Memberships
Your ongoing foundationChoose a service level for your organization’s needs, resources, and security priorities.
EssentialsAdvancedPremium
Three plan choices, with different levels of protection and vCISO support.
PEACE OF MIND BY DESIGN
Build trust. Strengthen security.
Build trust. Strengthen security.
Lead with confidence.
Virtual CISO leadership for small businesses, tribal and local governments, and nonprofits. Bring your people, policies, and protection together under one cybersecurity strategy.
- Leadership Practical vCISO guidance
- Protection Email, cloud, identity, and people
- Flexibility Memberships, add-ons, and retainers
A foundation that fits. Support that grows with you.
Bring your cybersecurity services together around one practical strategy, guided by your HOZHO vCISO.
YOUR HOZHO vCISO
One coordinated cybersecurity strategy
Helps prioritize what you need, when you need it, and how your services work together.
Add-ons
Extend your capabilitiesAdd focused expertise or technology when you need support beyond your membership.
- Risk assessments and remediation
- Team workshops and specialized training
- Additional security capabilities
Retainers
Arrange dedicated supportSet aside an agreed scope of support for sustained advisory needs or specialized initiatives.
- Compliance initiatives
- Incident response support
- Major projects and ongoing advisory
Start where you are. Build around what matters.
Your vCISO helps you choose a foundation, identify gaps, and coordinate added support as your priorities change.
Find the Right Fit for Your OrganizationServices, vCISO involvement, and any reserved support or response commitments are defined by your selected plan and agreement.
EMAIL COMPROMISE IMPACT CALCULATOR
What could an email compromise cost your business?
Explore how one compromised inbox could interrupt your people, payments, and connected business apps. Adjust this illustrative scenario to fit your organization.
Use at least 1 employee (whole number), 1 disruption hour, $15 per hour, and $0 payment exposure. Stay within the input limits.
Estimated staff time affected
$700
5 employees × 4 hours × $35/hour
2
Equivalent months of HOZHO Essentials
At approximately $350/month. A cost comparison, not guaranteed savings.
Separate payment / invoice exposure: $0
Your scenario input; not added to staff time. Recovery expenses and other impacts are not estimated.
Find My Email & Identity GapsOne inbox. Your business connected. HOZHO coordinates email protection, identity monitoring, employee training, and incident readiness under vCISO leadership. Services vary by plan.
Illustrative scenario, not a prediction or guaranteed savings. Staff time affected = employees × disruption hours × hourly employee cost; this is not necessarily lost revenue or an added cash expense. Payment exposure is shown separately and is not added to staff time. The comparison uses approximately $350/month for Essentials; actual scope and pricing are confirmed in your agreement. Membership does not guarantee prevention or reimbursement.
One cybersecurity partner to orchestrate it all.
Leadership, protection, training, and monitoring—working together to help your organization reduce risk and move forward with confidence.
GOVERNANCE & STRATEGY
Know what to do next.
Turn cybersecurity concerns into a practical plan, with vCISO guidance that fits your operations, priorities, and budget.
- Risk assessments and prioritized roadmaps
- Policies, procedures, and incident readiness
- Leadership guidance and progress reporting
CLOUD, EMAIL & IDENTITY
Protect the accounts your business runs on.
Bring connected protections together and strengthen the security tools you already use, with guidance on the gaps that matter.
- Email, cloud, and identity protection
- Access, permissions, and sharing reviews
- Support for existing Microsoft and Google tools
TRAINING & HUMAN RISK
Make your people a stronger defense.
Help leaders and employees recognize threats and practice safer decisions through engaging education and ongoing reinforcement.
- Live instructor-led workshops and executive education
- Flexible online and on-demand learning
- Simulated phishing and practical exercises
MONITORING & RESPONSE
Spot exposures. Respond with a plan.
Connect security findings with practical next steps, so your organization knows what needs attention and who will act.
- Dark web and external exposure monitoring
- Managed detection and response options
- Incident planning and coordinated response
Start with a membership. Add support as you grow.
Your membership provides a foundation. Add-ons and retainers bring focused support for assessments, training, compliance initiatives, and specialized projects—with your HOZHO vCISO helping coordinate the whole program.
