Category 01
Retainers
by Company Size
Priced by headcount. Every retainer runs 12 months. Each one starts with an entry assessment or the 30-day setup.
| Package | What's Included | Pricing | |
|---|---|---|---|
| STEADY (12-month minimum) |
4 core policies maintained, quarterly remote check-in, annual security awareness training, email support. Built for small teams that need a standing compliance contact. | 1–9 employees | $299/month Entry: Risk Snapshot $995 |
| RESILIENT (12-month minimum) |
Compliance audit (CLAS audit tool + onsite review), 6-policy core set, two semi-annual onsite check-ins (90 min each), M365 hardening guidance, risk register with remediation roadmap. 30-day initial setup included. | 10–24 employees Ongoing compliance |
$695/month · $8,340/year Entry: CLARITY lite $1,495 (50% credit on upgrade) |
| VANGUARD (12-month minimum) |
Everything in Resilient, plus 8-policy set, semi-annual onsite check-ins, 2–4 hours/month advisory call, policy upkeep. | 25–49 employees Growing practices and firms |
$1,195/month Entry: CLARITY $2,995 |
| SOVEREIGN (12-month minimum) Full Partnership |
Everything in Vanguard, plus 12-policy set with annual refresh, 8–12 fractional vCISO hours/month, quarterly onsite check-ins, regulatory monitoring. | 50–100 employees Full vCISO partnership |
$1,995/month · $23,940/year Entry: CLARITY $2,995 |
| Custom (Standalone) |
Organizations with 100+ employees or needs beyond Sovereign. Scoped after an assessment. | 100+ employees | Custom quote |
Retainer discounts on other services: Resilient −$500 · Vanguard −$1,000 · Sovereign −$1,500, applied to the AI Governance Framework, HIPAA Security Risk Analysis and ISO 27001 Gap Analysis. Resilient discounts can be paid in six $500 installments.
Second framework on a retainer: 30% off the standalone price, or the tier price, whichever is lower.
Second framework on a retainer: 30% off the standalone price, or the tier price, whichever is lower.
Category 02
AI Governance
& ISO 42001
| Service | What You Get | Pricing | |
|---|---|---|---|
|
AI Governance Framework
Most Requested
|
Governance framework for every AI tool your organization uses. Week 1 is an AI use audit: we inventory the AI tools staff already use and rate their risk, then the framework builds on that inventory. ChatGPT, Copilot, chatbots, scribes, decision support, scheduling AI. Includes AI risk register, AI vendor risk assessment, contract and BAA review for AI vendors, AI Acceptable Use Policy, staff training plan, and controls mapped to your obligations (HIPAA, GDPR, PCI DSS, ABA ethics rules). | ISO 42001 · NIST AI RMF · Regulatory crosswalk | From $3,500 Resilient $3,000 · Vanguard $2,500 · Sovereign $2,000 3–4 weeks |
| ISO 42001 Advisory Certification | Prepares your organization for ISO/IEC 42001 certification. Step 1 is an ISO 42001 gap assessment, included in the price, so you know where you stand before the build. Then: AI Management System (AIMS) build, impact assessment, governance documentation, and internal audit preparation. The certification body’s fee is separate. | ISO/IEC 42001 | From $8,500 4–8 weeks |
Category 03
Fractional vCISO
& vCAIO
| Service | What You Get | Pricing | |
|---|---|---|---|
| Fractional vCISO (Standalone) |
Custom-scope security leadership: strategy, board and client reporting, incident response oversight, vendor and policy governance. 6-month minimum. | Organizations that need security leadership beyond the retainer packages | Custom, scoped after assessment |
| Fractional vCAIO (Chief AI Officer, part-time) New |
Part-time AI leadership: AI tool approval, AI governance program ownership, AI vendor review, AI policy upkeep, staff AI training, leadership reporting. Advisory scope around 4 hours/month. | Firms adopting AI tools that need an accountable owner | From $2,500/month 6-month minimum |
Category 04
Compliance
Assessments
| Service | What You Get | Pricing | |
|---|---|---|---|
|
Risk Snapshot
Start Here
|
Audit tool, 30-minute onsite visit, and a 1-page priority matrix. For businesses of 1–9 employees. Delivered in 2–3 business days. | HIPAA · ISO 27001 · ISO 42001 | $995 one-time 2–3 days |
| CLARITY lite (10–24 employees) |
