Security assessment proposals clients can scope themselves
Fixed-price assessments with optional tests, findings written for the board and a remediation plan priced as options the client chooses.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
With QuoteCloud an MSP sends a security assessment as an interactive proposal: the core scope priced line by line, extra tests such as a phishing simulation or penetration test as optional rows, the deliverables in writing and a payment on signing. After the readout, remediation goes out as a priced proposal the client chooses from.
The readout of a sample cyber security assessment by a fictional MSP, Quillfield IT, for Thornbury & Webb: six findings ranked by Quillfield, two high (accounts without multi-factor authentication, untested backups), three medium (devices behind on updates, former staff with active accounts, no DMARC policy) and one low (staff who clicked a test phishing link). One by one each finding becomes a priced line in a remediation proposal: MFA and conditional access $1,600 and backup remediation $1,900 included, patching $1,150 and access clean-up $650 ticked, email authentication $850 and awareness training set-up $600 as options. The remediation proposal comes to $5,830.00 including tax, with 50% ($2,915.00) paid on signing.
Fixed scope, with extra tests they can tick
The core assessment is priced line by line: the external scan, the Microsoft 365 review, devices and backups, access, and the report and readout. A phishing simulation, a penetration test or a leaked-credential check sit underneath as optional rows the partners add themselves.
Because the findings are confidential, ask for a one-time passcode before signing: QuoteCloud emails it to the signer, and only then can they sign and pay half on signing. Try it: tick a test and the total and the payment follow.
- Optional rows for extra tests, with totals and tax recalculated
- A one-time passcode emailed to the signer before they can sign
- Certificate of authenticity and audit trail on the signed proposal
Price tables and payments: Essentials and up · eSignatures: every plan
Assessment scope
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Assessment | $7,500 | ||
External vulnerability scanInternet-facing services at both offices
|
1 lot | $1,450 | $1,450.00 |
Microsoft 365 security reviewMFA, admin roles, sharing and mail rules
|
1 lot | $1,800 | $1,800.00 |
Device, patch & backup reviewAll 51 laptops, desktops and servers
|
1 lot | $1,650 | $1,650.00 |
Access & offboarding reviewAccounts, privileged access, leavers
|
1 lot | $1,200 | $1,200.00 |
Findings report & readout workshopWritten for the partners, risks ranked
|
1 lot | $1,400 | $1,400.00 |
| Extra tests Tick to add | |||
| 1 lot | $900 | $900.00 | |
| 1 lot | $4,800 | $4,800.00 | |
| 1 lot | $350 | $350.00 | |
- Subtotal
- $8,400.00
- Tax (10%)
- $840.00
- Total
- $9,240.00
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $4,620.00
Confirm it's you before you sign
We emailed a one-time passcode to rebecca.webb@example.com.
482107
Passcode verified · Rebecca Webb can now sign
Accept, sign and pay
Rebecca Webb · Practice manager, Thornbury & Webb
Signed online · 23 Oct, 9:15 am
Payment on signing (50%)
$4,620.00
Paid via StripePay with card or PayPal
Certificate of authenticity and audit trail attached
Three documents, from assessment to managed security
An assessment opens the account. The findings close a remediation project, and the risks that stay become monthly services in the agreement.
Security assessment proposal
Cyber security assessment
A two-week review of how your practice's email, devices, accounts and backups are protected, with a findings report written for the partners and a readout workshop to agree what to fix first.
What you'll receive
- A findings report ranked by risk, with the business impact of each finding in plain English.
- A remediation plan priced as options, so the partners choose what to fix first.
- A readout workshop with Ingrid Halvorsen, our security lead.
- Everything we find stays confidential to Thornbury & Webb.
The proposal that opens the door
Insurer questionnaires, a client's due diligence or a worried board start the conversation. The proposal sets out the scope, what the partners will receive and that everything found stays confidential.
