Fixed fees. Written scope. No hourly meter.
You’ll know what you’re paying and what you’re getting before you sign. Every engagement is priced as a fixed fee, set in writing after a short call, and never billed by the hour.
Which one are you?
HIPAA compliance
Independent practices of 1–5 physicians who need a risk analysis an investigator would accept.
Maritime cyber (MTSA)
Operators facing the Coast Guard’s July 16, 2027 cyber deadline.
Virtual Fractional CISO
A named security leader on a monthly retainer, for any regulated small business.
AI governance
Rules, records and vendor review for the AI tools your people already use.
HIPAA compliance for independent practices
One-time fixed fees, scoped for 1–5 physician practices. Full details on the HIPAA page.
| Plan | Fee | Delivered in | What you get |
|---|---|---|---|
| Assess | $2,500–$3,500 | 2 weeks | A full, human-conducted HIPAA risk analysis across the Security Rule safeguards, an asset and ePHI data-flow inventory, a notice of privacy practices review, a gap analysis and a written, prioritized remediation roadmap. |
| Protect Most popular | $5,500–$7,500 | 2–3 weeks | Everything in Assess, plus external and internal vulnerability scans, a findings report with priorities, and MFA and encryption gap identification. |
| Certify | $9,500–$14,500 | 4–6 weeks | Everything in Protect, plus a scoped penetration test, a written and tested incident response plan, BAA review and an audit-ready documentation package. |
Ongoing: bi-annual vulnerability scan at $2,500 per scan, or an annual pen test retainer at $4,500 per year, which includes bi-annual scans and an attestation letter.
Maritime cyber compliance (MTSA)
For operators of vessels covered by 33 CFR Part 104. Full details on the maritime page.
| Engagement | Fee | What you get |
|---|---|---|
| Readiness Assessment | From $3,500 one vessel or facility. Fleets of similar vessels from $6,500 | Which of your boats are covered, a documented cybersecurity assessment, a ranked gap list and a readout call. |
| Assessment + Cybersecurity Plan | From $9,500 | Everything above plus a submission-ready Cybersecurity Plan. Your assessment fee is credited if you add the plan within 30 days. |
| Outsourced Cybersecurity Officer | From $1,500 per month | I act as your named Cybersecurity Officer: training oversight, drills and exercises, incident-response readiness and annual assessment updates. |
| Security awareness training | Quoted | Role-based training for the personnel the rule requires you to train, with records you can show an inspector. |
AI governance
For organizations that use AI tools and have no security executive to set the rules. Full details on the AI governance page.
| Engagement | Fee | What you get |
|---|---|---|
| AI Readiness Assessment | From $3,500 up to 50 staff | An inventory of AI tools in use, a map of where your data goes, a risk assessment against the NIST AI Risk Management Framework and a ranked action plan. |
| AI Policy & Approval Kit | $2,500 | An AI use policy, an approved-tools list, a request-and-approval form, staff guidance and a one-hour training session. |
| AI Governance Program | From $7,500 | Assessment, policy kit, review of up to five AI vendors, a risk register and a leadership briefing. Your assessment fee is credited if you add the program within 30 days. |
| Ongoing AI oversight | $750 per month | New tools reviewed before rollout, a quarterly check of the inventory and a short written update. Included in the Program and Officer of Record retainers. |
Virtual Fractional CISO retainers
Monthly, fixed, three-month minimum. Full details on the Virtual CISO page.
| Tier | Fee | What you get |
|---|---|---|
| Advisory | $1,500 per month | One monthly working session, a current risk register and roadmap, review of documents you send, and email access. |
| Program | $3,500 per month | Everything in Advisory, plus I own one framework program, write your policies, run vendor and BAA reviews, answer questionnaires and report quarterly. |
| Officer of Record | $5,500 per month | Everything in Program, plus I am your named officer, with two calls a month, annual drills and assessment updates, audit support and same-day incident response. Limited availability. |
| Questionnaire Sprint | $1,500 one time | One stalled customer or insurer security questionnaire answered within 10 business days. |
How I price, and what is not included
What is always true
- Fixed fees, agreed in writing before work begins
- No hourly billing and no surprise invoices
- You keep every document I produce
- I do the work myself
What costs extra
- Work outside the agreed scope, quoted first. Retainer clients get a reduced rate
- Penetration tests and vulnerability scans outside a plan
- Security software and tools
- An independent audit, certification or attorney’s opinion, which I don’t provide
Do you take a deposit?
Fixed-fee projects start with a signed scope and a deposit. Retainers are billed monthly in advance.
What if the scope grows?
I tell you before it happens and quote the change in writing. Nothing gets added without your approval.
Do you offer payment plans?
For larger fixed-fee projects I can split payments across milestones. Ask when we scope.
Book a free 20-minute call
Pick a time that works. I’ll ask what you’re running and what’s driving the timing, and I’ll tell you honestly whether I can help.
Talk to me directly
305.481.4386Call or text and we’ll find a time. Or send a note with your best times and I’ll confirm within one business day.
Send a requestNo pitch on the call. If you don’t need me, I’ll say so.
Spiral Security Advisors LLC · Miami, Florida · Privacy Policy
Spiral Security Advisors provides advisory services only. Nothing here is an audit, attestation, certification, or legal advice, and no outcome with a regulator is guaranteed. Prices are starting points; final fees are set in a written scope before work begins.