Las Vegas headquartered. For professional firms that already have IT support.
An independent review of the agreed environment, with evidence-backed findings and a prioritized plan for management and the IT provider.
Leadership is being asked whether client or customer information is actually protected: by an insurer, a client, a partner, or their own concern after a phishing attempt. The IT provider may be capable. What is missing is an independent account of the controls that matter, written for a managing partner. This is a cybersecurity assessment of an agreed environment. It is not managed IT, and it is not penetration testing. What the assessment includes and how that differs from a penetration test are explained separately.
Professional organizations, especially CPA, accounting, and tax firms of roughly 15 to 100 employees, and similar firms that handle sensitive information and rely on an MSP or a small internal IT team. The assessment is also the right first project for many wealth and advisory firms. It is a poor fit for a company that wants a new help desk, a 24/7 monitoring contract, or a certification badge.
Some controls are observed in configuration. Others are accepted on evidence the client or IT provider supplies, such as a backup report or a policy. Those are different levels of assurance. The register states which is which. Mojave does not describe every control as exhaustively validated.
The baseline is not penetration testing, exploitation, social engineering, forensic investigation, continuous monitoring, implementation of all fixes, source-code review, or a compliance certification. It is not a legal opinion.
A named management contact, a named IT contact, agreement on the tenants and locations in scope, and timely access to the evidence sources in the proposal. If a source cannot be produced, the finding is marked unavailable rather than assumed safe.
The scoping call and a written proposal fix the environment, the fee, and the boundaries.
We inspect the agreed evidence and controls with the IT provider or internal team.
You receive the register, the roadmap, and the executive briefing.
Your team implements, or Mojave scopes written-plan work, oversight, or engineering separately.
Assessment questions
You can keep that relationship. Mojave is engaged separately to assess important controls, explain the findings to management, and hand your MSP or internal IT team a prioritized plan. Where a specialist gap remains, implementation help is available under its own scope.
Both happen, and they are not the same thing. We inspect agreed configuration and evidence, and we note where a control was only described rather than observed. We do not claim that every control was exhaustively validated. Findings say what was reviewed and what was unavailable.
No. Mojave does not issue a certification, a CPA attestation, or a statutory audit opinion. A written plan does not, by itself, establish that safeguards are operating or that a regulation has been met. Insurance eligibility and claim payment are decisions for your insurer.
The baseline reviews agreed evidence and configuration. It does not include exploitation, social engineering, or an attack simulation. Authorized penetration testing is considered only when a client requirement justifies it, under written rules of engagement and a qualified delivery arrangement.
The assessment identifies what should change and who should own it. Your IT provider or internal team can carry out the plan. Mojave can track that work on a retainer, or provide hands-on engineering under a separate scope. The assessment fee does not include implementing every finding.
The prices shown describe a typical scope. User count is only one factor. Tenants, locations, and system complexity can change the price. After the scoping call you receive a written proposal with the fee, the boundaries, and what we need from you. Work begins when that proposal is accepted. A completion date is set in that proposal, after the delivery scope is known.
The call is 30 minutes. If a fixed assessment is the right first project, you receive a written proposal. The call is not a free technical assessment.