "slug": "iot-security-assessment", "title": "IoT Security Assessment", "url": "https://cisomarketplace.services/services/iot-security-assessment", "md_url": "https://cisomarketplace.services/services/iot-security-assessment.md", "practice": "Offensive Security", "category_group": "Specialized", "description": "Security testing of Internet of Things devices and infrastructure", "from_price_usd": 10000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic IoT Assessment", "price_usd": 10000, "description": "Security test of 1 IoT device model: network services, local interfaces, authentication, update mechanism and device-to-cloud traffic review, with architecture review and a findings report. No firmware extraction.", "includes": [ "Testing of 1 device model (network services, web/local interfaces)", "Authentication and default credential checks", "Update mechanism and traffic encryption review", "Security architecture review", "Report, executive summary and follow-up consultation" ], "excludes": [ "Firmware extraction and reverse engineering", "Hardware teardown (UART/JTAG)", "Companion mobile app and cloud API testing", "Retest" ], "limits": { "devices": 1 } }, { "id": "advanced", "name": "Advanced IoT Assessment", "price_usd": 18000, "description": "Security test of up to 3 device models. Adds firmware extraction and analysis, hardware interface testing (UART/JTAG/debug ports), wireless protocol review, and one retest.", "includes": [ "Everything in the Basic tier, for up to 3 device models", "Firmware extraction, static analysis and secrets review", "Hardware debug interface testing", "Wireless protocol review (e.g. BLE, Zigbee, Wi-Fi)", "One retest of fixed findings" ], "excludes": [ "Companion mobile app testing", "Cloud backend / API penetration testing", "Network-wide deployment analysis" ], "limits": { "devices": 3 } }, { "id": "enterprise", "name": "Enterprise IoT Assessment", "price_usd": 30000, "description": "Ecosystem assessment: up to 6 device models plus 1 companion mobile app, 1 cloud API/backend and the deployment network. Includes firmware analysis, device-to-cloud trust review, network segmentation analysis, compliance mapping and an implementation roadmap.", "includes": [ "Everything in the Advanced tier, for up to 6 device models", "Testing of 1 companion mobile app", "Testing of 1 cloud API / backend", "Deployment network and segmentation analysis", "Compliance mapping and implementation roadmap", "One retest" ], "excludes": [ "Hardening implementation and monitoring setup (see IoT Security Hardening Program)", "Industrial / OT environments (see IIoT Security Assessment)", "More than 6 device models" ], "limits": { "devices": 6, "mobile_apps": 1, "apis": 1 } } ], "scope": [ "Device hardware and debug-interface review", "Firmware extraction and analysis", "Wireless and network communications (WiFi, Bluetooth, Zigbee, cellular as applicable)", "Companion mobile application and cloud API testing", "Update mechanism and secure-boot review", "Default credentials, provisioning and lifecycle review" ], "deliverables": [ "IoT device security report with reproducible findings", "Risk-rated findings per device model", "Hardening guidance for engineering", "Executive summary", "Retest of fixed findings" ], "scope_url": "https://cisomarketplace.services/scope?service=iot-security-assessment" }, { "slug": "managed-dmarc-email-authentication", "title": "Managed DMARC & Email Authentication Enforcement", "url": "https://cisomarketplace.services/services/managed-dmarc-email-authentication", "md_url": "https://cisomarketplace.services/services/managed-dmarc-email-authentication.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Spoofed email is how business email compromise starts, and mailbox providers now require authentication from bulk senders. We inventory every service sending as your domains, fix SPF, DKIM and alignment, move DMARC from monitoring to quarantine to reject in controlled steps, and then monitor it so a new marketing tool does not quietly break it.", "from_price_usd": 3500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential DMARC Enforcement", "price_usd": 3500, "description": "Up to 3 domains: sender inventory, SPF/DKIM fixes and staged rollout to p=reject", "includes": [], "excludes": [], "limits": { "domains": 3 } }, { "id": "advanced", "name": "Advanced DMARC Enforcement", "price_usd": 7500, "description": "Up to 15 domains: adds parked-domain protection, BIMI readiness and 6 months of monitoring", "includes": [], "excludes": [], "limits": { "domains": 15 } }, { "id": "enterprise", "name": "Enterprise DMARC Program", "price_usd": 14000, "description": "Large domain portfolios: adds subdomain policy design, third-party sender governance and 12 months of managed monitoring", "includes": [], "excludes": [], "limits": { "domains": 100 } } ], "scope": [ "Sender inventory across every domain and subdomain", "SPF, DKIM and alignment remediation", "Staged DMARC policy rollout: none, quarantine, reject", "Parked-domain protection", "Ongoing monitoring and new-sender onboarding" ], "deliverables": [ "Sender inventory", "DMARC enforcement at p=reject", "Runbook for onboarding new mail senders", "Monthly monitoring report (managed tiers)" ], "scope_url": "https://cisomarketplace.services/scope?service=managed-dmarc-email-authentication" }, { "slug": "microsoft-365-entra-security-assessment", "title": "Microsoft 365 & Entra ID Security Assessment", "url": "https://cisomarketplace.services/services/microsoft-365-entra-security-assessment", "md_url": "https://cisomarketplace.services/services/microsoft-365-entra-security-assessment.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "A fixed-scope assessment of the Microsoft 365 tenant most organizations run their business on: identity and conditional access in Entra ID, Exchange Online and anti-phishing, SharePoint/OneDrive/Teams sharing, Defender and Purview configuration, admin roles and break-glass accounts. Measured against the CIS Microsoft 365 Foundations Benchmark and Microsoft Secure Score, delivered as a prioritized hardening plan your IT team or MSP can execute.", "from_price_usd": 4500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential M365 Review", "price_usd": 4500, "description": "Single tenant up to 100 users: CIS benchmark review, Secure Score analysis and a prioritized hardening plan", "includes": [], "excludes": [], "limits": { "users": 100, "locations": 3 } }, { "id": "advanced", "name": "Advanced M365 & Entra Assessment", "price_usd": 9500, "description": "Up to 500 users: adds conditional access design, privileged access review, Defender and Purview configuration and a remediation workshop", "includes": [], "excludes": [], "limits": { "users": 500, "locations": 10 } }, { "id": "enterprise", "name": "Enterprise M365 Security Program", "price_usd": 18000, "description": "Multi-tenant or 500+ users: adds hybrid identity (AD Connect), application consent and service principal review, and 30 days of remediation support", "includes": [], "excludes": [ "Tenants above 5,000 users are scoped individually" ], "limits": { "users": 5000 } } ], "scope": [ "Entra ID: MFA, conditional access, legacy auth, privileged roles", "Exchange Online: anti-phishing, SPF/DKIM/DMARC, mail flow rules, forwarding", "SharePoint, OneDrive and Teams external sharing and guest access", "Defender for Office 365 / Endpoint and Purview baseline", "Audit logging, alerting and break-glass account review" ], "deliverables": [ "CIS Microsoft 365 benchmark scorecard", "Prioritized hardening plan (quick wins / 30 / 90 days)", "Conditional access policy recommendations", "Executive summary for leadership or your cyber insurer" ], "scope_url": "https://cisomarketplace.services/scope?service=microsoft-365-entra-security-assessment" }, { "slug": "m365-copilot-genai-data-oversharing-readiness", "title": "Microsoft 365 Copilot & GenAI Data-Oversharing Readiness", "url": "https://cisomarketplace.services/services/m365-copilot-genai-data-oversharing-readiness", "md_url": "https://cisomarketplace.services/services/m365-copilot-genai-data-oversharing-readiness.md", "practice": "AI Security", "category_group": "Cloud & AppSec", "description": "Copilot and other GenAI assistants answer with whatever a user can technically reach. This