Start with your 90‑Day Blueprint
A prescription for your company. Our team reviews your technology and security, and every finding goes into a dated 90-day plan, scheduled as UT-Ops work or quoted as a project. You get the plan with dates and a fixed quote.
Other providers will quote you a rate. We hand you a plan with dates, and the quote comes from what we find in your company.
What you get
- A risk review with every gap ranked by risk, in plain language
- An environment and device check: how your company is set up, which devices meet the standard, the backup size you need for Microsoft 365 or Google, and what has to move
- A check for company passwords leaked online, and a scan of what an attacker sees from outside (a snapshot dated the day we ran it)
- Your cyber insurance renewal answers, drafted from what we found with weak answers flagged, for you to review and submit (ITFocus never signs them)
- A cut list of unused licenses and duplicate tools, with the monthly dollar total
- An automation map from 30-minute interviews with two or three of your people: your top three automations and the hours each would save (the what, not the how)
- A one-page security scorecard you can show your bank, insurer or board, and a one-page incident sheet with who to call
- Your dated 90-day plan and fixed quote, presented in a 60-minute readout with you and your leadership team
- 30 days of email follow-up with your vCISO on the findings
Delivered on the agreed date, 7 to 13 business days from access, or your full fee back.
Sign UT-Ops within 14 days of your leadership readout and the full fee counts toward your onboarding.
For companies with 15 or more seats. The owner or a decision-maker attends the readout.
A consultant-led security risk assessment alone typically costs $5,000 to $15,000. The Blueprint includes one, plus the scans, the insurance answers and your dated plan.
How delivery works
7 to 13 business days from access, depending on your setup: about 10 for most Microsoft 365 and Google companies, 13 for on-premises only, and 7 if you have no central IT.
- Day 1
Access and kickoff
A short kickoff call where we agree your delivery date. You give us admin access, and we book 30-minute interviews with two or three of your people.
- First days
Review and scans
We review your systems, security, devices, vendors and licenses, check for leaked company passwords, scan what an attacker sees from outside, and map where your team loses hours.
- Before the readout
Drafting the plan and answers
Every finding goes into your dated 90-day plan as UT-Ops work or a quoted project. We draft your insurance renewal answers and prepare your scorecard and incident sheet.
- Delivery date
Leadership readout
We present your dated 90-day plan and fixed quote to you and your leadership team in a 60-minute meeting.
For 30 days after, email your vCISO any questions about the findings.
Questions about the Blueprint
Which price applies to us?
$2,500 for most companies. $4,000 if you run servers on-premises, a hybrid setup, or handle regulated data (HIPAA, CMMC Level 1, card data), because the review covers more ground. Companies with 100 or more seats get a quote on the fit call.
Who is it for?
Companies with 15 or more seats. The owner or a decision-maker attends the readout, because the plan asks for decisions.
What access do you need?
Admin access to your email platform (Microsoft 365 or Google Workspace), your main systems and your network, plus 30-minute interviews with two or three people. The clock starts when we have access. If your old provider still holds the admin passwords, it starts when they arrive.
Will you change anything in our systems?
No. The Blueprint is a review and a prescription. Every finding goes into your dated 90-day plan, scheduled as UT-Ops work or quoted as a project, and the work starts once you approve the plan.
What if you find an active breach?
We stop, tell you the same day, and quote incident response separately.
Is the outside scan a penetration test?
No. It is a snapshot of what an attacker can see from outside, dated the day we ran it. New exposures appear every week, and UT-Ops watches for them continuously. Full penetration tests are quoted separately.
Do you submit our insurance application?
No. We draft the security answers from what we found and flag the weak ones. You review them and submit. ITFocus never signs the application, and coverage decisions belong to your insurer.
What if you're late?
We agree a delivery date at kickoff. If we miss it for reasons in our control, you get the full fee back. The clock pauses while we wait on access or on your team.
Do we have to sign up for UT-Ops afterward?
No. The report and the plan are yours whether or not you sign. If you sign within 14 days of the leadership readout, the full fee counts toward your onboarding. After 14 days there is no credit.
We're a construction subcontractor. Is there a version for us?
Yes. The Draw Protection Lockdown ($1,500) is the construction version. Ask about it on the fit call.
Can we buy the Blueprint on this page?
No. Start with the 20-minute fit call. If the Blueprint fits your company, we send the agreement after the call.
Get a dated plan and a fixed quote for your company.
Book a 20-minute fit call with a senior engineer. We will tell you whether the Blueprint fits, and if it does, you buy it after the call.
Assessment price ranges from Monmouth Cyber (2026), IBSSCORP (2026) and VikingCloud (2026).