Transparent, published pricing.
Most MSPs hide their pricing. We publish ours, and we show the math. Here's what managed IT, cybersecurity, and compliance actually costs at Evolving Technology Solutions.
Managed services
Monthly retainers, ongoing IT, security, and governance.
| Service | Starting from | Typical engagement range |
|---|---|---|
| Cybersecurity as a Service (CaaS) | $95 / user / month | $2,500-$15,000 / month |
| Virtual CISO (vCISO) | $3,500 / month (flat) | $3,500-$12,000 / month |
| Virtual Chief AI Officer (vCAIO) | $4,500 / month (flat) | $4,500-$15,000 / month |
CaaS scales per user, a 10-user firm starts at $950/month, a 25-employee firm around $2,500/month. vCISO and vCAIO are flat retainers because the deliverable is governance, not per-seat tooling. All prices are starting-from; your engagement depends on scope.
Compliance programs
Fixed-scope project pricing, one-time engagements with defined deliverables and timelines.
| Program | Starting from | Typical engagement | Typical timeline |
|---|---|---|---|
| NAIC WISP (insurance agencies, 10-100 employees) | $7,500 fixed | $7,500-$18,000 | 28 days |
| HIPAA program (10-50-employee practice) | $6,500 fixed | $6,500-$22,000 | 60-90 days |
| IRS Pub 4557 program (CPA / tax-prep firm, any size) | $5,500 fixed | $5,500-$15,000 | 30-60 days |
| CMMC L1 self-attestation program | $4,500 fixed | $4,500-$9,000 | 60-90 days |
| CMMC L2 readiness program (pre-C3PAO) | $45,000 | $45,000-$120,000 | 6-12 months |
Pricing is per-engagement, not per-user. Programs can be bundled with CaaS or vCISO for a discount.
What's not included in the starting-from price
We believe in line-item transparency. Here's what you pay separately, and why.
Hardware (firewalls, switches, endpoints)
Pass-through at vendor MSRP.
Third-party SaaS licenses (EDR, Microsoft 365, Google Workspace, backup, etc.)
Pass-through with line-item visibility on every invoice.
Active-incident response hours beyond what's included in your engagement
Separately scoped at $250/hour during active incidents.
C3PAO formal CMMC L2 assessment fees
Paid to the assessment organization, not to Evolv. Evolv prepares you; a separate accredited assessor certifies you.
How we set these prices
These numbers are derived from published 2026 benchmarks for the managed-security and fractional-executive markets. Regional Midwest MSP pricing typically runs $100-$200 per user per month for managed IT, with managed cybersecurity specifically landing $80-$120 per user per month. vCISO retainers run $1,500-$20,000+ per month, with small-business engagements typically $3,000-$5,000. vCAIO providers serving larger enterprises charge $8,000 and up; SMB-appropriate engagements scale meaningfully lower. Our starting-from prices sit in the middle of those ranges, above the floor where coverage gaps appear, below the premium tier where you're paying for enterprise scale you don't need. We publish the methodology because most MSPs won't, and operators deserve to know whether they're being quoted within the market or above it.
Compliance Evidence Coverage Map
Every Evolv CaaS subscription includes ongoing compliance evidence collection. This map shows which capabilities cover which controls in each major framework.
| Framework | Section / Control Set | Covered by CaaS Capability |
|---|---|---|
| HIPAA Security Rule | §164.308, Administrative safeguards | Risk management, workforce training, contingency planning |
| HIPAA Security Rule | §164.312, Technical safeguards | Access control, audit logs, encryption, integrity monitoring |
| PCI-DSS v4.0 | Requirement 5, Malware protection | Managed EDR, behavior-based AV |
| PCI-DSS v4.0 | Requirement 8, Identity & access | MFA enforcement, SSO, privileged access management |
| PCI-DSS v4.0 | Requirement 10, Logging & monitoring | 24/7 SOC, log aggregation, incident timeline retention |
| PCI-DSS v4.0 | Requirement 11, Vulnerability testing | Quarterly scans, patch verification |
| PCI-DSS v4.0 | Requirement 12, Security policy | Documentation library, SOPs, awareness training |
| NAIC Insurance Data Security Model Law | §4, Information Security Program | Risk assessment, controls, oversight, testing |
| IRS Publication 4557 | Six-step security plan | Inventory, risk assessment, safeguards, plan, train, test |
| GLBA Safeguards Rule | §314.4, Nine elements | Risk assessment, MFA, encryption, monitoring, training, incident response |
| CMMC Level 1 | 17 practices | AC, IA, MP, PE, SC, SI domains |
| CMMC Level 2 | 110 practices | Full NIST SP 800-171 domain coverage |
This map describes the capabilities Evolv includes as part of every CaaS subscription. For regulated-industry clients, we also offer fixed-fee programs to write your initial Written Information Security Program (WISP), policy library, and audit-ready evidence binder.
Frequently Asked Questions
Not sure where you stand?
Start with a free Cyber Scorecard to see your exposure in 5 minutes, or book a scoping call to get a tailored quote.