engagement maps overshared SharePoint, OneDrive and Teams content, stale and broken permissions, sensitivity labelling gaps and risky sites, then delivers the remediation and governance plan that makes a Copilot rollout defensible — including an AI acceptable-use policy and the Purview controls to enforce it.", "from_price_usd": 12500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Copilot Readiness", "price_usd": 12500, "description": "Up to 250 users: oversharing analysis, top-risk remediation plan and AI acceptable-use policy", "includes": [], "excludes": [], "limits": { "users": 250 } }, { "id": "advanced", "name": "Advanced Copilot Readiness", "price_usd": 18500, "description": "Up to 1,000 users: adds sensitivity-label design, Purview DLP baseline and a pilot-group rollout plan", "includes": [], "excludes": [], "limits": { "users": 1000 } }, { "id": "enterprise", "name": "Enterprise GenAI Data Governance", "price_usd": 32000, "description": "1,000+ users or multiple GenAI tools: adds data-owner workshops, automated remediation runbooks and post-rollout monitoring design", "includes": [], "excludes": [], "limits": { "users": 10000 } } ], "scope": [ "Permission and sharing analysis across SharePoint, OneDrive and Teams", "Sensitive data discovery and sensitivity-label coverage", "Copilot / GenAI access-path review (who can reach what)", "Purview DLP, labelling and retention baseline", "AI acceptable-use policy and rollout guardrails" ], "deliverables": [ "Oversharing findings report with the top risky sites and groups", "Remediation plan with owner-ready task lists", "AI acceptable-use policy", "Go / no-go readiness scorecard for the Copilot rollout" ], "scope_url": "https://cisomarketplace.services/scope?service=m365-copilot-genai-data-oversharing-readiness" }, { "slug": "mobile-application-security-assessment", "title": "Mobile Application Security Assessment", "url": "https://cisomarketplace.services/services/mobile-application-security-assessment", "md_url": "https://cisomarketplace.services/services/mobile-application-security-assessment.md", "practice": "Offensive Security", "category_group": "Cloud & AppSec", "description": "Comprehensive security testing of iOS and Android applications", "from_price_usd": 10000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Assessment", "price_usd": 10000, "description": "Security test of 1 mobile app on 1 platform (a single iOS build or a single Android build): static and dynamic analysis of the app binary, local storage, authentication, and app-to-server traffic. One retest.", "includes": [ "1 app, 1 platform build", "Static and dynamic analysis of the binary", "Local data storage, auth and session checks", "Traffic interception of app-to-server calls", "One retest of fixed findings" ], "excludes": [ "Second platform build", "Dedicated backend API penetration test", "Source code review", "CI/CD integration of SAST/DAST" ], "limits": { "mobile_apps": 1 } }, { "id": "advanced", "name": "Advanced Assessment", "price_usd": 15000, "description": "Security test of 1 mobile app on both platforms (iOS and Android builds) plus its 1 backend API (up to 50 endpoints), with dependency analysis and source-assisted review where code is provided. One retest.", "includes": [ "iOS and Android builds of 1 app (2 builds)", "1 backend API, up to 50 endpoints", "Third-party dependency/SDK analysis", "Source-assisted review where code is supplied", "One retest of fixed findings" ], "excludes": [ "Additional apps", "Internal network testing", "Social engineering", "Ongoing testing of new releases" ], "limits": { "mobile_apps": 2, "apis": 1 } } ], "scope": [ "iOS and Android application testing against OWASP MASVS", "Local data storage, keychain / keystore and cryptography review", "Authentication, session and authorization testing", "Backend API testing for the application", "Reverse-engineering resistance and tamper checks", "Third-party SDK and permission review" ], "deliverables": [ "Mobile application security report mapped to OWASP MASVS", "Reproducible findings with risk ratings", "Developer remediation guidance", "Executive summary", "Retest of fixed findings" ], "scope_url": "https://cisomarketplace.services/scope?service=mobile-application-security-assessment" }, { "slug": "penetration-testing", "title": "Penetration Testing", "url": "https://cisomarketplace.services/services/penetration-testing", "md_url": "https://cisomarketplace.services/services/penetration-testing.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive penetration testing service including network, application, and infrastructure security assessment. Includes detailed reporting and remediation guidance.", "from_price_usd": 8000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic (External only)", "price_usd": 8000, "description": "External testing only: up to 25 internet-facing IPs and 1 web application with up to 2 user roles. Report, one retest and an attestation letter.", "includes": [ "External network testing", "One web application", "Report and findings walkthrough", "One retest" ], "excludes": [ "Internal network testing", "Staff-targeted and on-site testing", "More than one application" ], "limits": { "external_ips": 25, "web_apps": 1, "locations": 1 } }, { "id": "external-plus", "name": "External Plus (External only)", "price_usd": 12500, "description": "External testing only, for a larger perimeter: up to 100 internet-facing IPs and 1 web application with up to 2 user roles. Report, one retest and an attestation letter.", "includes": [ "External network testing of up to 100 IPs", "One web application", "Report and findings walkthrough", "One retest" ], "excludes": [ "Internal network testing", "Staff-targeted and on-site testing", "More than one application" ], "limits": { "external_ips": 100, "web_apps": 1, "locations": 1 } }, { "id": "standard", "name": "Standard (External + Internal)", "price_usd": 15000, "description": "External and internal testing: up to 50 internet-facing IPs, up to 2 web applications and an internal network of up to 250 hosts at one site.", "includes": [ "External network testing", "Internal network testing at one site", "Up to two web applications", "Report, walkthrough and one retest" ], "excludes": [ "Staff-targeted and on-site testing", "More than one site" ], "limits": { "external_ips": 50, "web_apps": 2, "internal_hosts": 250, "locations": 1 } }, { "id": "premium", "name": "Premium (Full scope + Social Engineering)", "price_usd": 25000, "description": "External, internal, staff-targeted and on-site testing: up to 100 internet-facing IPs, 3 web applications, 500 internal hosts and 2 sites.", "includes": [ "External and internal network testing", "Up to three web applications", "One staff-targeted email exercise", "On-site testing at up to two sites" ], "excludes": [ "Objective-based adversary simulation — see Red Team Assessment", "Environments above 500 hosts — scoped separately" ], "limits": { "external_ips": 100, "web_apps": 3, "internal_hosts": 500, "locations": 2 } } ], "scope": [ "Scoping, rules of engagement and testing windows", "External network testing of internet-facing systems", "Web application testing (authenticated, by user role)", "Internal network testing (Standard and Premium tiers)", "Staff-targeted and on-site testing (Premium tier)", "Retest of remediated findings" ], "deliverables": [ "Penetration test report with reproducible findings and risk ratings", "Executive summary", "Remediation guidance per finding", "Findings walkthrough with your technical team", "Retest results and attestation letter" ], "scope_url": "https://cisomarketplace.services/scope?service=penetration-testing" }, { "slug": "ransomware-readiness-assessment", "title": "Ransomware Readiness Assessment", "url": "https://cisomarketplace.services/services/ransomware-readiness-assessment", "md_url": "https://cisomarketplace.services/services/ransomware-readiness-assessment.