How engagements work
We do not sell tiered packages
Compliance work is shaped by your scope, your starting posture, and your timeline. A fixed price list would either over-charge half our clients or under-deliver for the other half. Instead, we scope each engagement to the actual work and price it on what it takes to do correctly.
The engagement shapes we run
Four ways we structure work
Pricing model fits the work, not the other way around
A CMMC readiness assessment is a different shape of work than ongoing security operations or a multi-month GCC High migration. The pricing model follows the shape, which is why you will see four different commercial structures across our service lines.
Discovery and assessment (fixed scope)
A bounded engagement with a defined deliverable. CMMC readiness gap assessments, M365 tenant audits, GCC High eligibility reviews. Typically two to six weeks, fixed price.
Implementation projects (fixed scope, milestone billing)
Defined-outcome engagements like a GCC High migration, a CMMC control implementation, or an M365 tenant stand-up. Scoped against the deliverable, billed against milestones.
Ongoing operations (monthly retainer)
Day-to-day Microsoft 365 Security & Compliance Operations work. Fixed monthly fee scoped to your tenant size, control posture, and reporting cadence.
Advisory (hours block or fractional)
vCISO and compliance advisory engagements. Hours-block format for episodic work, fractional CISO format for committed monthly leadership coverage.
How we get from a first call to a signed statement of work
1. Discovery call (no charge)
A 30 to 60 minute working conversation. We learn about your contract obligations, your current environment, your timeline, and the outcome you actually need. You leave the call with a clear sense of whether Verasor is the right firm for the work, regardless of whether you engage us.
2. Scoping conversation
For most service lines, we schedule a deeper scoping conversation. We dig into the specifics, identify the unknowns, and outline the engagement shape that fits.
3. Statement of work
Written SOW covering scope, deliverables, timeline, pricing, assumptions, and escalation paths. No buried clauses. No marketing language pretending to be commitments.
4. Kickoff and engagement
Once the SOW is signed, we schedule a kickoff with the named engagement team. The senior architects you met during scoping are the same architects delivering the work.
Common questions about how we work
Do you publish a price list?
No, and we are unlikely to. Compliance work is too variable. A CMMC readiness assessment for a 25-person shop is a fundamentally different engagement than one for a 250-person operation. We commit to transparent, written scoping instead.
Do you offer fixed price?
Yes, for discovery, assessment, and implementation engagements with well-defined scope. Once we have done the scoping work, we can price the engagement as a fixed number with a clear deliverable.
Do you bill hourly?
Only for advisory work and out-of-scope additions. Our default is fixed-scope, fixed-price or monthly retainer. Hourly billing tends to create perverse incentives.
How quickly can you start?
Most discovery and assessment engagements can start within two to four weeks of a signed SOW. Larger implementation engagements and GCC High migrations have longer lead times. We will tell you a realistic start date during scoping.
Will you sign a non-disclosure agreement before the discovery call?
Yes. Send your standard NDA and we will execute it before the call. We expect to discuss sensitive contract and environment information.
Do you require long-term contracts?
No. Project engagements end with the deliverable. Retainer engagements roll month to month with a defined termination notice. We earn the engagement by delivering value, not by locking you in.
Tell us what you are trying to accomplish.
The first conversation is the most useful one. Bring your contract clauses, your assessment timeline, or whatever you have. We will help you figure out the right shape of engagement, even if it is not with us.