- Scope, method and deliverables in your own wording
- Optional extra tests
- 50% paid on signing
Price tables and payments: Essentials and up
Findings, ranked by risk From assessment QF-S-0233 · written by Quillfield IT
2 high3 medium1 low
| Ref | Finding | Risk | Recommendation | Priced as |
|---|---|---|---|---|
| F-01 | Microsoft 365Six accounts, two of them admins, sign in without multi-factor authentication. | High | Enforce MFA and conditional access for every account. | Included$1,600 |
| F-02 | BackupsServer backups run, but no restore has been tested this year. | High | Monitored backups with a quarterly restore test. | Included$1,900 |
| F-03 | DevicesNine laptops are more than 60 days behind on updates. | Medium | Patch and enrol every device in device management. | Option$1,150 |
| F-04 | AccessThree former staff still have active accounts. | Medium | Close former staff accounts; add an offboarding checklist. | Option$650 |
| F-05 | EmailThe practice's email domain has no DMARC policy. | Medium | Publish SPF, DKIM and DMARC records. | Option$850 |
| F-06 | PeopleFive of 42 staff clicked the simulated phishing link. | Low | Security awareness training every month. | Option$600 |
Risk ratings are Quillfield's own assessment of this practice. They are not a certification or an audit opinion.
Remediation, by priority
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Priority 1 · fix now | $3,500 | ||
MFA & conditional access roll-outAll 42 users, admin roles first
|
1 lot | $1,600 | $1,600.00 |
Backup remediation & restore testBoth servers and Microsoft 365
|
1 lot | $1,900 | $1,900.00 |
| Priority 2 · recommended Tick to add | |||
| 1 lot | $1,150 | $1,150.00 | |
| 1 lot | $650 | $650.00 | |
| 1 lot | $850 | $850.00 | |
| Priority 3 · when you're ready Tick to add | |||
| 1 lot | $600 | $600.00 | |
- Subtotal
- $5,300.00
- Tax (10%)
- $530.00
- Total
- $5,830.00
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $2,915.00
Findings written for the partners, fixes priced as choices
After the readout, your security lead writes each finding, its risk and the fix into a remediation proposal. The two high risks are included rows; the rest are optional rows the partners tick, so they choose what to fix first and sign the plan.
- Your own risk ratings in a findings table
- Priority 1 included, priorities 2 and 3 optional
- Signed and part-paid in the same document
Findings and ratings are your team's work, not a QuoteCloud scan
Security options in your agreement
| Item | Qty | Monthly | Once-off |
|---|---|---|---|
| Security options Tick to add | |||
| 51 | $612 | — | |
| 42 | $168 | — | |
| 1 | $390 | — | |
- Monthly recurring
- $780/mo
- Once-off
- $0
- Total contract value over 36 months
- $28,080
Shown here on their own; in the agreement they sit under the per-user and per-device services. Prices excluding tax, invoiced monthly by Quillfield IT.
Why we recommend them
- Findings F-03 and F-06: devices fell behind and five people clicked a test phishing link.
- Managed detection & response watches every device around the clock.
- Training keeps the phishing result from coming back next year.
The risks that stay become monthly services
Managed detection and response, awareness training and after-hours support are optional monthly rows in your managed services agreement. Tick or untick them and the monthly total and contract value follow.
- Repeating rows per device or per user
- Term switch for 12, 24 or 36 months
- Invoiced monthly by you, not by QuoteCloud
Repeating price items: Essentials and up
Per-user & per-device MSP pricingWhat goes in your assessment template
Set up once with your security lead during implementation, so every assessment goes out with the same method, limits and confidentiality wording.
Scope and method
What you'll test, how, and over what period, in your own words. Save it as a company block in the content library.
Exclusions and limits
What's out of scope and what a point-in-time review can't promise. Lock the block so no one softens it (Business).
Confidentiality
How findings and client data are handled and who sees the report. Add the one-time passcode so only the named signer can sign.
Deliverables
The findings report, the readout workshop and the remediation proposal, so the partners know what they're buying.
Access you'll need
Admin access, a contact at each office, and the hours you'll scan, agreed before work starts.
Price and payment
Core scope and optional tests from your price book, with a share paid on signing through Stripe or PayPal.
Send your next security assessment from QuoteCloud
Free for 14 days, no credit card required. Send us your assessment proposal and we'll convert one template during the trial.