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Evaluate your organization's ability to prevent, detect, and recover from sophisticated ransomware attacks. Our assessment identifies critical gaps in ransomware defense and provides a clear roadmap for enhancing resilience.", "from_price_usd": 30000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Ransomware Defense", "price_usd": 30000, "description": "Control review for up to 500 employees and 1 location with one AD forest: email security, endpoint protection, segmentation, backups, AD and privileged access, by configuration review and interviews. Report and remediation roadmap.", "includes": [ "Review of the 7 ransomware control areas", "Backup and recovery capability review on paper", "Active Directory security configuration review", "Ransomware defense report", "Remediation roadmap" ], "excludes": [ "Tabletop exercise", "Hands-on restore testing", "Attack simulation", "IR playbook updates" ], "limits": { "employees": 500, "locations": 1 } }, { "id": "enhanced", "name": "Enhanced Ransomware Protection Program", "price_usd": 55000, "description": "Up to 2,500 employees and up to 3 locations. Adds 1 ransomware tabletop scenario for up to 20 participants, observed restore tests of up to 3 critical systems, a user awareness evaluation, and updates to the existing IR playbook.", "includes": [ "Everything in the basic tier", "1 ransomware tabletop scenario", "Observed restore tests of up to 3 critical systems", "User awareness evaluation", "Updates to the existing IR playbook" ], "excludes": [ "Ransomware attack simulation in the environment", "A new custom playbook written from scratch", "Remediation implementation" ], "limits": { "employees": 2500, "locations": 3, "scenarios": 1, "participants": 20 } }, { "id": "complete", "name": "Complete Anti-Ransomware Solution", "price_usd": 85000, "description": "No fixed employee cap - scoped at kickoff; up to 10 locations. Adds ransomware attack simulation with non-destructive techniques, restore validation of up to 8 critical systems, 2 tabletop scenarios for up to 40 participants, and a custom playbook.", "includes": [ "Everything in the enhanced tier", "Non-destructive ransomware attack simulation", "Restore validation of up to 8 critical systems", "2 tabletop scenarios (technical and executive)", "Custom ransomware response playbook" ], "excludes": [ "Remediation implementation", "Incident response retainer", "Ransom negotiation services" ], "limits": { "locations": 10, "scenarios": 2, "participants": 40 } } ], "scope": [ "Email security controls", "Endpoint protection assessment", "Network segmentation review", "Backup and recovery systems", "Active Directory security", "User awareness evaluation", "Privileged access management" ], "deliverables": [ "Ransomware defense report", "Technical control recommendations", "Recovery capability assessment", "Remediation roadmap", "Tabletop scenario results", "Incident response playbook updates" ], "scope_url": "https://cisomarketplace.services/scope?service=ransomware-readiness-assessment" }, { "slug": "red-team-assessment", "title": "Red Team Assessment", "url": "https://cisomarketplace.services/services/red-team-assessment", "md_url": "https://cisomarketplace.services/services/red-team-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Advanced adversary simulation to test your security controls", "from_price_usd": 25000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Red Team", "price_usd": 25000, "description": "One objective at one site, using standard scenarios agreed at kickoff.", "includes": [ "One agreed objective", "Executive and technical report", "Debrief with the defensive team" ], "excludes": [ "Custom tooling", "On-site activity at more than one site" ], "limits": { "scenarios": 1, "locations": 1 } }, { "id": "advanced", "name": "Advanced Red Team", "price_usd": 44000, "description": "Up to 2 objectives with scenarios tailored to the organization, across up to 2 sites.", "includes": [ "Up to two objectives", "Tailored scenarios", "Detection and response timeline for the defensive team" ], "excludes": [ "Engagements longer than 4 weeks" ], "limits": { "scenarios": 2, "locations": 2 } }, { "id": "enterprise", "name": "Enterprise Red Team", "price_usd": 62500, "description": "Up to 3 objectives across up to 3 sites, with a joint replay session for the defensive team.", "includes": [ "Up to three objectives", "Joint replay session", "Board-level summary" ], "excludes": [ "Ongoing adversary simulation — see Red Team Subscription" ], "limits": { "scenarios": 3, "locations": 3 } } ], "scope": [ "Objectives and rules of engagement agreed with an executive sponsor", "Threat-informed scenario design", "Objective-based adversary simulation across people, process and technology", "Measurement of detection and response by your defensive team", "Joint replay session with the defensive team" ], "deliverables": [ "Engagement narrative: what was attempted, what worked, what was detected", "Detection and response timeline", "Prioritized improvement plan for prevention, detection and response", "Executive and board-level summary", "Debrief and replay session" ], "scope_url": "https://cisomarketplace.services/scope?service=red-team-assessment" }, { "slug": "remote-work-security-assessment", "title": "Remote Work Security Assessment", "url": "https://cisomarketplace.services/services/remote-work-security-assessment", "md_url": "https://cisomarketplace.services/services/remote-work-security-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's remote work security posture in today's hybrid workplace environment. Our assessment examines remote access infrastructure, endpoint security, home network risks, secure communications, data protection measures, and policy effectiveness for distributed workforces, providing a roadmap to secure your modern workplace.", "from_price_usd": 30000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Remote Work Security Review", "price_usd": 30000, "description": "Up to 250 remote users. Review of remote access (VPN/ZTNA), authentication and identity controls, endpoint protection and MDM settings, cloud access and the remote work policy, by configuration review and interviews. Findings report and roadmap.", "includes": [ "Remote access and authentication configuration review", "Endpoint protection and MDM review", "Cloud access security review", "Remote work policy review", "Risk findings report and implementation roadmap" ], "excludes": [ "Writing new policies and procedures", "Collaboration tool and DLP deep-dive", "Security awareness materials", "Physical assessment of shared offices" ], "limits": { "users": 250 } }, { "id": "coworking", "name": "Shared Office & Coworking Space Security Assessment", "price_usd": 45000, "description": "For teams in shared offices: up to 250 users across up to 3 coworking sites. On-site review at each site of physical access, shared network isolation, visual and acoustic privacy, printing and device handling, plus the remote access and policy review from the base tier.", "includes": [ "On-site assessment of up to 3 shared office sites", "Shared network isolation and Wi-Fi review", "Visual privacy, clean desk and device handling review", "Remote access, authentication and policy review", "Shared-workspace security guidelines for staff" ], "excludes": [ "Endpoint strategy and collaboration framework development", "Full policy rewrite", "Testing of the coworking operator's own infrastructure", "More than 3 sites" ], "limits": { "users": 250, "locations": 3 } }, { "id": "comprehensive", "name": "Comprehensive Remote Workforce Security Program", "price_usd": 55000, "description": "Up to 1,000 remote users. Adds DLP for remote workers, collaboration tool assessment, remote support security and home network risk, and we write the deliverables: endpoint strategy, collaboration framework, updated policies, home office guidelines and awareness materials.", "includes": [ "Everything in the review tier", "Endpoint protection strategy and remote access architecture recommendations", "Secure collaboration framework", "Written policy and procedure updates", "Home office security guidelines and awareness materials" ], "excludes": [ "On-site assessment of coworking spaces", "Deployment of tools or configuration changes", "Penetration testing of remote access", "Workforces above 1,000 remote users (scoped separately)" ], "limits": { "users": 1000 } } ], "scope": [ "Remote access security evaluation", "Home network risk assessment", "Endpoint protection review", "Mobile device management analysis", "Data loss prevention for remote workers", "Secure collaboration tool assessment", "Remote work policy review", "Authentication and identity controls", "Cloud access security", "Remote support security" ], "deliverables": [ "Remote work security report", "Risk assessment findings", "Remote access architecture recommendations", "Endpoint security enhancement plan", "Secure collaboration framework", "Policy and procedure updates", "Home office security guidelines", "Remote security awareness materials", "Implementation roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=remote-work-security-assessment" }, { "slug": "smb-comprehensive-security-assessment", "title": "SMB Comprehensive Security Assessment", "url": "https://cisomarketplace.services/services/smb-comprehensive-security-assessment", "md_url": "https://cisomarketplace.services/services/smb-comprehensive-security-assessment.