ISG Managed Services Pricing

Predictable Security. Continuous Risk Reduction. No Hourly Retainers.

ISG Managed Services deliver enterprise-grade governance, risk, and compliance operations using AI-enabled visibility and senior security leadership at a fixed annual price.

Most organizations do not struggle because they lack tools. They struggle because security operations are fragmented, reactive, and measured in hours instead of outcomes.

Outcome-based delivery Continuous audit readiness Fixed annual pricing
The Problem

Security programs are measured in hours, not outcomes.

Most organizations do not struggle because they lack tools. They struggle because security operations are fragmented, reactive, and measured in hours instead of outcomes.

The ISG Difference

Outcome-based security operations.

ISG Managed Services replace traditional billable-hour consulting with outcome-based security operations, powered by AiVRIC and continuously informed by real-time risk signals.

What You Get

  • Continuous risk visibility - not annual snapshots
  • Always-current audit posture
  • Clear executive accountability
  • Predictable annual spend
  • No staffing burden, no audit scramble
ITG Pricing Models

Packaged to serve common IT governance customer types.

We do not sell hours. We sell continuous governance, intelligence, and transformation oversight at a fixed price.

Core Technology Governance

Foundational visibility, control, and decision discipline.

  • vCIO leadership and strategic technology planning.
  • Enterprise architecture guardrails.
  • Data and intelligence readiness baseline.
  • Technology portfolio and workload governance.
  • Operational metrics and executive reporting.

Invoiced at

$10k – $17.5k / month
Strategy & Delivery Governance

Disciplined execution and modernization at scale.

  • Portfolio and program delivery governance.
  • Managed enterprise architecture.
  • Managed AI and intelligence.
  • Integrated change and risk governance.
  • Quarterly executive planning and prioritization.

Invoiced at

$15k – $25k / month
Enterprise Digital Leadership

Board-aligned architecture, intelligence, and transformation leadership.

  • Fractional CIO / embedded vCIO leadership.
  • Managed enterprise architecture strategy.
  • Managed AI and intelligence strategy.
  • Enterprise technology risk and opportunity modeling.
  • Board-ready technology and digital risk briefings.

Invoiced at

$24k – $40k / month
Pricing Models

Packaged to serve common customer types.

We do not sell hours. We sell continuous risk reduction with executive accountability at a fixed price.

Tier 1

ISG Core Assurance

Continuous audit readiness and workload-level risk visibility. Designed for organizations seeking predictable, always-on security governance without audit churn or manual overhead.

  • Information Security Program (ISP) with formalized policies, governance, roles, and oversight aligned to NIST, ISO, or SOC 2.
  • Risk Management Program (RMP) with continuous risk identification and tracking mapped to business impact and cloud workloads.
  • AiVRIC continuous posture monitoring for in-scope cloud workloads.
  • Black Kite tier-1 vendor risk monitoring for sensitive vendors identified during onboarding.
  • Quarterly executive risk reporting with posture changes, material exposures, and remediation themes.

Annual Pricing

Mid-Market $96,000
Lower Enterprise $132,000
Enterprise $168,000
Tier 2

ISG Risk-Driven Governance

Operationalized GRC with measurable accountability. Extends Core Assurance into a fully operational governance model with defined ownership, escalation, and response readiness.

  • Vendor Compliance Program (VCP) with tiering, due diligence workflows, and continuous oversight.
  • Cyber-Incident Response Program (CIRP - Governance) with roles, escalation, and risk workflow integration.
  • POA&M lifecycle management across cloud workloads, vendors, and control domains.
  • Semi-annual executive tabletop exercise aligned to threat exposure and business context.

Annual Pricing

Mid-Market $148,000
Lower Enterprise $198,000
Enterprise $248,000
Tier 3

ISG Enterprise Risk Operations

Board-level governance without full-time headcount. Senior security leadership, architectural oversight, and enterprise-scale governance for complex, regulated environments.

  • vCISO support with strategic guidance, executive alignment, and board-facing risk oversight.
  • Security and cloud architecture oversight for identity, data protection, and control alignment.
  • Annual threat modeling for critical cloud workloads and data flows.
  • Board-ready risk reporting focused on material risk and enterprise impact.
  • M&A and new entity governance onboarding for rapid integration.

Annual Pricing

Mid-Market $228,000
Lower Enterprise $298,000
Enterprise $378,000
Scope Guardrails

Organization Profiles

Exceeding thresholds triggers pre-priced adders.

Profile Employees Cloud Workloads (AiVRIC) Sensitive Vendors (Black Kite) Managed Entities
Mid-Market 250-750 ≤25 workloads 5-10 ≤3
Lower Enterprise 750-2,000 25-75 workloads 10-25 ≤7
Enterprise 2,000-5,000 75-150 workloads 25-50 ≤12
Scope Creep Prevention

Pre-Priced Add-Ons

All add-ons are explicitly scoped and pre-priced to preserve predictability.

Add-On Price
Additional Managed Entity $18,000 / year
SOC 2 / ISO / HIPAA Readiness Overlay $25,000
M&A Entity Onboarding $12,500 per entity
Regulator / Customer Due-Diligence Pack $7,500

Remediation engineering is available under a separate statement of work when needed.

How ISG Managed Services Reduce Total Cost of Security

Predictable spend, continuous risk reduction.

ISG converts cybersecurity from a variable expense into a predictable, risk-aligned operating cost.

Traditional Model ISG Model
Hourly retainers Flat annual pricing
Annual re-assessments Continuous monitoring
Manual evidence collection Automated risk signals
Variable audit costs Predictable spend
  • Lower total compliance cost
  • Reduced audit preparation hours
  • Avoided breach and regulatory exposure
  • No incremental headcount

CFO Message: ISG converts cybersecurity from a variable expense into a predictable, risk-aligned operating cost.

Pricing - Replacing Hourly Retainers

Outcome-based pricing.

Pricing: Services are delivered on a fixed-fee, outcome-based basis aligned to the selected ISG Managed Services Tier and Organization Profile. Fees are not tied to time-and-materials, billable hours, or ad hoc task execution.

Scope Guardrails: Scope is defined by Organization Profile thresholds, selected tier, and explicit inclusions/exclusions. Work outside these parameters is governed by pre-priced add-ons or a separate statement of work.

No Hourly Accounting: Clients are not billed or measured by hours. Internal effort allocation is managed by 3HUE to meet agreed outcomes.

ITG Organization Profiles

Scope guardrails for technology governance.

Exceeding thresholds triggers pre-priced adders.

Profile Employees Cloud Workloads Technology Domains Portfolio Complexity
Mid-Market 250-750 ≤25 2-3 Moderate
Lower Enterprise 750-2,000 25-75 3-5 High
Enterprise 2,000-5,000 75-150 5+ Very High
ITG Add-On Pricing

Pre-priced extensions

All add-ons are scoped and priced to preserve predictability.

Add-On Price
Additional Managed Entity $18,000 / year
Technology Portfolio Rationalization $25,000
Cloud / Hybrid Architecture Roadmap $18,000
PMO Launch & Operating Model $30,000
Executive AI & Intelligence Risk Workshop $7,500

Ready for predictable security outcomes?

Schedule a pricing briefing to align tier selection, scope guardrails, and executive reporting cadence.