Security Services for Small and Mid-Sized Businesses
PlatOps runs security for companies with 10–200 employees and funded SaaS startups that have no security lead: clinics, law and accounting firms, professional services and software companies.
The list of services below is long because the reasons people need security differ. You don't need all of it. Start with the situation in front of you, and we'll tell you which one service fits.
Fixed-scope ways to start
Published price, 30 days, a written result you keep
- SOC 2 Readiness Sprint$5,000
Honest gap assessment, first controls shipped, and an auditor-ready roadmap — for teams facing a deal that requires SOC 2.
- HIPAA Risk Analysis Sprint$5,000
The Security Risk Analysis HIPAA requires, quick-win controls closed, and an OCR- and MIPS-ready roadmap — for practices without IT.
- DMARC Enforcement Sprint$2,500 per domain
Stop scammers sending email as your company, without blocking your real mail — the proof insurers and auditors now require.
Where to start, by situation
Most small businesses come to us because something specific happened. Find the line that matches yours; each one says what to do first and which service fits.
A customer asked for a SOC 2 report or sent a security questionnaire
Before anything else, ask the customer what would unblock the deal. Some accept a Type I report or a readiness letter with a dated roadmap while a Type II is under way; others need a Type II report and nothing less.
A Type II report covers an observation period, usually several months, so the clock only starts once your controls are running. Find your gaps early rather than the week the questionnaire is due.
You store or handle patient data
The HIPAA Security Rule requires a documented, accurate and thorough risk analysis of the electronic protected health information you hold. If you have never done one, that is the first job, and it is what the HHS Office for Civil Rights asks to see.
There is no official HIPAA certification. HHS does not endorse private HIPAA certificates, so be wary of anyone selling one as proof of compliance.
Sources: HHS: Guidance on Risk Analysis · HHS FAQ on HIPAA certification
Nobody owns security, and leadership keeps asking who does
If the gap is decisions rather than hands — policies, a risk register, answers for the board, customers and insurers, vendor reviews — you need part-time security leadership, not another tool.
If the gap is day-to-day work such as patching, alerts and access reviews, a managed service covers it and a vCISO would sit idle.
Phishing, spoofed invoices or a payment-fraud scare
DMARC at an enforced policy (p=quarantine or p=reject) stops other people sending mail as your exact domain. It does not stop look-alike domains or an attacker inside a real mailbox, so pair it with MFA on every mailbox.
For invoice fraud, the control that works is a process: confirm any change to bank details by phone, on a number you already had.
You worry about how your cloud accounts are configured
Most cloud incidents at small companies start with configuration, not exotic attacks: public storage, admin keys that never expire, root or global admin accounts without MFA, audit logging switched off.
Start with the provider you actually run on. The native tools (AWS Security Hub and GuardDuty, Microsoft Defender for Cloud, Google Security Command Center) find most of this once they are switched on and tuned.
You need someone watching around the clock
Ask any provider who actually answers at 3 a.m., and how fast. On our Essential plan, monitoring is automated 24/7 and P1 incidents get a response within an hour; Professional adds 24/7 human response with P1 under 15 minutes.
Monitoring only helps if logs are collected in the first place, so check that audit and sign-in logs are switched on and kept before you pay anyone to watch them.
Something is happening right now
Don't wipe or rebuild machines yet; you will destroy the evidence of how the attacker got in. Disconnect affected devices from the network, and reset passwords and sessions from a device you trust.
If you have cyber insurance, call the insurer's claims line early. Many policies expect notice before you engage a responder and may require one from their panel.
All security services
Every security service we offer, grouped by the problem it solves. Prices are shown where they are published; the rest are quoted after a free 1-hour call.
Compliance and audits
Getting ready for an audit, and staying ready once you have passed one.
- SOC 2 Readiness Sprint$5,000 · 30 days
A fixed-scope gap assessment with the first controls shipped and a roadmap you can show an auditor or a customer.
Control implementation, evidence collection and audit support through Type I and Type II. The audit itself is performed by an independent CPA firm.
- HIPAA Risk Analysis Sprint$5,000 · 30 days
The Security Risk Analysis HIPAA requires, written for a practice or SaaS team without IT staff, with quick-win fixes closed.
Programs for ISO 27001, PCI DSS, HIPAA and GDPR, mapped to one set of controls so a second framework doesn't mean starting over.
For teams that ship software: compliance checks in the CI/CD pipeline, so change evidence collects itself between audits.
Leadership, monitoring and response
Someone accountable for security, someone watching it, and someone to call.
