Good questions.
Clear answers.

We help growing businesses understand security risks, create practical security policies and response materials, and get expert help with security decisions and assignments. Our offerings include Security Assessment, Security Readiness Program, GuardVest 360, ClearSight source-code review, SOC 2 Readiness, CMMC Self-Attestation Readiness, FedRAMP Readiness, consultations and focused projects.

No. Our services are designed for businesses that may not have a dedicated security leader. If you already have technical or security staff, our findings, documents and guidance give them a practical basis for deciding what to do next.

Choose Security Assessment if you need to understand your gaps and priorities. Choose Security Readiness Program if you also need tailored documents, a source-code scan, a response rehearsal and service recommendations. Choose GuardVest 360 if you want that foundation plus continuing support. Choose ClearSight for a source-code review, SOC 2 Readiness for a Type I or Type II examination, CMMC Self-Attestation Readiness for defense-contracting requirements, or FedRAMP Readiness for federal cloud opportunities. For one question, choose Ask GuardVest; for a defined work product, choose a Single-Purpose Engagement.

No. The Security Readiness Program already includes the Security Assessment. GuardVest 360 includes the full Readiness foundation in its first three months. You do not need to purchase those included services separately.

Yes. You can begin with a smaller engagement and discuss a larger scope as your needs develop. Before you upgrade, we confirm the work already completed, the additional deliverables and the applicable upgrade price.

No. The free 30-minute scoping call helps us understand your priorities and identify an appropriate engagement. Ask GuardVest is a paid, one-hour minimum consultation for working through a specific security question or decision with an expert.

You receive an assessment report with documented findings and a response appendix, a prioritized 90-day action roadmap, and a leadership presentation and readout. The four-week engagement includes eight one-hour sessions covering 100 core questions about your business and security practices.

The Assessment identifies gaps and recommends actions; it does not include implementing every recommendation. Readiness adds specific deliverables such as tailored documents and a tabletop. Additional implementation or security assignments need to be included in your agreed scope.

No. It is a one-time vulnerability scan of an agreed source-code snapshot. You receive a vulnerability report and executive findings presentation covering evidence, priority, impact and recommended fixes for your engineers. It does not provide continuous monitoring or a broad penetration test of your live systems; rescans require separate scope.

We sign a mutual NDA covering the confidential information shared for the engagement, including your source code. The scan uses an agreed snapshot of your code, rather than ongoing repository access. We use our proprietary vulnerability scanners solely to identify weaknesses and prepare your agreed findings. We do not use the code for unrelated purposes, modify your source code or deploy changes to your systems. The NDA sets out our confidentiality and permitted-use obligations; it does not mean the scan guarantees that every vulnerability will be found.

Our experts create the policies, procedures and response materials for your organization, tailored to your business. They are delivered as PDFs with one revision round. The full document list appears on the Readiness and GuardVest 360 pages. Editable source files are not included.

It is a 60-minute facilitated rehearsal of a hypothetical security incident. Your team discusses how it would respond, communicate and make decisions. You receive a written exercise summary and action log. It is a rehearsal, rather than a live attack or an investigation into an actual incident.

No. We assess what additional external security services your business may need and categorize them as needed now, able to wait, or not currently needed. You receive prioritized recommendations and a management report explaining the rationale. Purchasing or operating those services is separate from receiving the recommendations.

Readiness turns requirements into a defined scope, documented controls, organized evidence and prioritized actions. We prepare your team for customer reviews and the applicable assessment process. Official assessment, certification and authorization decisions follow the requirements of the selected program.

Month 1 is the Security Assessment. Month 2 adds the one-time source-code scan, 17 tailored documents and incident tabletop. Month 3 covers external security service recommendations. Months 4–6 provide up to 60 additional support hours, allocated as 20 hours per month, for advice, agreed assignments and reporting.

No. The additional 60-hour allowance applies to Months 4, 5 and 6, at 20 hours per month. The foundation deliverables in Months 1–3 are separate. Two one-hour calls each month and written advice between calls are included throughout the six-month engagement.

In Months 4–6, the two monthly one-hour calls, written advice, agreed security work and reporting all share the 20-hour monthly allowance. Written advice means you can send security questions between scheduled calls; the initial written response is within two business days, which is not a promise that every question will be fully resolved in that time.

Yes. We agree on assignments around your business needs and available capacity. Examples include customer questionnaires, policy updates, vendor reviews and custom security reports. These are examples, not a complete list. Work needs to fit the agreed scope and monthly allowance; additional work requires a separate agreement.

No. Unused hours from each 20-hour allocation in Months 4–6 do not roll over. This differs from Single-Purpose Engagements, where unused prepaid hours never expire.

GuardVest 360 includes six monthly scorecards, board reports in Months 3 and 6, and one live board or investor briefing during Months 4–6. These help leadership understand progress, remaining risks and the decisions that need attention.

Ask GuardVest is live expert advice at $250 per hour, prepaid, with a one-hour minimum. A Single-Purpose Engagement is scoped work that produces an agreed deliverable, using prepaid hours with pricing confirmed for your engagement. If you need us to complete a questionnaire or write a policy, choose a scoped project rather than assuming that work comes with a consultation.

Ask GuardVest provides a live consultation to discuss your situation, evaluate options and clarify next steps. A separate written report, investigation or completed work product is not included in the consultation; those can be discussed as a Single-Purpose Engagement.

The initial prepaid balance provides 10 hours. It is a prepaid balance, not a flat price for any size of project. We agree on the assignment and deliverable before starting, and actual time worked draws down the balance. Additional time requires additional funding.

Yes. You can use the balance for one assignment or several scoped assignments. Unused prepaid Single-Purpose hours never expire. The examples on the service page are illustrative; we can discuss other security work your business needs.

Ask GuardVest requires payment to confirm the consultation booking. For other engagements, confirm the scope and agreement with GuardVest before paying. Work begins after the required advance payment has cleared, unless we agree otherwise with you in writing. Making a payment alone does not define a project’s scope or start date.

We help prepare the safeguards, documentation, evidence and leadership review behind CMMC Level 1 and Level 2 self-assessment and affirmation. Your contract and information flows determine the applicable scope and path.

We scope readiness across Classes A, B, C and D through the applicable 20x or Rev5 path, including DoD cloud requirements, IRS Publication 1075 safeguards and other agency-specific overlays.

CMMC concerns the defense-contracting environment handling FCI or CUI. FedRAMP concerns a cloud service offering used by federal agencies. A company delivering a cloud product while performing defense contracts may need coordinated preparation for both.

Yes. We review your current scope and evidence, identify reusable work and map the additional requirements for the selected CMMC or FedRAMP path.

Yes. We can scope continuing evidence reviews, remediation tracking, change assessments and preparation for recurring affirmations or monitoring obligations.