vCISO retainers your client chooses and signs
Advisory days a month as packages, the board reporting and roadmap in writing, and the baseline paid when they sign.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
QuoteCloud lets vCISO firms send retainers as packages the client chooses: advisory days a month, what each includes, a monthly fee shown in the document and invoiced by the firm, and a once-off baseline and roadmap paid on signing. The CEO signs online, with a certificate of authenticity.
Last reviewed by the QuoteCloud team
Three pages of a sample vCISO retainer proposal from a fictional firm, Northlatch Security, for Brightfern Software, fanned out and taking turns at the front: the cover; the three retainer levels, Advisory at $3,200 a month for 2 days, Fractional CISO at $5,900 for 4 days (the one most companies Brightfern's size choose) and Embedded at $10,800 for 8 days; and the retainer price table with the monthly retainer invoiced by Northlatch and a $4,500 (plus tax) security baseline and 12-month roadmap paid in full on signing, awaiting the CEO's signature.
Three levels, one choice, the baseline paid on signing
Brightfern Software's CEO picks a level, the retainer line follows it, and the once-off baseline and roadmap is paid when he signs. Try it: choose a level.
Choose your retainer
Your retainer
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Retainer | |||
Fractional CISOInvoiced monthly by Northlatch
|
Monthly | $5,900 | $5,900.00/mo |
Security baseline & 12-month roadmapMonth one: where you are and what comes next
|
1 lot | $4,500 | $4,500.00 |
- Subtotal
- $4,500.00
- Tax (10%)
- $450.00
- Total
- $4,950.00
- Retainer, monthly
- $5,900.00/mo
- Baseline paid on signing (100%)
- $4,950.00
Accept, sign and pay
Marcus Oyelaran · CEO, Brightfern Software
Signed online · Awaiting signature
Baseline paid on signing (100%)
$4,950.00
Paid via StripePay with card or PayPal
Certificate of authenticity and audit trail attached
What a vCISO retainer should spell out
A retainer sells time and judgement. Writing down what's in it, and what isn't, is what keeps it from turning into an open-ended help desk.
Days a month
How many days each level includes, and what happens to a day that isn't used. Your rule, in your words.
Board reporting
How often the board hears from their security lead, and what each report covers.
The roadmap
Month one's baseline and 12-month roadmap, priced once and paid on signing, then owned and tracked under the retainer.
Questionnaires and suppliers
Customer security questionnaires and supplier reviews: included, capped, or quoted separately.
Scope wording written once, locked where it matters
The retainer is assembled from your firm's own blocks. The scope and the exclusions are the same in every proposal; the introduction is written for each client.
- Your vCISO and how we workText block
- What the retainer includesText block Locked
- Board reportingText block
- Out of scopeText block Locked
- Retainer levelsPackages
- Retainer and baselinePrice table
- Confidentiality and data handlingText block Locked
- AcceptanceSignature block
- 1Cover and introductionWritten for Brightfern
- 2Your vCISO and how we work From library
- 3What the retainer includes Locked block
- 4Out of scope Locked block
- 5Board reportingMonthly at this level From library
- 6Choose your retainer From library
- 7Retainer and baselineBaseline paid on signing From library
- 8Confidentiality and data handling Locked block
- 9Acceptance From library
Written once
Save the scope, the exclusions and your confidentiality terms as company blocks, and every retainer starts from the same wording.
Content libraries: Essentials and up
Locked in the proposal
Lock the scope and exclusions so a consultant can use them but not edit them in a proposal.
Content locking: Business
Help with the introduction
The AI Co-Worker helps your consultant draft the client introduction in the editor. What it writes is flagged until someone accepts it.
AI Co-Worker: Business
Send your next retainer as levels the client chooses
Free for 14 days, no credit card required. Send us your current retainer letter and we'll convert one template for you during the trial.
vCISO & advisory retainers
Judgement, sold by the day and agreed in writing
The client chooses how much of your time they buy. The days, the reports and the exclusions are in the document they sign, and the first month's work is paid before it starts.
From the first call to a signed retainer
How a vCISO firm can send a retainer the same day as the conversation.
Have the first call
Hear what the board, the customers and the auditors are asking for.
Start from your template
Levels, scope wording and the baseline are already in it; write the introduction.
Send it
The proposal goes to the CEO by email, with tracking to show when it's read.
They choose a level
The retainer line and the monthly figure follow the level they pick.
Signed, baseline paid
The CEO signs and pays the baseline through Stripe or PayPal; you invoice the monthly retainer.
Questions about vCISO retainers
How do I send a vCISO retainer proposal in QuoteCloud?
Build one retainer template with your levels, scope wording and baseline, then start each proposal from it and write the introduction for the client. Send it by email; the client chooses a level, signs online and pays the baseline on signing. Tracking shows when the proposal is opened.
Can the client choose between retainer levels?
Yes. Your levels show as packages, a single choice with what each includes and its monthly fee. The retainer line in the price table follows the level the client picks, so the figures they sign match their choice.
Does QuoteCloud charge the monthly retainer?
No. The monthly fee is shown in the proposal and your firm invoices it. QuoteCloud takes a payment when the client signs, such as the once-off baseline and roadmap, through Stripe or PayPal. Retainers don't renew by themselves; you send a new or revised document.
Can I stop consultants changing the scope wording?
Yes. Save the scope, exclusions and confidentiality terms as blocks in a content library (Essentials and up), and lock them so they can be used in a proposal but not edited there. Content locking is on Business.
Can AI help write the retainer?
The AI Co-Worker (Business) helps your consultant draft text in the editor, such as the introduction, and flags it until someone accepts it. With QuoteCloud's MCP service, your AI assistant can be set up to create a draft from your template for review. Nothing is sent without a person.
More for security firms
Every page of QuoteCloud for cybersecurity services.
-
Compliance gap auditsControls against your chosen framework, current and target maturity, and the roadmap priced as options.Explore
-
Managed security service proposalsEndpoints and users × service tier → the monthly price, on a term, with renewals you can see coming.Explore
-
Authorisation to test & signingRules of engagement and written authorisation signed by every party, then a deposit or full payment on signing.Explore
- AI-drafted reports & quotes with MCPYour AI assistant, connected through QuoteCloud's MCP service, drafts the report and the priced quote for an analyst to review.
- Vulnerability scan reportsMonthly and quarterly scan results as a branded report: severity summary, findings, trend and what to fix first.
- Penetration test reportsExecutive summary, findings with evidence and retest status, and the client's sign-off in one document.
- Monthly managed security reportsThe month in alerts, incidents and patching from your monitoring platform, with next month's recommendations to tick.
- Remediation quotes priced from findingsFindings by severity × hours × rate in a Spreadsheet block that sets the price lines, plus a retest the client ticks.
- Penetration test & assessment proposalsScope by IPs, apps and APIs, days worked out in your scoping sheet, and extra tests as options.
- Integrations & automationMCP, the API, Zapier and Make, plus CRM, accounting, Slack and Teams, connected the way each one really connects.
- Cybersecurity templatesReal QuoteCloud cybersecurity, SLA and consulting templates, ready for your report and quote layouts.
- QuoteCloud implementation for security firmsReport and quote templates, your pricing sheet, the MCP connection and analyst training, step by step.
- FAQAnswers to the questions MSSPs, pen-testers, security consultancies and vCISO firms ask most.
Your next retainer, chosen and signed
Start a free 14-day trial: set up your retainer levels and scope wording, and send your first retainer this week.