The questions firms ask before they buy.

A BrainTrust Premium membership is $2,500/year. One-time engagements are scoped individually and start at $3,000 for a policy and documentation review and $5,000 for an M365 / Azure configuration audit or an AI Framework Assessment; the flagship Cybersecurity Vulnerability Audit starts at $10,000. Retainer arrangements are quoted on request.

Scope. The number of office locations, internet-facing domains, Microsoft 365 tenants, and vendors in play is what moves the fee from the starting price. A single-office firm with one domain and one tenant is usually at or near the starting price. Every engagement is quoted as a fixed fee in writing before work begins, so the number on the estimate is the number on the invoice.

The Cybersecurity Vulnerability Audit is MTradecraft's flagship one-time assessment. It combines external attack surface mapping, internal vulnerability scanning, a Microsoft 365 and Azure configuration audit, OSINT and breach-exposure analysis, and a policy review into a single examination-ready report with an executive summary, regulatory mapping, an evidence archive, and a remediation roadmap. It starts at $10,000.

Both. À la carte engagements are scoped in writing with a defined deliverable and produced to the same evidentiary standard as our retainer work. They include the Cybersecurity Vulnerability Audit, external penetration testing, tabletop exercises, Microsoft 365 and Azure configuration audits, AI Framework Assessments, internal vulnerability scans, policy and documentation reviews, and examination response support.

You receive an itemized estimate from MTradecraft with a link to approve it. Approval converts the estimate to an invoice due in 30 days and triggers a short onboarding form that includes the client agreement and the written authorization to test. There is no separate long-form contract. The client agreement already contains confidentiality language, and we will sign your firm's NDA if your vendor process requires one.

Most one-time engagements are delivered within two weeks of kickoff. For an engagement with an internal scan, the scanning appliance arrives by FedEx in three to four days, scanning takes about two days once it is plugged in, and the final reports follow about a week after that. A Microsoft 365 / Azure audit or a policy review on its own is typically faster. Examination response support runs on the examiner's clock, not ours.

One point of contact, the signed authorization, and a small amount of time. For an internal scan, someone at the office plugs the appliance into the network and ships it back in the prepaid box when we say we are done. For a Microsoft 365 / Azure audit, your administrator grants read-only access that you remove when the audit is complete. We do not need staff interviews, end-user credentials, or access to client account data.

No. The internal scan runs from a loaned appliance that goes back to us when the scan is complete, and no software agents are left on your workstations or servers. Microsoft 365 / Azure access is read-only and is revoked by your administrator at the end of the engagement. External testing touches only what is already visible on the internet.

A written report with an executive summary in plain English for the principals and the CCO, a technical findings section with evidence for whoever does the fixing, a mapping of each finding to the SEC rule it bears on, and a prioritized remediation roadmap. We walk the report with you on a call so the findings and the priorities are clear before you hand it to your IT provider. The report and evidence archive are yours to keep for the compliance file.

A verification rescan of the items in the remediation roadmap is included when it is requested within 60 days of the final report. It produces a short closure letter for the compliance file showing which findings were resolved. Remediation itself is done by your firm or your IT provider; MTradecraft writes the plan and verifies the result, but does not do the fixing, so the findings stay independent.

Yes, and it does a second job at the same time. Rule 206(4)-7(b) requires a registered adviser to review, at least annually, the adequacy of its compliance policies and the effectiveness of their implementation. A dated vulnerability assessment with Microsoft 365 configuration results and a written remediation plan is the evidence that the cybersecurity policies are actually being implemented, so the report is written to be filed with that annual review. The same evidence answers what carriers and client due diligence questionnaires ask for: when the firm was last tested, what was found, and what was done about it.

Usually not the full scope. If nothing significant has changed in your infrastructure, a returning firm can update the audit documentation and rescan the same scope at a reduced fee, which gives the compliance file a current date on patch status and known vulnerabilities. If you have moved offices, changed IT providers, or migrated systems, the scope and fee are reset to match. Either way it is quoted in writing before work begins.

For a firm with someone able to do the work, yes. The library gives you the policies, incident response plan, vendor due diligence records, exam checklist, and training that examiners ask for, plus a Quarterly External Vulnerability Scan of your public footprint for the vulnerability-assessment record. What it does not give you is testing inside your environment (internal network, Microsoft 365 and Azure configuration) or anyone outside the firm maintaining the file. Firms that want either of those move to a one-time engagement, or ask about a retainer, and members can apply what they have already built.

For firms that want the program operated for them or ongoing security leadership support, retainer arrangements are available by request. This is sometimes called a remote CISO or vCISO arrangement. Scope, cadence, and fee are set in a written engagement after a short call; there is no standard package.