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Practical and efficient security evaluation designed specifically for small and medium-sized businesses. This streamlined assessment focuses on essential security controls, cloud security, and practical recommendations that can be implemented with limited resources. Our SMB-focused approach delivers actionable security guidance without requiring enterprise-scale security teams or budgets.", "from_price_usd": 25000, "price_cadence": "engagement", "tiers": [ { "id": "essential", "name": "Essential SMB Security Review", "price_usd": 25000, "description": "Assessment of the 12 core control areas for a business of up to 50 employees, 1 location and 1 cloud environment. Interviews, configuration checks of email, identity, endpoints and backup; no compliance mapping.", "includes": [ "Up to 50 employees, 1 location", "1 cloud/productivity environment reviewed", "Email, identity, endpoint and backup checks", "Quick-wins list and roadmap", "Policy and IR plan templates" ], "excludes": [ "Compliance mapping to a framework", "Custom application review", "Penetration testing", "Additional locations" ], "limits": { "employees": 50, "locations": 1, "cloud_accounts": 1 } }, { "id": "standard", "name": "Standard SMB Security Assessment", "price_usd": 35000, "description": "Assessment of the 12 control areas for up to 100 employees, up to 3 locations and up to 2 cloud environments, adding mapping to 1 compliance framework and review of up to 5 key vendors.", "includes": [ "Up to 100 employees, up to 3 locations", "Up to 2 cloud environments", "Gap mapping to 1 compliance framework", "Security review of up to 5 key vendors", "Roadmap with timeframes" ], "excludes": [ "Custom application review", "On-prem/hybrid infrastructure deep-dive", "Penetration testing" ], "limits": { "employees": 100, "locations": 3, "cloud_accounts": 2, "frameworks": 1, "vendors": 5 } }, { "id": "advanced", "name": "Advanced SMB Security Program", "price_usd": 45000, "description": "Assessment for up to 250 employees, up to 5 locations and up to 3 cloud environments with hybrid on-prem infrastructure, adding a design-level review of 1 custom application, mapping to up to 2 frameworks and up to 10 vendors.", "includes": [ "Up to 250 employees, up to 5 locations", "Hybrid on-prem and up to 3 cloud environments", "Design-level review of 1 custom application", "Gap mapping to up to 2 frameworks", "Security review of up to 10 vendors" ], "excludes": [ "Penetration testing", "Remediation implementation", "Organizations over 250 employees (use an enterprise assessment)" ], "limits": { "employees": 250, "locations": 5, "cloud_accounts": 3, "frameworks": 2, "vendors": 10, "web_apps": 1 } } ], "scope": [ "Essential security controls assessment", "Cloud security configuration review", "Identity and access management evaluation", "Data protection practices assessment", "Network security fundamentals review", "Endpoint protection assessment", "Business email security evaluation", "Backup and recovery assessment", "Basic incident response readiness", "Vendor security review", "Security awareness evaluation", "Regulatory compliance fundamentals" ], "deliverables": [ "SMB security assessment report", "Prioritized security recommendations", "Implementation roadmap with timeframes", "Security quick-wins list", "Cloud security checklist", "Essential security policy templates", "Vendor security questionnaire template", "Incident response plan template", "Security awareness materials", "Executive summary with clear next steps" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-comprehensive-security-assessment" }, { "slug": "smb-remote-workforce", "title": "SMB Remote Workforce", "url": "https://cisomarketplace.services/services/smb-remote-workforce", "md_url": "https://cisomarketplace.services/services/smb-remote-workforce.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Security assessment focused on distributed workforce risks.", "from_price_usd": 4500, "price_cadence": "engagement", "tiers": [], "scope": [ "VPN configuration review", "MDM policy assessment", "Cloud app security review", "Remote access controls", "Endpoint security check", "Data loss prevention review", "Remote worker security survey" ], "deliverables": [ "Remote security assessment report", "MDM configuration guide", "Cloud security checklist", "Remote worker security guide", "1-hour findings review" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-remote-workforce" }, { "slug": "smb-security-essentials", "title": "SMB Security Essentials", "url": "https://cisomarketplace.services/services/smb-security-essentials", "md_url": "https://cisomarketplace.services/services/smb-security-essentials.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive security assessment tailored for growing businesses with complex infrastructure.", "from_price_usd": 5000, "price_cadence": "engagement", "tiers": [], "scope": [ "External/Internal network penetration test", "Web application assessment (1 application)", "Active Directory security review", "Cloud configuration review (AWS/Azure/GCP)", "Compliance gap analysis" ], "deliverables": [ "Detailed technical report", "Cloud security scorecard", "AD security metrics", "Web app vulnerability assessment", "1-hour findings review" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-security-essentials" }, { "slug": "smb-security-quickscan", "title": "SMB Security Quickscan", "url": "https://cisomarketplace.services/services/smb-security-quickscan", "md_url": "https://cisomarketplace.services/services/smb-security-quickscan.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Rapid security assessment designed for small businesses needing basic security validation.", "from_price_usd": 2500, "price_cadence": "engagement", "tiers": [], "scope": [ "External vulnerability scan (up to 256 IPs)", "Basic phishing campaign (up to 100 employees)", "Critical findings summary", "Executive recommendations" ], "deliverables": [ "High-level findings report", "Phishing statistics dashboard", "30-minute executive briefing", "Basic remediation checklist" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-security-quickscan" }, { "slug": "smb-security-starter", "title": "SMB Security Starter", "url": "https://cisomarketplace.services/services/smb-security-starter", "md_url": "https://cisomarketplace.services/services/smb-security-starter.md", "practice": "Specialized & Industry", "category_group": "Specialized", "description": "Entry-level automated security assessment for micro-businesses and startups.", "from_price_usd": 1500, "price_cadence": "engagement", "tiers": [], "scope": [ "External vulnerability scan (up to 128 IPs)", "Automated web application scan (1 domain)", "SSL/TLS configuration check", "Basic DNS security review", "Open source intelligence gathering" ], "deliverables": [ "PDF executive summary", "Automated scan results", "Basic remediation checklist", "15-minute findings review call" ], "scope_url": "https://cisomarketplace.services/scope?service=smb-security-starter" }, { "slug": "saas-security-posture-assessment", "title": "SaaS Security Posture Assessment", "url": "https://cisomarketplace.services/services/saas-security-posture-assessment", "md_url": "https://cisomarketplace.services/services/saas-security-posture-assessment.