- Virtual CISO (vCISO)From $5,000/mo
Part-time security leadership: policies, risk register, board and customer conversations, vendor reviews.
- Managed SecurityFrom $3,500/mo
Ongoing security operations: threat detection, vulnerability management and response under the plan's response times.
- Incident Response RetainerFrom $2,500/mo
Terms, access and contacts agreed in advance, so an incident starts with a phone call instead of a contract.
Penetration tests, vulnerability assessments and configuration reviews, ending in a prioritized fix list.
Cloud and infrastructure
Hardening the accounts, workloads and access paths your business runs on.
Security Hub, GuardDuty, IAM clean-up and logging configured and tuned in your AWS accounts.
Defender for Cloud, Entra ID and Sentinel set up for Azure subscriptions and Microsoft identities.
Security Command Center, organization policies and VPC Service Controls for Google Cloud projects.
Containers and Kubernetes: image scanning and signing, runtime detection and supply-chain hardening.
Identity, device trust and application access that doesn't depend on being on the office network or a VPN.
Email and Microsoft 365
Where most attacks on small businesses start.
- DMARC Enforcement Sprint$2,500 per domain · 30 days
Every legitimate sender found and aligned, then a staged move to p=reject without blocking real mail.
Ongoing DMARC report monitoring and enforcement, so new senders and changes don't break mail or open gaps.
- Microsoft 365 SecurityFrom $7,500
Tenant hardening against CIS benchmarks: MFA, Conditional Access, Defender and data-loss rules.
How security engagements work
Fixed-scope sprints first
The SOC 2, HIPAA and DMARC sprints run 30 days at a published price. You keep the written result whether or not you continue with us.
Retainers for ongoing work
Ongoing security runs under the same plans as our cloud and DevOps work: Essential $3,500–$7,500/mo, Professional $8,000–$15,000/mo, Enterprise priced to scope.
Your accounts, your evidence
Work happens in your own cloud, Microsoft 365 or Google Workspace tenants. Policies, runbooks and audit evidence stay with you.
We prepare you; auditors attest
SOC 2 reports are issued by independent CPA firms and ISO 27001 certificates by accredited certification bodies. We get you ready and support you through the audit.
See every plan on the pricing page or all entry offers on the sprints page.
Security services FAQ
Which security service should a small business start with?
Start with whatever is forcing the issue. A customer asking for SOC 2 points to the SOC 2 Readiness Sprint, patient data to the HIPAA Risk Analysis Sprint, and invoice fraud or spoofing to the DMARC Enforcement Sprint. With no deadline at all, a cloud and Microsoft 365 configuration review usually finds the most risk for the least money.
Does PlatOps issue SOC 2 reports?
No. SOC 2 reports can only be issued by an independent CPA firm. We implement the controls, collect the evidence, and support you through the audit with the firm you choose.
Is there such a thing as HIPAA certification?
Not an official one. HHS says it does not endorse or recognize private HIPAA certifications. What the Security Rule requires is a documented risk analysis, safeguards that address the risks it finds, and ongoing review. Our HIPAA sprint produces that risk analysis.
What's the difference between managed security and a vCISO?
Managed security is the day-to-day work: monitoring, vulnerability management, patching and response. A vCISO is part-time leadership: deciding priorities, writing policy, answering the board, customers and auditors. Many small companies need one before the other; few need both on day one.
Do we need to buy new security tools?
Often not at first. AWS, Azure, Google Cloud, Microsoft 365 and Google Workspace include security features that are frequently switched off or left at defaults. We start there and recommend extra tools only for gaps they can't cover.
How much do PlatOps security services cost?
Sprints are fixed: SOC 2 and HIPAA sprints cost $5,000 and the DMARC Enforcement Sprint starts at $2,500, each over 30 days. Ongoing plans run $3,500–$7,500 a month (Essential) or $8,000–$15,000 a month (Professional), with Enterprise priced to scope. A vCISO starts at $5,000 a month.
Guides before you buy
IT and security for businesses without an IT team
SOC 2 Type I vs Type II: which do you need first?
SOC 2 compliance cost: what startups actually pay
HIPAA for small medical and dental practices
MSSP vs vCISO vs in-house: choosing a security provider
Zero Trust for small business: a practical guide
PKI fundamentals: certificates, CAs and trust chains
Tell us what triggered the question
A customer deadline, an insurer's form, a suspicious email: describe it on a call and we'll tell you which service fits, or that you don't need one yet.