How engagements work
We do not sell tiered packages
The work is shaped by your scope, your starting posture, and your timeline, whether that is a compliance deadline, a security test, or an infrastructure project. A fixed price list would either over-charge half our clients or under-deliver for the other half. Instead, we scope each engagement to the actual work and price it on what it takes to do correctly.
Pricing model fits the work, not the other way around
A CMMC readiness assessment is a different kind of work than a penetration test, an Active Directory health check, or a multi-month GCC High migration, and the pricing model follows that difference. That is why you will see four different commercial structures across our service lines.
Discovery and assessment (fixed scope)
A bounded engagement with a defined deliverable. CMMC readiness gap assessments, M365 tenant audits, Active Directory health checks, GCC High eligibility reviews, and vulnerability scans. Typically two to six weeks, fixed price.
Implementation projects (fixed scope, milestone billing)
Defined-outcome engagements like a GCC High migration, a CMMC control implementation, an Active Directory deployment, a penetration test, or a custom application build. Scoped against the deliverable, billed against milestones.
Ongoing operations (monthly retainer)
Day-to-day Microsoft 365 Security & Compliance Operations work, or standing server and Active Directory administration. Fixed monthly fee scoped to your environment size, control posture, and reporting cadence.
Advisory (hours block or fractional)
vCISO and compliance advisory engagements. Hours-block format for episodic work, fractional CISO format for committed monthly leadership coverage.
How we get from a first call to a signed statement of work
1. Discovery call (no charge)
A 30 to 60 minute working conversation. We learn about your contract obligations, your current environment, your timeline, and the outcome you actually need. You leave the call with a clear sense of whether Verasor is the right firm for the work, regardless of whether you engage us.
2. Scoping conversation
For most service lines, we schedule a deeper scoping conversation. We dig into the specifics, identify the unknowns, and outline which engagement structure fits.
3. Statement of work
Written SOW covering scope, deliverables, timeline, pricing, assumptions, and escalation paths. No buried clauses. No marketing language pretending to be commitments.
4. Kickoff and engagement
Once the SOW is signed, we schedule a kickoff with the named engagement team. The senior architects you met during scoping are the same architects delivering the work.
Common questions about how we work
Do you publish a price list?
No, and we are unlikely to. A CMMC readiness assessment, a penetration test, and an Active Directory health check are three different kinds of engagement before you even factor in the size of the organization. We commit to transparent, written scoping instead.
Do you offer fixed price?
Yes, for discovery, assessment, and implementation engagements with well-defined scope. Once we have done the scoping work, we can price the engagement as a fixed number with a clear deliverable.
Do you bill hourly?
Only for advisory work and out-of-scope additions. Our default is fixed-scope, fixed-price or monthly retainer. Hourly billing rewards time spent over outcomes delivered.
How quickly can you start?
Most discovery and assessment engagements can start within two to four weeks of a signed SOW. Larger implementation engagements and GCC High migrations have longer lead times. We will tell you a realistic start date during scoping.
Will you sign a non-disclosure agreement before the discovery call?
Yes. Send your standard NDA and we will execute it before the call. We expect to discuss sensitive contract and environment information.
Do you require long-term contracts?
No. Project engagements end with the deliverable. Retainer engagements roll month to month with a defined termination notice. We earn the engagement by delivering value, not by locking you in.
Tell us what you are trying to accomplish.
The first conversation is the most useful one. Bring your contract clauses, your assessment timeline, or whatever you have. We will help you figure out the right engagement structure, even if it is not with us.