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Comprehensive security evaluation of your cloud-based productivity and collaboration platforms, including Microsoft 365, Google Workspace, and other critical SaaS environments. Our assessment identifies security misconfigurations, access control weaknesses, data protection gaps, and provides actionable recommendations to secure your cloud-based business operations.", "from_price_usd": 32000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential SaaS Security Review", "price_usd": 32000, "description": "Configuration assessment of 1 primary SaaS platform (one Microsoft 365 tenant, or one Google Workspace tenant), up to 500 users: identity, admin privileges, MFA, conditional access, sharing and DLP settings.", "includes": [ "1 SaaS platform, 1 tenant, up to 500 users", "Identity, MFA and conditional access review", "Admin privilege assessment", "Sharing, DLP and information protection settings", "Posture report with baseline recommendations" ], "excludes": [ "Second SaaS platform", "Third-party app integration review", "Shadow IT discovery", "Remediation in your tenant" ], "limits": { "users": 500 } }, { "id": "standard", "name": "Comprehensive SaaS Security Program", "price_usd": 55000, "description": "Assessment of up to 3 SaaS platforms, up to 2,500 users: all first-tier checks per platform plus third-party app/OAuth integration review, shadow IT discovery, access control framework and data protection strategy.", "includes": [ "Up to 3 SaaS platforms, up to 2,500 users", "Third-party app and OAuth integration review", "Shadow IT discovery", "Access control framework", "Data protection strategy and tenant roadmap" ], "excludes": [ "Custom security baseline per platform", "On-premises identity integration review", "Remediation in your tenants" ], "limits": { "users": 2500 } }, { "id": "enterprise", "name": "Enterprise SaaS Security Framework", "price_usd": 85000, "description": "Assessment of up to 6 SaaS platforms; no fixed user cap - scoped at kickoff. Adds a custom security baseline per platform, a third-party app governance model, and review of integration with on-premises identity and security tooling.", "includes": [ "Up to 6 SaaS platforms, user count scoped", "Custom configuration baseline per platform", "Third-party app governance model", "On-premises identity/security integration review", "Monitoring recommendations" ], "excludes": [ "Remediation implementation in your tenants", "Ongoing posture monitoring", "SaaS licence or tooling costs" ], "limits": {} } ], "scope": [ "Identity and access management review", "Admin privilege assessment", "Data loss prevention controls", "Security configuration analysis", "Third-party application integration security", "Shadow IT discovery", "Multi-factor authentication implementation", "Conditional access policy evaluation", "Information protection settings", "Collaboration security controls" ], "deliverables": [ "SaaS security posture report", "Configuration baseline recommendations", "Access control framework", "Data protection strategy", "Tenant security roadmap", "Secure collaboration guidelines", "Third-party app governance model", "Cloud security monitoring recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=saas-security-posture-assessment" }, { "slug": "secure-code-review", "title": "Secure Code Review", "url": "https://cisomarketplace.services/services/secure-code-review", "md_url": "https://cisomarketplace.services/services/secure-code-review.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Comprehensive analysis of application source code to identify security vulnerabilities, coding flaws, and implementation issues that could lead to security breaches. Our expert review combines automated scanning with manual expert analysis.", "from_price_usd": 35000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Code Review", "price_usd": 35000, "description": "Review of the security-critical components of 1 application: up to 2 repositories and up to 100,000 lines of code. Automated static analysis of the whole codebase, manual review limited to auth, session, input handling and crypto.", "includes": [ "1 application, up to 2 repositories, up to 100k LOC", "Automated static analysis of all code", "Manual review of auth, session, input and crypto code", "Vulnerability report with code-level fixes" ], "excludes": [ "Manual review of the full codebase", "Business logic review", "Software composition analysis of all dependencies", "Developer training" ], "limits": { "repositories": 2 } }, { "id": "comprehensive", "name": "Comprehensive Code Security Assessment", "price_usd": 65000, "description": "Whole-codebase review of 1 application: up to 5 repositories and up to 500,000 lines of code. Manual review of all modules, business logic review, software composition analysis and a remediation plan.", "includes": [ "1 application, up to 5 repositories, up to 500k LOC", "Manual review across all modules", "Business logic review", "Software composition analysis", "Prioritized remediation plan" ], "excludes": [ "Secure SDLC process design", "Custom static-analysis rules", "Developer training delivery", "Fixing the code" ], "limits": { "repositories": 5 } }, { "id": "enterprise", "name": "Enterprise Secure SDLC Program", "price_usd": 95000, "description": "Code review of up to 3 applications and up to 15 repositories, plus secure SDLC design, custom static-analysis rules wired into your pipeline and secure-coding training for up to 50 developers. Lines of code scoped at kickoff.", "includes": [ "Up to 3 applications, up to 15 repositories", "Secure SDLC process design and rollout plan", "Custom static-analysis rules in your pipeline", "Secure-coding training for up to 50 developers", "Software composition analysis" ], "excludes": [ "Fixing the code", "Ongoing review of new commits", "Dynamic/penetration testing of running apps" ], "limits": { "repositories": 15, "developers": 50 } } ], "scope": [ "Manual code review", "Automated static analysis", "Business logic review", "Third-party component analysis", "Security control assessment", "Secure coding practices evaluation" ], "deliverables": [ "Detailed vulnerability report", "Code-level remediation guidance", "Risk prioritization", "Secure coding best practices", "Software composition analysis", "Secure development training recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=secure-code-review" }, { "slug": "secure-development-training-security-champions", "title": "Secure Development Training & Security Champions Program", "url": "https://cisomarketplace.services/services/secure-development-training-security-champions", "md_url": "https://cisomarketplace.services/services/secure-development-training-security-champions.md", "practice": "Cloud & Application Security", "category_group": "Cloud & AppSec", "description": "Annual slide-deck training does not change how code is written. We train developers on the vulnerabilities found in your own stack and findings, run hands-on labs, and stand up a security champions program — named engineers in each team with a playbook, office hours and metrics — so secure design survives after the training ends. Satisfies SOC 2, ISO 27001 and PCI developer-training requirements.", "from_price_usd": 4500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Developer Training", "price_usd": 4500, "description": "Up to 15 developers: one tailored workshop day, labs and completion evidence", "includes": [], "excludes": [], "limits": { "developers": 15 } }, { "id": "advanced", "name": "Advanced Training & Champions Launch", "price_usd": 12000, "description": "Up to 50 developers: adds language-specific tracks, champions selection, playbook and three months of office hours", "includes": [], "excludes": [], "limits": { "developers": 50 } }, { "id": "enterprise", "name": "Enterprise Champions Program", "price_usd": 28000, "description": "Up to 200 developers: adds threat-modelling clinics, champion coaching for 12 months and program metrics", "includes": [], "excludes": [], "limits": { "developers": 200 } } ], "scope": [ "Training needs analysis from your stack and past findings", "Hands-on secure coding workshops", "Security champions selection, playbook and office hours", "Threat modelling and secure design clinic", "Completion evidence for auditors" ], "deliverables": [ "Tailored training curriculum and labs", "Security champions playbook", "Training completion records", "Program metrics and 12-month plan" ], "scope_url": "https://cisomarketplace.services/scope?service=secure-development-training-security-champions" }, { "slug": "security-automation-orchestration-assessment", "title": "Security Automation & Orchestration Assessment", "url": "https://cisomarketplace.services/services/security-automation-orchestration-assessment", "md_url": "https://cisomarketplace.services/services/security-automation-orchestration-assessment.