After the readout
Findings that end in a signature, not a PDF in an inbox
The readout workshop ends with a priced remediation plan the partners can open, choose from and sign the same week, while the risks are still fresh in the room.
QBR proposals & upsellFrom the first call to remediation signed
Each step is its own QuoteCloud document or an action in one. The assessment itself is your team's work.
Send the assessment proposal
From your assessment template: core scope priced, extra tests as optional rows.
Verified, signed, half paid
The signer enters the passcode sent to their email, signs, and pays the share due on signing.
Run the assessment
With your own tools and people. Nothing is scanned or scored by QuoteCloud.
Write up the findings
Each finding, its risk and the fix in a remediation proposal, high risks included, the rest optional.
Readout and sign
The partners tick the fixes they want and sign. Ongoing services go into the managed services agreement.
Security assessment proposal questions
How do I send a cyber security assessment proposal with QuoteCloud?
Start from your own assessment template or the Cybersecurity Proposal template. Price the core scope line by line, add extra tests as optional rows, set out the method, exclusions and confidentiality in text blocks, and ask for a share of the price on signing through Stripe or PayPal. The client signs online with no account needed.
Can clients add a penetration test or phishing simulation themselves?
Yes. Put extra tests in an optional section of the price table. The client ticks the ones they want, and the subtotal, tax, total and payment on signing recalculate on the page. You see which tests were chosen when the proposal is signed. Price tables are on Essentials and above.
How do I make sure the right person signs a confidential proposal?
Turn on recipient verification: QuoteCloud emails a one-time passcode to the signer, and they enter it before they can sign. Every signed document carries a certificate of authenticity and an audit trail, and eSignatures are legally binding and eIDAS compliant.
Does QuoteCloud scan for vulnerabilities or certify compliance?
No. QuoteCloud prices, sends and gets the proposals signed. The assessment, its findings, the risk ratings and any mapping to a security framework are your team's own work, written into the document. QuoteCloud does not scan systems, import vulnerabilities, rate risk or certify compliance.
How do findings become a remediation project?
Write the findings into a remediation proposal with each risk and its fix, then price the fixes in a price table: high risks as included rows, the rest as optional rows the client ticks. The partners choose what to fix first, sign and pay the share due on signing in the same document.
How is client information protected in QuoteCloud?
Documents are protected with 256-bit encryption and hosted on AWS, and eSignatures are eIDAS compliant with a certificate and audit trail. You can ask for a one-time passcode before signing, and give your own team custom user roles on Essentials and above.
More for IT service providers
Every page of the QuoteCloud IT services microsite.
-
Per-user & per-device MSP pricingSupport tiers priced per user, devices and servers per unit, Microsoft 365 per seat, on the term the client picks.Explore
-
QBR proposals & upsellQuarterly reviews that end in priced recommendations the client can choose and sign in the same document.Explore
-
Project statements of workMigrations, network refreshes and cloud projects priced by milestone, with a Gantt plan and sign-off at each stage.Explore
- Support tiers & service levelsEssentials, Standard and Complete side by side, response targets by priority, and your SLA wording locked.
- Microsoft 365, licensing & hardware resaleLicences as monthly rows, laptops and network gear outright, with your cost and margin hidden from the client.
- Break-fix to managed servicesTurn a year of call-out invoices into one proposal for a predictable monthly fee per person.
- Renewals, true-ups & seat changesSee agreements nearing expiry, send the next term early, and add users and devices by signed variation.
- Approvals, discounts & margin controlBig agreements and deep discounts go In Review before they're sent; cost and margin stay with your team.
- PSA, CRM & accounting integrationsSigned agreements into your CRM and accounting software, and to your PSA or service desk through Zapier or the API.
- IT services templatesReal QuoteCloud templates for managed services, SLAs, security, network projects and break-fix work.
- QuoteCloud implementation for MSPsYour agreement template converted, price book imported, SLA wording locked, approvals, integrations and training.
- FAQAnswers to the questions MSPs and IT service companies ask most.
Your next assessment, scoped and signed
Free for 14 days. No credit card required.