ValorOps

Services and prices

Three fixed-scope assessment packages and a documentation service, all with published prices. The price on this page is the price on the proposal. Over 50 users, or anything outside Microsoft 365, is quoted after a short scoping call.

1. Microsoft 365 Security Baseline

$1,500 up to 25 users · $2,500 26 to 50

A read-only review of the tenant that answers the questions an insurer, a client, or a regulator will ask, and tells your IT vendor exactly what to change. Report in five business days from the day access is granted.

What is reviewed

  • MFA enforcement and Conditional Access, including legacy authentication and exclusions
  • Admin roles: who holds them, whether they use separate accounts
  • Mail authentication (SPF, DKIM, DMARC), anti-phishing policies, forwarding and transport rules
  • External sharing in SharePoint, OneDrive, and Teams, including anonymous links
  • Audit logging, alerting, and backup coverage
  • Device compliance posture
  • Microsoft Secure Score and its improvement actions

What you receive

  • Assessment report: one page a partner can read, then the detail. Each finding has a severity, the business risk in plain words, and the exact fix.
  • Prioritized fix list with effort and suggested owner, formatted so your vendor can quote from it.
  • Cyber insurance questionnaire control answers, filled in with evidence.
  • Secure Score snapshot on day one.
  • 45-minute findings walkthrough.

Book a call about this package

2. AI Readiness and Governance

$2,000 up to 50 users

Where client data can leak into AI tools, and the policy you are missing. Copilot reads whatever a user can already open; the problem is usually that users can open far too much. Report in five business days from the day access is granted.

What is reviewed

  • SharePoint and OneDrive oversharing relevant to Copilot and other AI tools
  • Sensitivity labels, data loss prevention, and retention policies
  • Copilot licensing posture and readiness
  • Current staff use of AI tools, through short remote interviews

What you receive

  • Oversharing report: which sites and libraries expose what, and to whom.
  • Copilot go or no-go checklist.
  • A two-page AI acceptable use policy drafted for the firm to review, adopt, and distribute: approved tools, data that never goes in, who owns exceptions.
  • Each finding tied to the control it bears on in the framework named in your statement of work, so you have evidence to hand to whoever is asking.

Book a call about this package

3. Full Assessment plus 30-day recheck

$3,500 up to 25 users · $4,500 26 to 50

Both assessments, one combined report, and a 30-day follow-up to confirm the fixes landed. Report in ten business days from the day access is granted; recheck 30 days after delivery. The price is the sum of packages 1 and 2; the recheck and the before-and-after scorecard are what you gain.

What is included

  • Everything in packages 1 and 2
  • One combined report and one findings walkthrough
  • 30-day recheck of every finding

Why the recheck matters

  • A before and after Secure Score scorecard is the document an insurer or a client actually wants to see.
  • Fix lists stall. A dated follow-up is what gets them finished.

Book a call about this package

4. Policy and Documentation

From $350 per document · $1,800 starter set of five

The policies an insurer, a client contract, or a regulator asks for, written for your organization rather than downloaded and renamed. Intake call, draft in five business days, one round of revisions, delivered as editable Word and PDF on your letterhead.

Why this is worth paying for

Nearly every assessment ends with the same finding: the controls exist, the paperwork does not. That matters more than it sounds. A cyber insurance claim is adjusted against the policies you had in force on the day of the incident; if the application said you had an incident response plan and you cannot produce one, the carrier has grounds to deny. A client's security questionnaire asks for the documents by name. A regulator, or opposing counsel after a breach, reads them to decide whether you were negligent.

A free template fails all three tests because it describes a company that is not yours. It names roles you do not have, systems you do not run, and a notification procedure nobody at the firm has read. Writing one properly means collecting who actually does what, which systems hold which data, who your vendors are, and which rules apply, then producing something a new hire could follow and an auditor would accept. That is a few hours of a practitioner's time per document, which is what the price covers.

Catalog

DocumentWho asks for itPrice
Acceptable Use PolicyInsurers, employment counsel$350
Incident Response Plan, with a 60-minute tabletop walkthroughInsurers, regulators, client contracts$600
Backup and Recovery PolicyInsurers, client contracts$350
Access Control and Password PolicyInsurers, questionnaires$350
Vendor and Third-Party Access PolicyClient contracts, regulators$350
Data Retention and Disposal PolicyRegulators, client contracts$350
Remote Work and Personal Device PolicyInsurers, employment counsel$350
AI Acceptable Use PolicyClient contracts, partners$350, included in package 2
Security Awareness BaselineInsurers, questionnaires$350
Starter set: any five of the above$1,800

Something not listed? Ask. Most firm-specific documents fit the same process and price.

How it works

  1. 30-minute intake call.

    Who does what, which systems hold which data, your vendors, and which rules apply to you.

  2. Draft in five business days.

    Written in plain language a new hire could follow. Named contacts, real systems, your actual procedures.

  3. One round of revisions.

    You mark it up, I revise. The IRP includes a 60-minute tabletop walkthrough so the people named in it have run it once.

  4. Delivered on your letterhead.

    Editable Word plus PDF, with a review date set one year out.

These documents are operational, not legal advice. Where a policy touches employment or breach-notification law, the draft marks the sections your counsel should confirm.

Book a call about documentation

Over 50 users, and remediation

Over 50 users

Any package, scoped to the tenant's size and complexity, quoted in writing after a 20-minute call. Book the call.

Remediation

Kept separate on purpose, so the assessment stays independent. ValorOps can implement the fix list at $150 per hour under a separate statement of work, or hand it to your existing IT vendor with a written scope. Not offered: managed services, help desk, or ongoing monitoring.

What a finding looks like

Every finding in the report has the same four parts, so a partner can read the first two and an IT vendor can act on the last two.

Questions firms usually ask

Do you need admin access to our tenant?

No. Your Global Administrator creates one dedicated Global Reader account with MFA for the engagement, and revokes it when the report is delivered. Global Reader can read the configuration across Entra, Exchange, SharePoint, Defender, Intune, and Secure Score without the ability to change any of it. ValorOps never holds Global Administrator credentials, and the account's sign-ins and activity appear in your own tenant logs.

Will anything change in our environment?

Nothing. Assessments are read-only. Every finding comes with the exact fix, and you or your IT vendor decide when and whether to make it.

We already have an IT company. Does this replace them?

No, and it is not meant to. Your vendor keeps things running. This is the independent review that tells both of you what to fix, written so your vendor can quote from it directly. Most vendors welcome it; it turns a vague "are we secure" into a scoped list.

Does the report make us compliant with HIPAA, the FTC Safeguards Rule, or our bar's rules?

It gives you evidence and a fix list against the framework that applies to you. It is not a certification and not legal advice. If your data falls under a specific regime, the statement of work says so, and any agreement that regime requires is signed before access begins.

What does the price include?

Everything listed for the package, travel within the Chattanooga and North Georgia area, and the findings walkthrough. 50% is invoiced on signing and schedules the work; 50% on delivery of the report. Change orders and delays caused on the client side are billed at $150 per hour, with notice first.

How is this different from Microsoft Secure Score?

Secure Score is one input, not the assessment. It tells you how many recommended settings are on. The assessment tells you which gaps matter for your firm, what they expose, and in what order to close them, and it covers things Secure Score does not, like mail forwarding rules, anonymous links, and what staff are doing with AI tools.

Not sure which package fits? That is what the call is for.

Book a 20-minute call dillan@valor-ops.com