# Security Program Development

> From $5K · Advisory / vCISO · https://cisomarketplace.services/services/security-program-development

Build and mature your security program with expert guidance

## In scope

- Security Architecture Review
- Controls Assessment
- Risk Analysis
- Compliance Mapping
- Security Program Evaluation

## Deliverables

- Detailed Assessment Report
- Executive Summary
- Recommendations Document
- Implementation Roadmap
- Follow-up Consultation

## Tiers

### Core Security Program Development: $5K

Up to 20 consulting hours a month with 1 guidance session monthly: programme gap review, core policy set drafted from templates, and a prioritised plan for baseline controls with follow-up on progress.

Limits: hours 20, sessions 1

Includes:
- Up to 20 hours per month
- 1 guidance session per month
- Core policy set from templates
- Baseline controls plan
- Programme roadmap

Excludes:
- Security architecture design
- Mapping to a specific compliance framework
- Board reporting
- Hands-on tool implementation

### Advanced Security Program Development: $8.5K

Up to 40 consulting hours a month with weekly guidance sessions. Adds security architecture review and target design, adaptation of 1 control framework to the organisation, compliance mapping, risk analysis and a maintained risk register.

Limits: hours 40, sessions 4

Includes:
- Up to 40 hours per month
- Weekly guidance sessions
- Security architecture review and design
- 1 control framework adapted
- Compliance mapping
- Risk register

Excludes:
- Named dedicated consultant
- More than 1 framework
- Board presentations
- Hands-on tool implementation

### Enterprise Security Program Development: $15K

Up to 80 consulting hours a month with a named consultant and up to 8 sessions monthly. Adds implementation of up to 3 frameworks, programme metrics, a quarterly programme review with leadership and continuous roadmap updates.

Limits: hours 80, sessions 8

Includes:
- Up to 80 hours per month
- Named consultant
- Up to 3 frameworks implemented
- Programme metrics
- Quarterly leadership review
- Continuous roadmap updates

Excludes:
- Acting as the named CISO (see vCISO services)
- Hands-on engineering and tool deployment
- Audit or certification fees

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=security-program-development