What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A security assessment can open the door to ongoing work when you use it as a current baseline—not as a pitch for an automatic retainer. Turn findings into agreed priorities, offer follow-up services that address specific risks, and define exactly what you will monitor, report, and support. The recurring value for a client is continued visibility and risk treatment; the right service and price depend on the client’s scope and your delivery capacity.
Start with the assessment the client already bought
Close out the assessment by explaining what the findings mean for the client’s environment. Validate context, rank remediation actions with the client, and make ownership and next steps explicit. A finding is more useful when the client knows who will act, what action is expected, and how completion will be judged.
As an Amazon Associate I earn from qualifying purchases.
- Separate urgent risk treatment from longer-term improvements.
- Identify dependencies, such as client approvals, access, or system changes.
- State which recommendations you can implement and which require another team or provider.
- Agree on remediation acceptance criteria so that “fixed” has a shared meaning.
Keep advice distinct from implementation work. If you offer remediation support, define its scope and change boundaries rather than treating every recommendation as included in the assessment.
Choose follow-up work that fits the risks
There is no universal package prescribed by security guidance. Build a service around the client’s outstanding risks, operational needs, and your ability to deliver it. The options below can stand alone or form a sequence.
#1 Best Overall
Scoped remediation support
Help implement selected controls or review the client’s remediation. Specify the systems and actions covered, who makes production changes, what evidence will demonstrate completion, and how work outside scope is approved.
Recurring monitoring
Depending on the assessment findings, recurring work might include vulnerability scanning, internet-facing asset monitoring, asset or configuration tracking, security-control monitoring, or alert review. Make the cadence clear and distinguish automated results from human investigation and response. CISA describes its own Cyber Hygiene service as including monitoring internet-accessible assets, weekly vulnerability reports, urgent alerts, and public web-application scanning. That is an example of continuing activity, not a commercial package or endorsement; check CISA’s current service description and eligibility at CISA Cyber Hygiene Services.
Periodic risk and control review
Schedule reviews to revisit material risks, changed systems, control performance, and unresolved actions. A review can refresh the client’s understanding of exposure and identify where a new assessment is warranted. It should not imply that monitoring alone replaces independent testing.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Managed service or referral
If you lack the staff or tools for a requested service, a qualified managed security provider may be a better fit than stretching your own scope. Assess the provider’s capabilities and responsibilities, and help the client understand the risks of granting a third party access. NIST’s October 2019 MSP project description identifies asset management, risk assessment, identity and access control, data security, and continuous monitoring as functions in an example solution. It also notes that compromise of an MSP can increase risk for the SMBs it supports; this is a risk to evaluate, not a claim that every SMB needs an MSP. NIST’s MSP project description.
Design the recurring service around clear boundaries
A recurring fee is only defensible when the client can tell what work it buys and what remains their responsibility. Put the service design in writing before delivery begins.
- Coverage: List assets, accounts, environments, and locations included, along with exclusions.
- Cadence and hours: Set monitoring frequency, review schedule, service hours, and any response-time commitments.
- Severity and escalation: Define severity levels, notification channels, escalation contacts, and what happens outside service hours.
- Roles: Distinguish IT operations from security services, and assign incident response and remediation responsibilities.
- Remediation: State whether you only report findings, help implement fixes, or verify remediation; document acceptance criteria and change approvals.
- Data and records: Specify access, retention, log handling, customer-data separation, and how records are returned or disposed of at termination.
- Dependencies and extra work: Identify required client access, approvals, and information, and define what events trigger additional scope or fees.
- Transition: Explain how access, documentation, open findings, and monitoring responsibilities move to the client or another provider if the service ends.
CISA’s guidance for MSP customers recommends documenting service levels and security responsibilities, including incident roles, remediation acceptance, customer-data separation, and log or record handling. CISA, Risk Considerations for Managed Service Provider Customers. NIST SP 800-35 also offers durable provider-selection prompts: consider the service arrangement, provider qualifications and capability, operational requirements, provider viability, staff trustworthiness, and ability to protect systems and information. It dates to October 2003, so use it as a set of questions rather than a current market standard. NIST SP 800-35.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep recurring reviews current
Monitoring and periodic review extend the client’s visibility, but they do not make an old assessment report proof of current security. Systems, threats, configurations, and business dependencies can change. Refresh evidence when the environment or risk changes, and preserve independent assessment where it is needed.
CMS policy provides one agency-specific illustration: reusing prior assessment documents can save time and resources, but may weaken test write-ups and the accuracy of risk identification. That is a CMS policy context, not a universal reassessment interval or rule. CMS Risk Management Handbook, Chapter 4.
NIST SP 800-137A describes evaluating a continuous-monitoring program through review of its strategies, policies, procedures, operations, and analysis of monitoring data. Its assessment approach and example criteria can help frame program evaluation; it does not prescribe a consulting package. NIST SP 800-137A.
Set a price from the actual scope
Neither the cited standards nor the service examples establish a universal price, conversion rate, or standard recurring package. Estimate delivery effort and overhead, account for the client’s scope and risk, and set fees against the service levels and responsibilities you have agreed to provide. Validate that the work fits your capacity before committing to response times or coverage.
A practitioner’s Reddit post asks, “How much do you charge to just run a one-off NIST-CSF risk assessment?” That is one person’s question, not representative pricing data. It is a useful reminder to define what the assessment includes before discussing fees; it cannot establish what providers generally charge. Reddit r/msp discussion.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
A practical path from report to ongoing work
- Explain the findings. Validate context, rank risks with the client, and name owners and next actions.
- Offer specific next steps. Separate scoped remediation from monitoring and periodic review; tie each offer to a client need.
- Write the service boundaries. Define coverage, cadence, response, roles, data handling, exclusions, acceptance criteria, and transition.
- Deliver and report consistently. Show what was monitored, what changed, what needs attention, and which actions remain open.
- Refresh the evidence. Revisit risks and controls as the environment changes instead of relying on a stale assessment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