1-hour onsite visit, 4 core policies (HIPAA, ISO 27001 or ISO 42001), assessment report and remediation roadmap template. Not a formal SRA. Upgrading to Resilient within 30 days earns a 50% credit. | HIPAA · ISO 27001 · ISO 42001 | $1,495 one-time 4–5 days |
| CLARITY (25+ employees) |
Comprehensive assessment and first compliance binder: 2-hour onsite visit, 6 custom HIPAA policies, gap analysis, findings report, and remediation roadmap. Not a formal SRA. | HIPAA · ISO 27001 · ISO 42001 | $2,995 one-time 4–5 days |
| HIPAA Security Risk Analysis | Comprehensive evaluation of administrative, physical, and technical safeguards. Meets OCR's required Security Risk Analysis standard. Includes SRA spreadsheet and written report. | HIPAA (45 CFR §164.308) | From $3,500 Resilient $3,000 · Vanguard $2,500 · Sovereign $2,000 2–3 weeks |
| ISO 27001 Gap Analysis | Assessment of your current information security posture against ISO 27001:2022 controls. Step 1 of the ISO 27001 certification path, sold separately so you can decide whether to proceed before committing to implementation. Produces a gap register, risk treatment plan, and implementation roadmap. | ISO 27001:2022 | From $4,500 standalone Resilient $4,000 · Vanguard $3,500 · Sovereign $3,000 3–4 weeks |
Category 05
Policy & Governance
Documentation
| Service | What You Get | Pricing | |
|---|---|---|---|
| HIPAA Core Policy Library (6-Policy Set) |
Privacy Policy, Security Policy, Breach Notification Policy, Sanctions Policy, Device & Media Controls Policy, and Workforce Security Policy. Each policy is authored for your organization. | CLARITY (25+) · Resilient | Included |
| HIPAA Extended Policy Set (8-Policy Set) |
Core 6 plus Incident Response Plan and BAA Management Policy. All policies are version-controlled, signed, and reviewed annually. | Vanguard | Included |
| HIPAA 12-Policy Full Library | Extended set adds Third-Party Risk Management, Remote Work & BYOD, AI Acceptable Use, and Data Retention & Disposal. Annual refresh. | Sovereign | Included |
| Data Protection Impact Assessment (DPIA) |
Structured assessment for new data processing activities, vendor onboarding, or system changes. Covers data flows, risk identification, and mitigation controls. | Standalone | Quoted per scope |
Category 06
Security Hardening
& Add-ons
| Service | What You Get | Pricing | |
|---|---|---|---|
| M365 Security Hardening Guidance Document |
Written hardening guidance for your Microsoft 365 tenant: MFA, conditional access, sharing, and audit logging. Governance documentation; your IT provider implements the changes. | Microsoft 365 | Included in Resilient and above Standalone quoted per tenant |
| Apple Ecosystem Security Specialty |
Security assessment of Apple device usage across your practice or firm, led by Frederic Saraiva, Apple certified in software and hardware and an Apple certified instructor. Covers macOS hardening, MDM enrollment readiness, FileVault encryption, iCloud and Apple account security, and written governance documentation. | macOS · iOS · iPadOS | Quoted per fleet Add-on to any package |
| Security Awareness Training (Annual Program) |
Annual HIPAA security awareness training for your staff. Includes phishing awareness, password hygiene, device security, and incident reporting. | All staff | $1,200/year |
| Vendor Risk Assessment (BAA Review) Add-on only |
Review of your Business Associate Agreements and third-party vendor risk posture. Identifies missing BAAs, insufficient contractual protections, and high-risk vendors. | Third-party vendors | Quoted per vendor list |
Pricing in Context
What This Costs
vs. What Non-Compliance Costs
| Item | Penalty or Cost | |
|---|---|---|
| HIPAA violation, lack of knowledge | $145 to $36,505.50 per violation; annual cap $36,505.50 | HHS, eff. Jan 28, 2026 |
| HIPAA violation, reasonable cause | $1,461 to $73,011 per violation; annual cap $146,053 | HHS, eff. Jan 28, 2026 |
| HIPAA violation, willful neglect not corrected | $73,011 to $2,190,294 per violation; annual cap $2,190,294 | HHS, eff. Jan 28, 2026 |
About the “Market” Ranges
Market ranges are typical prices published in 2026 industry pricing guides, shown so you can compare. They are not quotes from specific competitors, and your CLAS price depends on scope. Sources: One Guy Consulting (HIPAA SRA) · Accountable (annual HIPAA upkeep) · Compass IT (vCISO) · CertBetter (ISO 42001) · HIPAA Journal (2026 HHS penalty tiers).