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Comprehensive evaluation of your organization's security automation capabilities and integration with security workflows. Our assessment analyzes your current security orchestration, automation, and response (SOAR) implementation, identifies opportunities for enhanced efficiency, and provides a roadmap to accelerate threat response through optimized automation.", "from_price_usd": 36000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Automation Assessment", "price_usd": 36000, "description": "Assessment of 1 automation platform: up to 10 existing playbooks and up to 10 tool integrations reviewed, alert triage and response time metrics analysis, maturity report and prioritized use case list. 160 consulting hours. No playbooks are written.", "includes": [ "Automation maturity report for 1 platform", "Review of up to 10 playbooks and 10 integrations", "Alert triage and response time metrics analysis", "Use case prioritization framework", "Skills gap findings" ], "excludes": [ "New playbook design or development", "Integration architecture design", "ROI model for proposed automations", "Implementation support" ], "limits": { "hours": 160 } }, { "id": "advanced", "name": "Advanced Automation & Orchestration Program", "price_usd": 65000, "description": "Comprehensive assessment with detailed automation roadmap, playbook development, and integration architecture", "includes": [], "excludes": [ "Building and deploying playbooks in the platform", "Post-deployment ROI measurement", "Platform licensing or procurement" ], "limits": {} }, { "id": "enterprise", "name": "Enterprise Security Automation Transformation", "price_usd": 95000, "description": "Complete automation transformation program with custom playbook development, implementation support, and ROI validation", "includes": [], "excludes": [ "Platform licensing costs", "24x7 operation of the automation platform", "Development beyond the included hours" ], "limits": {} } ], "scope": [ "Security automation platform assessment", "Workflow integration analysis", "Playbook effectiveness evaluation", "Alert triage automation review", "Orchestration capability assessment", "Response time metrics analysis", "Integration ecosystem evaluation", "Automation governance review", "Security tool integration assessment", "Automation ROI analysis", "Skills gap identification", "Use case prioritization" ], "deliverables": [ "Security automation maturity report", "Workflow optimization recommendations", "Playbook enhancement strategy", "Integration architecture recommendations", "Automation roadmap and timeline", "Response time improvement projections", "ROI analysis for proposed automations", "Use case prioritization framework", "Skills development recommendations", "Tool integration guidance" ], "scope_url": "https://cisomarketplace.services/scope?service=security-automation-orchestration-assessment" }, { "slug": "security-awareness-program-assessment", "title": "Security Awareness Program Assessment", "url": "https://cisomarketplace.services/services/security-awareness-program-assessment", "md_url": "https://cisomarketplace.services/services/security-awareness-program-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive evaluation of your organization's security awareness and training initiatives, measuring effectiveness, cultural impact, and behavior change. Our assessment identifies gaps in your human security controls and provides a strategic roadmap for creating a security-conscious workforce that actively defends against social engineering and other human-targeted attacks.", "from_price_usd": 28000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Security Awareness Review", "price_usd": 28000, "description": "Assessment of the awareness program for up to 500 staff.", "includes": [ "Program and content review", "Metrics baseline", "Improvement plan" ], "excludes": [ "Running simulations for you" ], "limits": { "employees": 500 } }, { "id": "standard", "name": "Comprehensive Awareness Program Development", "price_usd": 48000, "description": "Up to 2,000 staff, including a measured simulation and role-based gap analysis.", "includes": [ "Measured simulation", "Role-based gap analysis" ], "excludes": [ "Ongoing program operation" ], "limits": { "employees": 2000 } }, { "id": "enterprise", "name": "Enterprise Security Culture Program", "price_usd": 75000, "description": "Up to 10,000 staff across regions; larger organizations are scoped at kickoff.", "includes": [ "Multi-region program review", "Executive and board reporting design" ], "excludes": [ "Ongoing program operation — see Managed Security Awareness" ], "limits": { "employees": 10000 } } ], "scope": [ "Training content evaluation", "Awareness program effectiveness", "Phishing simulation results analysis", "Security culture assessment", "Behavior change measurement", "Training delivery methods", "Executive engagement review", "Compliance training adequacy" ], "deliverables": [ "Security awareness program report", "Gap analysis and recommendations", "Phishing simulation plan", "Training content enhancement strategy", "Security culture development roadmap", "Metrics and measurement framework", "Role-based training recommendations" ], "scope_url": "https://cisomarketplace.services/scope?service=security-awareness-program-assessment" }, { "slug": "tabletop-exercises", "title": "Tabletop Exercises Program", "url": "https://cisomarketplace.services/services/tabletop-exercises", "md_url": "https://cisomarketplace.services/services/tabletop-exercises.md", "practice": "Managed Security & Incident Response", "category_group": "Incident Response & Recovery", "description": "Structured, facilitated simulations of cybersecurity incidents designed to test your organization's incident response capabilities, processes, and decision-making. Our exercises create realistic scenarios to identify gaps, improve coordination, and enhance your incident response effectiveness.", "from_price_usd": 28000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Response Exercise", "price_usd": 28000, "description": "Single scenario tabletop exercise focused on technical incident response procedures", "includes": [], "excludes": [ "Management and communications team exercise", "Executive participation and executive briefing", "Multiple scenarios", "Follow-up exercise" ], "limits": { "participants": 15, "scenarios": 1, "sessions": 1 } }, { "id": "advanced", "name": "Advanced Exercise Program", "price_usd": 45000, "description": "Up to 3 scenarios over up to 3 sessions for up to 30 participants, testing technical, communications and management response separately. Adds communications effectiveness assessment, executive briefing, and a follow-up exercise roadmap.", "includes": [ "Everything in the basic tier", "Up to 3 scenarios across technical, communications and management teams", "Communications procedure testing", "Executive briefing of results", "Follow-up exercise roadmap" ], "excludes": [ "Single combined simulation with executives, legal and PR in the room", "Escalating injects across business units", "Crisis communications drafting" ], "limits": { "participants": 30, "scenarios": 3, "sessions": 3 } }, { "id": "comprehensive", "name": "Comprehensive Crisis Simulation", "price_usd": 75000, "description": "Full-day crisis simulation plus preparation sessions: up to 5 escalating scenarios over up to 4 sessions for up to 60 participants from executives, technical teams, legal, PR and business units, with live injects and decision-point scoring.", "includes": [ "Everything in the advanced tier", "Full-day multi-team crisis simulation", "Up to 5 escalating scenarios with live injects", "Executive decision-making assessment", "Interdepartmental coordination assessment", "Executive