# Charity Tier Selector — RedactLabs

> Source: https://redactlabs.ca/charity-tier-selector/
> Machine-readable Markdown of this page (also served at this URL under `Accept: text/markdown`).

# Find your practice tier.

Five questions. About 90 seconds. No email required.

Our charity practice runs five tiers — from a Sentinel Exposure Review™ to fully managed IT with an embedded vCISO. Answer five questions; we recommend where to start.

## FIVE QUESTIONS

Data sensitivity

### What kind of personal data does your charity hold?

Headcount

### How many staff have email accounts or system access?

Incident history

### Have you had a security incident in the last 24 months?

Governance pressure

### Are your board or funders asking about cybersecurity?

Provincial scope

### Where do you operate?

RECOMMENDED — TIER 0

### Sentinel Exposure Review™.

A fixed-fee review of your exposure. The right place to start.

- **Format.** Fixed fee, by headcount.
- **Output.** A point-in-time review of your exposure, with findings prioritized for your board.
- **Best for.** Charities formalizing cybersecurity for the first time.

RECOMMENDED — TIER 1

### Remediation.

Specific high-risk gaps need closing now.

- **Format.** Project, quoted from the Exposure Review.
- **Output.** The highest-risk findings from the review, closed first.
- **Best for.** Charities with known issues or a recent incident.
- **Next step.** An Exposure Review first, to scope the work.

RECOMMENDED — TIER 2

### Managed Security Essentials.

Foundational managed security, reported monthly.

- **Format.** Monthly, per user.
- **Includes.** Endpoint detection and response (EDR), Microsoft 365 or Google Workspace posture monitoring, patching of operating systems and apps, Sentinel Watch™ external exposure monitoring, and the monthly Sentinel Brief™.
- **Best for.** Charities with established operations and growing oversight.

RECOMMENDED — TIER 3

### Managed Security Professional.

A security program: awareness training, vulnerability scans, an incident response plan and quarterly reporting.

- **Format.** Monthly, per user.
- **Includes.** Everything in Security Essentials, plus awareness training and phishing simulation, quarterly vulnerability scans, an incident response plan and annual tabletop, 8 prepaid incident hours a year, cyber-insurance questionnaire support, and a quarterly leadership report.
- **Best for.** Mid-to-large charities with complex or regulated operations.

RECOMMENDED — TIER 4

### Managed IT Assured + Sentinel Advisory™.

Fully managed IT with a security program, an annual penetration test and an embedded vCISO.

- **Format.** Monthly, per user, plus the Sentinel Advisory™ retainer.
- **Includes.** Everything in Security Professional, plus an annual external penetration test, a business-hours service desk, Microsoft 365 or Google Workspace administration, device management and backup, staff onboarding and offboarding, procurement coordination, network, firewall and domain monitoring, a quarterly vCIO review, privacy-officer support, and an embedded vCISO through Sentinel Advisory™.
- **Best for.** National charities, regulated programmes, or organizations with material cybersecurity risk.

## CHARITY PRACTICE TIERS

- TIER 0: Sentinel Exposure Review™ · A point-in-time review of your exposure, with findings prioritized for your board. The right place to start. Best for charities formalizing cybersecurity for the first time. · Fixed fee, by headcount · point-in-time exposure review · prioritized findings · board-ready summary
- TIER 1: Remediation · The highest-risk findings from the review, closed first. Best for charities with known issues or a recent incident. · Project · quoted from the Exposure Review
- TIER 2: Managed Security Essentials · Foundational managed security, reported monthly. Best for charities with established operations and growing oversight. · Monthly, per user · endpoint detection and response (EDR) · Microsoft 365 or Google Workspace posture monitoring · patching of operating systems and apps · Sentinel Watch™ external exposure monitoring · the monthly Sentinel Brief™
- TIER 3: Managed Security Professional · A security program: awareness training, vulnerability scans, an incident response plan and quarterly reporting. Best for mid-to-large charities with complex or regulated operations. · Monthly, per user · everything in Security Essentials · awareness training and phishing simulation · quarterly vulnerability scans · an incident response plan and annual tabletop · 8 prepaid incident hours a year · cyber-insurance questionnaire support · a quarterly leadership report
- TIER 4: Managed IT Assured + Sentinel Advisory™ · Fully managed IT with a security program, an annual penetration test and an embedded vCISO. Best for national charities, regulated programmes, or organizations with material cybersecurity risk. · Monthly, per user, plus the vCISO retainer · everything in Security Professional · an annual external penetration test · a business-hours service desk · Microsoft 365 or Google Workspace administration · device management and backup · staff onboarding and offboarding · procurement coordination · network, firewall and domain monitoring · a quarterly vCIO review · privacy-officer support · an embedded vCISO through Sentinel Advisory™