# SMB & Growing Teams Practice — RedactLabs

> Source: https://redactlabs.ca/practices/smb/
> Machine-readable Markdown of this page (also served at this URL under `Accept: text/markdown`).

# For teams that have outgrown their first-generation IT.

For 5–150-person Canadian firms that need cybersecurity, IT, and web infrastructure that scales with the business. One senior team across all three. NIST CSF 2.0 baseline. Fixed-fee. Vendor-agnostic. No multi-year lock-in.

Practice profile

- **Team size**: 5–150 people
- **Coverage**: Security / IT / Web
- **Baseline**: NIST CSF 2.0
- **Commitment**: No multi-year lock-in

## THE FIT

- 01 **Right-sized tiers** for 5–150 staff.
- 02 **One team** across identity, endpoint, network, web, and email.
- 03 **Vendor-agnostic.** We hold no reseller loyalties.
- 04 **Annual retainers,** billed monthly.

## Engagement patterns.

### Managed IT Complete + a Care plan

IT, security and your website under one team: we run your IT with Managed Security Essentials built in, and a Website Care plan runs the site.

$195 CAD/user/mo ($1,500 minimum) + Care from $149 CAD/mo

### Sentinel Exposure Review™

A 2–4-week fixed-fee assessment mapped to NIST CSF 2.0 and the 13 CyberSecure Canada controls, delivered as the Sentinel Brief™.

From $6,500 CAD, by headcount

### Provider takeover

Part of managed-plan onboarding: a 30–60-day transition that stabilises inherited systems.

One month's fee (minimum $750), waived on annual prepay

### Sentinel Advisory™ (vCISO)

Executive security leadership: Advisory for up to 50 staff, Program for 51–150.

From $3,500 CAD/mo · 12-⁠month term

## What right-sized looks like.

- **Identity**: MFA, conditional access
- **Endpoint**: managed EDR, encryption
- **Email**: SPF, DKIM, DMARC
- **Network**: segmented Wi-Fi, ZTNA
- **Backup**: 3-2-1 discipline
- **Governance**: policies, privacy officer, tabletop exercises

## Compliance posture.

- CyberSecure Canada
- NIST CSF 2.0
- CIS v8 (IG1–2)
- PIPEDA / Law 25

## Common SMB questions.

- **We already have an internal IT lead. Where do you fit?**: Above day-to-day IT, as the security and architecture function — we set the standard your lead runs to.
- **How long until we’re defensible?**: A four-week audit, then eight to twelve weeks of stabilisation. Defensibility is a date, not a slogan.
- **Can you take over from our current provider?**: Yes. The takeover is part of managed-plan onboarding (one month's fee (minimum $750), waived on annual prepay): we stabilise inherited systems over 30–60 days.
- **Do we have to bundle?**: No. Each engagement stands alone. Managed IT Complete already includes Managed Security Essentials; a Website Care plan sits beside it, month to month.
- **How large a vCISO do we need?**: Sized to headcount and obligation. Sentinel Advisory™ is $3,500 CAD/mo for up to 50 staff (Advisory, about 8 hours a month) or $5,500 CAD/mo for 51–150 (Program, about 16 hours). 12-month term, or a 6-month pilot at +10%.

## Start with an Exposure Review.