Terms & Conditions

• A live interview, usually 60 to 90 minutes, by phone or video. I fill in the questionnaire as we talk.
• A written security risk assessment report with findings rated Critical, High, Medium or Low.
• A custom written information security plan (WISP) written from your answers.
• A vendor compliance check for the vendors you name, based on what each vendor publishes about its own security.
• An implementation guide with prioritized actions.
• A walkthrough of the results, and one round of revisions requested within 14 days of delivery.
• Delivery by encrypted email within five business days of the interview.
• An annual review on request after delivery. Ask me and I’ll schedule it.

The package price covers all of this. The assessment alone costs the same.

• Legal advice. I’m an information security consultant, not a lawyer. For questions about your legal obligations, talk to a qualified attorney.
• A guarantee or certification of compliance. The report and plan are my professional assessment based on what you tell me. They don’t certify that your firm meets any law, rule or standard, and they don’t guarantee against a security incident.
• Penetration testing or technical testing. I don’t scan, probe or test your systems.
• Hands-on IT work. I assess and advise. I don’t log into your systems, change settings or manage your IT.
• A full audit of your vendors. The vendor check reviews each vendor’s published security information and compares it with how you’ve set the service up. It is not an audit of the vendor.
• Carrying out the fixes. Putting the recommendations in place is up to your firm. I’m glad to answer questions as you work through them.

I work from how your firm operates: its tools, people, locations and vendors. I don’t need your clients’ information, and I ask you not to share it.

• Please don’t send or show client names, Social Security numbers, tax return data or other client records. If something like that appears on screen during a call, I’ll ask you to close it.
• I won’t ask for passwords or administrator access.
• I don’t record calls unless you agree in writing.
• I keep what you tell me confidential and use it only to deliver your work. I deliver reports by encrypted email.

• Risk assessment package: $500, a one-time launch price, paid in full before the interview. I send an invoice with the engagement agreement.
• Consulting: $50 per hour, billed in half-hour increments ($25 per half hour). We agree on scope and an estimate first, and I invoice before work starts.
• There is no subscription and nothing renews automatically.
• Larger or multi-location firms: ask me for a quote.

My work depends on what you tell me, so please answer as accurately as you can. “I don’t know” is a useful answer. Your firm is responsible for putting the recommendations in place, for keeping your plan current, and for deciding which risks to accept.

A new assessment is a good idea when your firm changes significantly: new staff, a new office or a move between virtual and physical, new software or vendors that hold client data, a security incident, a merger or new service line, or a change of security lead or IT provider.