Security Advisory Retainer in Las Vegas

When a retainer makes sense

A firm that has just received a risk register often needs someone to keep the list honest: what closed, what slipped, and what management should hear next quarter. That is what the retainer is for.

It is a poor fit as a cold purchase for a firm that has never had a defined review. If that is where you are, start with the Security Baseline & Resilience Assessment.

Included work

Remediation trackingThe roadmap stays current. Owners and dates are revisited with management and the IT provider.
Leadership consultationA monthly working session for the operating leader, not an open engineering queue.
Quarterly control reviewA bounded re-check of agreed controls, with a short management report.
Incident-plan maintenanceContacts, roles, and the plan stay aligned with how the firm actually operates.
Vulnerability follow-upPeriodic review of agreed scan or exposure results. This is not continuous monitoring.
QuestionnairesBounded help with insurer or customer security questionnaires, within the hours in the agreement.

Outside the monthly fee

Unlimited engineering, help desk tickets, 24/7 monitoring, unlimited incident response, legal advice, and any certification. Major implementation is a separate security-engineering scope.

Security engineering, separately scoped

When the roadmap needs hands-on work the MSP or internal team will not do, Mojave quotes that implementation as its own fixed project: identity hardening, Microsoft 365 or Google Workspace changes, backup and recovery improvements, and control configuration. The tasks and the fee are set in a separate statement of work after the findings are known.

Authorized penetration testing

Penetration testing is not part of the retainer and it is not the assessment. We consider it only when an insurer, a customer, or a contract creates a defined need, and only with written rules of engagement. It is a separate project, not something included here.

Commercial term

The fee is $2,500 to $4,000 per month. The initial term is six months. Both are written in the agreement before the retainer starts. Hour limits and questionnaire limits are written there, so "advisory" does not become unlimited labor.

What good looks like

A monthly action register, a quarterly management report, and a documented path for raising an issue that cannot wait until the next meeting. An active security incident is still escalated to the IT provider or an incident responder. The retainer coordinates a defined management response. It does not replace that responder.

Retainer questions

Limits, term, and incidents

Is a retainer required?

No. The assessment is a complete first engagement. The Security Assurance Retainer is optional follow-on support after an assessment.

Is there a minimum term?

The initial term is six months. The signed agreement is what binds the term, the monthly fee, and the hour limits. Those commercial terms are written down before work starts.

Will you implement the fixes?

The assessment identifies what should change and who should own it. Your IT provider or internal team can carry out the plan. Mojave can track that work on a retainer, or provide hands-on engineering under a separate scope. The assessment fee does not include implementing every finding.

What does the monthly fee include?

A defined amount of leadership consultation, remediation tracking, a quarterly control review, incident-plan maintenance, periodic vulnerability follow-up, and bounded help with insurer or customer security questionnaires. It does not include unlimited engineering, help desk coverage, 24/7 monitoring, or unlimited incident response.

If we have an active incident, is this the hotline?

No. Incident readiness means a plan, roles, and a tabletop before something happens. An active intrusion, fraud event, or outage should go to your IT provider or a retained incident responder. The retainer can help management coordinate a defined response. It is not a 24/7 security operations center.

Security Assurance Retainer