Choosing the Right Cybersecurity Retainer

 

Many Philippine SMEs need expert cybersecurity guidance but cannot justify a full-time security leader. Our time-based retainers give you access to a senior consultant who provides clear direction, practical recommendations, and steady progress without the cost of a permanent hire. The difference between the packages is simply how much time and involvement you get each month.

Essential Advisory (8 hours/month)
This package is designed for companies that mainly need a trusted expert to ask questions and get clear answers.

Possible outputs include one structured monthly call, written follow-up notes, review and comments on one or two documents (such as policies or customer questionnaire responses), and ongoing email support for specific questions.

Client expectation is important: you still do most of the work. The consultant provides direction and prioritization so you know what matters most and what can wait.

The real value is avoiding costly mistakes and getting senior judgment on the issues that affect your business. It is ideal if you already have some basic controls in place and simply need occasional expert guidance.

Security Program (16 hours/month)
This package is for organizations that want to build a proper security program step by step.

Possible outputs include two advisory sessions each month, steady progress on foundational policies, a simple risk register that is set up and maintained, help answering customer security questionnaires, a short prioritized action list or roadmap, and a brief monthly or quarterly status update.

Client expectation: you implement most of the recommendations while the consultant guides the work, reviews progress, and produces key documents. The pace is practical and sustainable for a small team.

The real value is structured progress. Instead of reacting to problems or customer requests, you start building a basic, defensible security program that you can show to clients, partners, and insurers.

vCISO / Strategic Leadership (32 hours/month)
This package provides the closest experience to having a part-time Chief Information Security Officer.

Possible outputs include weekly working sessions, ownership of a security roadmap, development and maintenance of a fuller set of policies, risk assessment support, vendor risk guidance, incident response planning, management or board-level summaries, and higher day-to-day availability for questions and decisions.

Client expectation: your internal team or other vendors still handle day-to-day operations and technical implementation. The consultant sets priorities, drives the program forward, and acts as the senior security voice for the organization.

The real value is leadership and momentum. You gain a named expert who keeps the security program moving, coordinates different workstreams, and helps you communicate security status clearly to management and external parties.

Which package is right for you?
Choose Essential Advisory if you need occasional expert advice. Choose Security Program if you want to build foundational policies, risk management, and customer-facing security materials. Choose vCISO if you want ongoing strategic leadership and faster progress across multiple areas.

All three packages are pure consulting time. They do not include hands-on implementation, penetration testing, or 24/7 monitoring, those services can be arranged separately when needed. The goal is the same in every package: give you clear, senior-level guidance so you can improve your security posture in a practical and cost-effective way.