and board-level briefing" ], "excludes": [ "Technical attack simulation against live systems", "Rewriting the IR plan", "Recurring quarterly exercises" ], "limits": { "participants": 60, "scenarios": 5, "sessions": 4 } } ], "scope": [ "Incident response plan review", "Custom scenario development", "Exercise facilitation", "Decision point evaluation", "Interdepartmental coordination assessment", "Communications procedure testing", "Executive decision-making assessment" ], "deliverables": [ "Exercise findings report", "IR plan improvement recommendations", "Incident response procedure gaps", "Response timeline analysis", "Communications effectiveness assessment", "Executive briefing", "Follow-up exercise roadmap" ], "scope_url": "https://cisomarketplace.services/scope?service=tabletop-exercises" }, { "slug": "threat-modeling-as-a-service", "title": "Threat Modeling as a Service", "url": "https://cisomarketplace.services/services/threat-modeling-as-a-service", "md_url": "https://cisomarketplace.services/services/threat-modeling-as-a-service.md", "practice": "AI Security", "category_group": "Cloud & AppSec", "description": "Threat modelling finds design flaws before they are built, which is cheaper than finding them in a pentest. Per application or major feature, we run facilitated sessions with your engineers, produce data-flow diagrams and a STRIDE-based threat register, rate the risks, and hand back mitigations as backlog-ready stories. AI-assisted diagramming keeps it fast; a security architect keeps it right.", "from_price_usd": 6500, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Threat Model", "price_usd": 6500, "description": "One application or major feature: two facilitated sessions, data-flow diagrams, a STRIDE threat register and a mitigation backlog. Limit key 'web_apps' = applications modelled.", "includes": [], "excludes": [], "limits": { "web_apps": 1 } }, { "id": "advanced", "name": "Advanced Threat Model", "price_usd": 12500, "description": "One complex application or up to three services: adds abuse cases, cloud trust-boundary analysis and a re-review", "includes": [], "excludes": [], "limits": { "web_apps": 3 } }, { "id": "enterprise", "name": "Enterprise Threat Modeling Program", "price_usd": 24000, "description": "Up to eight applications: adds a reusable threat library, engineer training and quarterly re-reviews", "includes": [], "excludes": [], "limits": { "web_apps": 8 } } ], "scope": [ "Architecture and data-flow discovery", "Facilitated threat-modelling sessions with engineers", "STRIDE-based threat register with risk ratings", "Mitigations written as backlog-ready stories", "Re-review after design changes" ], "deliverables": [ "Data-flow diagrams", "Threat register", "Prioritized mitigation backlog", "Design review summary for auditors and customers" ], "scope_url": "https://cisomarketplace.services/scope?service=threat-modeling-as-a-service" }, { "slug": "vehicle-security-assessment", "title": "Vehicle Security Assessment", "url": "https://cisomarketplace.services/services/vehicle-security-assessment", "md_url": "https://cisomarketplace.services/services/vehicle-security-assessment.md", "practice": "Offensive Security", "category_group": "Specialized", "description": "Comprehensive security assessment of modern vehicles, including CAN bus analysis, telematics systems, and connected car features.", "from_price_usd": 28000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Core Vehicle Security Assessment", "price_usd": 28000, "description": "Essential vehicle security covering basic CAN bus analysis, telematics testing, and fundamental wireless security", "includes": [], "excludes": [], "limits": {} }, { "id": "advanced", "name": "Advanced Vehicle Security Program", "price_usd": 48000, "description": "Comprehensive assessment including detailed ECU analysis, advanced key fob testing, and complete mobile app security", "includes": [], "excludes": [], "limits": {} }, { "id": "premium", "name": "Enterprise Vehicle Security Solution", "price_usd": 75000, "description": "Full-scope vehicle security with custom testing tools, advanced protocol analysis, and complete telematics protection", "includes": [], "excludes": [], "limits": {} } ], "scope": [ "CAN bus security analysis", "Telematics system testing", "Bluetooth/WiFi interface assessment", "Mobile app security review", "Key fob security testing", "OBD-II port security", "ECU security assessment" ], "deliverables": [ "Vehicle security report", "CAN bus vulnerability analysis", "Wireless security findings", "Mobile app security review", "Key fob security recommendations", "ECU security guidance", "90-day follow-up assessment" ], "scope_url": "https://cisomarketplace.services/scope?service=vehicle-security-assessment" }, { "slug": "vendor-third-party-risk-assessment", "title": "Vendor & Third-Party Security Risk Assessment", "url": "https://cisomarketplace.services/services/vendor-third-party-risk-assessment", "md_url": "https://cisomarketplace.services/services/vendor-third-party-risk-assessment.md", "practice": "Compliance & GRC", "category_group": "Compliance & GRC", "description": "Comprehensive evaluation of your organization's third-party risk management program and vendor security assessment practices. Our assessment examines your vendor security evaluation processes, contractual security requirements, ongoing monitoring capabilities, and supply chain security controls to identify vulnerabilities in your extended enterprise and provide a roadmap for enhanced third-party risk management.", "from_price_usd": 38000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Third-Party Risk Assessment", "price_usd": 38000, "description": "Program review for a vendor inventory of up to 100. Assesses methodology, risk tiering, questionnaires, contract security terms and vendor access management, sampling up to 5 completed vendor assessments. Program assessment report and roadmap.", "includes": [ "TPRM methodology and governance review", "Risk tiering evaluation", "Questionnaire and contract security requirements review", "Sample review of up to 5 completed vendor assessments", "Program assessment report and roadmap" ], "excludes": [ "Building a new assessment methodology or tiering model", "Continuous monitoring strategy", "Assessing individual vendors on the client's behalf", "Fourth-party and supply chain analysis" ], "limits": { "vendors": 100 } }, { "id": "advanced", "name": "Comprehensive Vendor Security Program", "price_usd": 70000, "description": "Vendor inventory of up to 500, sampling up to 15 assessments. We build the risk-based assessment methodology, tiering model, contract security requirements template, continuous monitoring strategy, critical vendor playbook and vendor incident response procedures.", "includes": [ "Everything in the program review tier", "Risk-based assessment methodology written", "Vendor tiering model", "Contract security requirements template", "Continuous monitoring strategy and vendor incident procedures" ], "excludes": [ "Custom assessment tooling", "Supply chain risk quantification", "Rollout support and training", "Performing vendor assessments or onsite vendor audits" ], "limits": { "vendors": 500 } }, { "id": "enterprise", "name": "Enterprise Supply Chain Security Framework", "price_usd": 110000, "description": "Vendor inventory of up to 2,500, sampling up to 30 assessments. Adds supply chain attack surface and fourth-party analysis, risk quantification for the top 25 critical vendors, custom questionnaires and scoring workbooks, and rollout support with the vendor management team.", "includes": [ "Everything in the advanced tier", "Supply chain and fourth-party risk analysis", "Risk quantification for up to 25 critical vendors", "Custom questionnaires and scoring workbooks", "Implementation support and team training" ], "excludes": [ "Onsite audits of individual vendors", "Operating the vendor assessment queue as a managed service", "TPRM platform licences", "Inventories above 2,500 vendors (scoped separately)" ], "limits": { "vendors": 2500 } } ], "scope": [ "Vendor security assessment methodology review", "Third-party risk tiering evaluation", "Supply chain attack surface analysis", "Vendor security questionnaire assessment", "Third-party contract security