Las Vegas cybersecurity firm
Mojave Corp assesses the controls that protect client information, gives management a prioritized plan, and coordinates the work with the IT provider you already have.
Your IT provider can stay
Mojave assesses important controls, explains the findings to management, and helps coordinate remediation. You do not have to replace your MSP or internal IT team to start.
Mojave Corp is a Las Vegas cybersecurity firm for professional organizations. Most of those firms already have someone managing Microsoft 365, endpoints, and backups. That relationship can continue. What is often missing is a separate look at whether the controls that matter are actually in place, written so a managing partner can use it. What an independent cybersecurity assessment includes explains the difference.
Independent, here, means Mojave is engaged apart from the managed-IT contract. It does not mean a CPA attestation, a statutory audit opinion, or an accredited certification.
If specialist implementation is needed later, that work is a separate scope. Your IT provider can also carry out the plan.
First engagement
The first project for most firms. A defined review of the agreed environment, with findings management and the IT provider can act on.
Agreed scope, in business language
A package you can brief and assign
Reviewing evidence is not the same as exhaustively testing every control. The report states what was inspected and what was unavailable.
Confirmed in a written proposal
Larger or more complex environments are typically $12,500 to $18,000 after scoping. User count alone does not set the fee. Multiple tenants, locations, or systems change the scope.
See the full scopeWays to engage
Start with the assessment. Add a written plan when the firm needs one. Use ongoing advisory when the first project shows it is justified.
Findings, a risk register, a prioritized plan, and one briefing for management and the IT provider.
Assessment detailsA Written Information Security Plan tailored to the practice, plus an incident-response plan and a tabletop. $3,500 to $4,500 when added to an assessment.
Plan detailsOptional follow-on support after an assessment. Remediation tracking, quarterly reviews, and bounded questionnaire help. A retainer is not required to buy the assessment.
Retainer detailsHow an engagement runs
The proposal sets the completion date once the environment is known.
A 30-minute scoping call confirms the organization, the systems in view, and whether a fixed assessment is the right first project. You then receive a written scope and fee.
We inspect the sources named in the proposal, with your IT provider or internal team. Gaps in access are recorded. We do not expand into exploitation or unrelated systems.
Management and the IT provider receive the same briefing: what was observed, how serious it is, who should own the change, and a sensible order of work.
Your existing provider can implement the plan. Mojave can add a written security plan, track remediation, or quote engineering where a specialist is actually needed.
Purchasing questions
Straight answers about scope, price, and what this engagement is.
You can keep that relationship. Mojave is engaged separately to assess important controls, explain the findings to management, and hand your MSP or internal IT team a prioritized plan. Where a specialist gap remains, implementation help is available under its own scope.
The baseline reviews agreed evidence and configuration. It does not include exploitation, social engineering, or an attack simulation. Authorized penetration testing is considered only when a client requirement justifies it, under written rules of engagement and a qualified delivery arrangement.
No. The assessment is a complete first engagement. The Security Assurance Retainer is optional follow-on support after an assessment.
We agree the environment and the evidence sources before work starts. That usually means administrator-assisted or read-only access to identity, email, and workspace settings, plus endpoint, backup, and policy evidence, and time with the people who own security and IT. If a source is unavailable, the report says so. Do not send passwords, client tax records, or security evidence through the website form.
The Security Baseline & Resilience Assessment produces evidence-backed findings ranked by severity, a structured risk register, a prioritized remediation roadmap with recommended owners and target dates, and an executive briefing for management and the IT provider. The written-plan engagement and the retainer have their own deliverables, described on those pages.
The assessment identifies what should change and who should own it. Your IT provider or internal team can carry out the plan. Mojave can track that work on a retainer, or provide hands-on engineering under a separate scope. The assessment fee does not include implementing every finding.
No. Mojave does not issue a certification, a CPA attestation, or a statutory audit opinion. A written plan does not, by itself, establish that safeguards are operating or that a regulation has been met. Insurance eligibility and claim payment are decisions for your insurer.
The prices shown describe a typical scope. User count is only one factor. Tenants, locations, and system complexity can change the price. After the scoping call you receive a written proposal with the fee, the boundaries, and what we need from you. Work begins when that proposal is accepted. A completion date is set in that proposal, after the delivery scope is known.
Tell us the organization, the approximate size, and why you are looking now. The call confirms whether a fixed assessment is the right first project. It is not a free technical assessment, and it is not an incident hotline.