Independent cybersecurity firm
Mojave reviews the controls that protect client information, explains the findings to management, and gives your MSP or internal IT team a plan they can act on.
Your IT provider can stay
Most professional firms already have someone managing Microsoft 365, endpoints, and backups. Mojave is hired alongside that team to look at whether the controls that matter are in place, and to put the findings in language a managing partner can use.
We work with professional organizations across the United States. Engagements are remote. You do not have to replace your MSP or internal IT team to start. What an independent cybersecurity assessment includes explains how that review differs from day-to-day managed IT.
If later work needs hands-on implementation, that is a separate scope. Your IT provider can also carry out the plan.
Services
Start with a defined review of the environment. Add a written security plan when the firm needs one. Use monthly advisory when you want help keeping the roadmap moving.
A defined review of the agreed environment
Identity, email, workspace configuration, endpoints, external exposure, backups, and incident preparedness. You receive severity-ranked findings, a risk register, a prioritized roadmap, and one briefing for management and the IT provider.
Larger or more complex environments are typically $12,500 to $18,000 after scoping.
Assessment detailsA written program for the practice
A Written Information Security Plan tailored to the firm, plus an incident-response plan and a tabletop. $3,500 to $4,500 when added to an assessment.
Plan detailsOptional support after the assessment
Remediation tracking, quarterly reviews, and bounded help with insurer or customer questionnaires. The initial term is six months. A retainer is not required to buy the assessment.
Retainer detailsHow it works
A written proposal sets the fee, the boundaries, and the completion date once the environment is known.
A 30-minute call confirms the organization, the systems in view, and whether a fixed assessment is the right starting point. You then receive a written scope and fee.
We inspect the sources named in the proposal, with your IT provider or internal team. Gaps in access are recorded rather than assumed safe.
Management and the IT provider receive the same briefing: what was observed, how serious it is, who should own the change, and a sensible order of work.
Your existing provider can implement the plan. Mojave can add a written security plan, track remediation, or quote engineering where a specialist is needed.
Common questions
Straight answers before you book a call.
Keep that relationship. Mojave is hired separately to review important controls, explain the findings to management, and give your MSP or internal IT team a prioritized plan. If later work needs a specialist, that is a separate scope.
No. The baseline reviews agreed evidence and configuration. It does not include exploitation, social engineering, or an attack simulation. If a contract or insurer later requires authorized penetration testing, that is a separate project with written rules of engagement.
No. The assessment is a complete engagement on its own. The Security Assurance Retainer is optional support after the assessment, if you want help keeping the roadmap moving.
We agree the environment and the evidence sources before work starts. That usually means administrator-assisted or read-only access to identity, email, and workspace settings, plus endpoint, backup, and policy evidence, and time with the people who own security and IT. If a source is unavailable, the report says so. Do not send passwords, client tax records, or security evidence through the website form.
The Security Baseline & Resilience Assessment produces findings ranked by severity, a risk register, a prioritized remediation roadmap with recommended owners and target dates, and an executive briefing for management and the IT provider. The written-plan engagement and the retainer have their own deliverables, described on those pages.
The assessment identifies what should change and who should own it. Your IT provider or internal team can carry out the plan. Mojave can track that work on a retainer, or quote hands-on engineering under a separate scope. Implementing every finding is not included in the assessment fee.
No. Mojave does not issue a certification, a CPA attestation, or a statutory audit opinion. A written plan describes how the firm manages security; it does not, by itself, prove that safeguards are operating. Insurance eligibility and claim payment are decisions for your insurer.
The prices shown describe a typical scope. User count is only one factor. Tenants, locations, and system complexity can change the fee. After the scoping call you receive a written proposal with the fee, the boundaries, and what we need from you. Work begins when that proposal is accepted. The proposal also sets the completion date once the delivery scope is known.
Tell us about the organization, the approximate size, and what prompted the inquiry. The call confirms whether a fixed assessment is the right starting point.