requirements", "Vendor access management review", "Vendor incident response coordination", "Continuous monitoring capabilities", "Fourth-party risk visibility", "Cloud service provider security assessment", "Strategic vendor security oversight", "Third-party risk governance" ], "deliverables": [ "Third-party risk program assessment report", "Vendor security framework recommendations", "Risk-based assessment methodology", "Vendor tiering model", "Contract security requirements template", "Continuous monitoring strategy", "Supply chain risk mitigation plan", "Critical vendor management playbook", "Vendor incident response procedures", "Implementation roadmap and timeline" ], "scope_url": "https://cisomarketplace.services/scope?service=vendor-third-party-risk-assessment" }, { "slug": "vulnerability-management-maturity-assessment", "title": "Vulnerability Management Maturity Assessment", "url": "https://cisomarketplace.services/services/vulnerability-management-maturity-assessment", "md_url": "https://cisomarketplace.services/services/vulnerability-management-maturity-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Comprehensive evaluation of your organization's vulnerability management program maturity, effectiveness, and integration with security operations. Our assessment examines scanning coverage, patch management processes, risk-based prioritization, and remediation workflows to identify program gaps and provide a roadmap for enhanced vulnerability risk reduction.", "from_price_usd": 34000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Vulnerability Program Assessment", "price_usd": 34000, "description": "Maturity assessment of a vulnerability management program covering up to 1,000 assets.", "includes": [ "Process and tooling review", "Maturity score", "Roadmap" ], "excludes": [ "Running the scans for you" ], "limits": { "devices": 1000, "locations": 2 } }, { "id": "advanced", "name": "Advanced Vulnerability Management Program", "price_usd": 60000, "description": "Up to 5,000 assets, including cloud, with SLA and metrics design.", "includes": [ "Cloud coverage", "SLA and metrics design" ], "excludes": [ "Tool implementation" ], "limits": { "devices": 5000, "locations": 5 } }, { "id": "enterprise", "name": "Enterprise Vulnerability Program Transformation", "price_usd": 90000, "description": "Up to 25,000 assets across business units, with an operating model and tooling selection.", "includes": [ "Operating model", "Tooling selection support" ], "excludes": [ "Ongoing operation — see Vulnerability Management as a Service" ], "limits": { "devices": 25000, "locations": 15 } } ], "scope": [ "Vulnerability scanning coverage assessment", "Patch management process evaluation", "Vulnerability prioritization methodology review", "Remediation workflow assessment", "Mean time to remediate analysis", "Vulnerability tracking process evaluation", "Risk acceptance process review", "False positive management assessment", "Asset inventory completeness evaluation", "Vulnerability management governance", "Tool effectiveness assessment", "Integration with development workflows" ], "deliverables": [ "Vulnerability management maturity report", "Program gap analysis", "Scanning coverage recommendations", "Prioritization framework optimization", "Remediation process enhancements", "MTTR improvement strategy", "Governance model recommendations", "Tool optimization guidance", "DevSecOps integration roadmap", "Metrics and KPI framework", "Implementation timeline" ], "scope_url": "https://cisomarketplace.services/scope?service=vulnerability-management-maturity-assessment" }, { "slug": "web-application-security-assessment", "title": "Web Application Security Assessment", "url": "https://cisomarketplace.services/services/web-application-security-assessment", "md_url": "https://cisomarketplace.services/services/web-application-security-assessment.md", "practice": "Offensive Security", "category_group": "Cloud & AppSec", "description": "In-depth testing of web applications for security vulnerabilities", "from_price_usd": 8000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Basic Web App Assessment", "price_usd": 8000, "description": "Grey-box penetration test of 1 web application with up to 2 user roles: authenticated and unauthenticated testing against common web vulnerability classes, manual validation of findings. No separate API testing. One retest.", "includes": [ "1 web application, up to 2 user roles", "Authenticated and unauthenticated testing", "Manual validation of scanner findings", "Vulnerability report with fixes", "One retest of fixed findings" ], "excludes": [ "Dedicated API testing", "Source code review", "More than 2 user roles", "Ongoing scanning after the test" ], "limits": { "web_apps": 1 } }, { "id": "advanced", "name": "Advanced Web App Assessment", "price_usd": 15000, "description": "Penetration test of 1 web application with up to 5 user roles plus 1 API (up to 50 endpoints): business logic and access-control testing across roles, API authz testing, dependency analysis. One retest.", "includes": [ "1 web application, up to 5 user roles", "1 API, up to 50 endpoints", "Business logic and cross-role access control testing", "Dependency analysis", "One retest of fixed findings" ], "excludes": [ "Additional applications", "Ongoing scanning after the test", "Source code review", "CI/CD SAST/DAST integration" ], "limits": { "web_apps": 1, "apis": 1 } }, { "id": "premium", "name": "Premium Web App Assessment", "price_usd": 25000, "description": "Full-scope web application testing with continuous monitoring", "includes": [], "excludes": [ "Full manual re-test each month", "Mobile app testing", "Fixing the code", "Infrastructure/network penetration testing" ], "limits": { "web_apps": 2, "apis": 3 } } ], "scope": [ "Authenticated testing by user role against OWASP ASVS and the OWASP Top 10", "Authentication, session management and access-control testing", "Input handling and injection testing", "Business-logic abuse cases", "API endpoints used by the application", "Configuration, headers and transport security review" ], "deliverables": [ "Web application security report with reproducible findings", "Risk-rated findings mapped to OWASP ASVS", "Developer remediation guidance", "Executive summary", "Retest of fixed findings" ], "scope_url": "https://cisomarketplace.services/scope?service=web-application-security-assessment" }, { "slug": "wireless-network-assessment", "title": "Wireless Network Assessment", "url": "https://cisomarketplace.services/services/wireless-network-assessment", "md_url": "https://cisomarketplace.services/services/wireless-network-assessment.md", "practice": "Offensive Security", "category_group": "Offensive Security", "description": "Evaluate the security of your wireless infrastructure through comprehensive onsite testing", "from_price_usd": 8000, "price_cadence": "engagement", "tiers": [ { "id": "basic", "name": "Essential Wireless Assessment", "price_usd": 8000, "description": "Wireless assessment of one office: up to 5 networks (SSIDs).", "includes": [ "One office", "Configuration and coverage review", "Findings report" ], "excludes": [ "More than one site", "Non-WiFi radio protocols" ], "limits": { "locations": 1, "devices": 5 } }, { "id": "advanced", "name": "Advanced Wireless Assessment", "price_usd": 15000, "description": "Up to 3 sites and 15 networks, including guest and IoT segmentation checks.", "includes": [ "Up to three sites", "Segmentation checks" ], "excludes": [ "Non-WiFi radio protocols" ], "limits": { "locations": 3, "devices": 15 } }, { "id": "premium", "name": "Enterprise Wireless Assessment", "price_usd": 25000, "description": "Campus or up to 6 sites and 40 networks, with a retest.", "includes": [ "Campus or multi-site", "One retest" ], "excludes": [ "Custom radio research — see Wireless Infrastructure Attack Assessment" ], "limits": { "locations": 6, "devices": 40 } } ], "scope": [ "Wireless Network Architecture Review", "Access Point Security Assessment", "Wireless Protocol Analysis", "Signal Coverage Mapping" ], "deliverables": [ "Network Security Report", "Coverage Analysis Maps", "Configuration Recommendations", "Security Improvement Plan" ], "scope_url": "https://cisomarketplace.services/scope?service=wireless-network-assessment" } ] }