Services and response coverage vary by membership, selected options, and agreement.
Start with the risks that matter to your organization.
HOZHO combines consolidated protection, hands-on education, and vCISO leadership to help reduce risk across your people, systems, and operations.
We typically start with the CIS Controls: a practical foundation for organizations with limited time and budgets. Then we connect the relevant safeguards to your other framework, contractual, and insurance priorities.
Already invested in security tools? We can work with your existing Microsoft, Google, and other security platforms and help close the gaps.
For eligible state, local, tribal, and territorial organizations, your vCISO can help identify cost-effective CIS and MS-ISAC resources.
| Risk | What could happen | How HOZHO helps reduce risk | Service availability | Especially relevant to |
|---|---|---|---|---|
| Credential theft & account takeover | What could happenA stolen password or session can expose email, files, payments, and connected business apps. | How HOZHO helps reduce riskStrengthen authentication, review permissions, monitor identity activity, and coordinate containment of compromised accounts. CIS 5, 6NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityAvailable Configuration and response scope are confirmed during onboarding. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Phishing & payment fraud | What could happenConvincing messages can trick employees into sharing credentials, opening malware, or redirecting payments. | How HOZHO helps reduce riskCombine layered email protection, phishing simulations, practical staff training, and payment-verification procedures. CIS 9, 14NIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityAvailable Technology, awareness training, and vCISO guidance work together. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Ransomware & endpoint compromise | What could happenMalware can interrupt operations, encrypt systems, and put sensitive information at risk. | How HOZHO helps reduce riskReview existing endpoint defenses, coordinate monitoring and response, reduce excessive access, and help plan recovery. CIS 10, 11NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityExisting tools supported Integrated endpoint expansion planned for Q1 2027; existing defenses remain part of the plan. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Cloud data exposure | What could happenPublic links, excessive access, and risky cloud settings can expose confidential files and records. | How HOZHO helps reduce riskReview sharing and access, monitor cloud exposure, and coordinate remediation with your administrators. CIS 3, 6NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityAvailable Applies to connected services and agreed configurations. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Employee mistakes & unsafe practices | What could happenEveryday decisions can expose information or give attackers an opening. | How HOZHO helps reduce riskBuild safer habits through instructor-led workshops, executive education, online learning, and phishing practice. CIS 14NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityAvailable Delivery format and training scope are tailored to your team. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Vendor & third-party exposure | What could happenProviders and connected apps can introduce weak access controls, data exposure, or service disruption. | How HOZHO helps reduce riskAssess vendor risk, review security terms and access, and define responsibilities for sensitive information. CIS 15NIST CSFNIST SP 800-53ISO 27001PCI DSSHIPAA |
Service availabilityAdvisory service Reviews and remediation are scoped to your provider relationships. |
Especially relevant to Small businessesTribal governmentsLocal governmentsHealthcareNonprofits |
| Unauthorized network access | What could happenWeak remote access or network boundaries can let intruders reach critical systems. | How HOZHO helps reduce riskReview remote access, firewall rules, segmentation, and monitoring with your IT team or network provider. CIS 12, 13NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2 |
Service availabilityCoordinated service Network tools and changes are scoped separately. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Exposed assets & unpatched systems | What could happenOutdated software and exposed services can leave avoidable routes into your environment. | How HOZHO helps reduce riskIdentify external exposures, prioritize vulnerabilities, and coordinate patching and secure configuration improvements. CIS 4, 7NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityAvailable + coordination Assessment and monitoring inform remediation by the responsible team. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Data loss & prolonged downtime | What could happenMissing, damaged, or untested backups can turn an incident into a lengthy interruption. | How HOZHO helps reduce riskReview backup coverage, recovery priorities, and restore testing with your IT and backup providers. CIS 11NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityCoordinated service Backup technology and recovery work require an agreed scope. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Delayed detection & response | What could happenUnreviewed alerts and unclear responsibilities can allow an incident to spread. | How HOZHO helps reduce riskCoordinate managed detection and response, escalation contacts, incident plans, and tabletop exercises. CIS 17NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityScoped service Monitoring sources, response authority, and service coverage are agreed upfront. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Unclear security priorities | What could happenLimited time and budgets can leave important protections unfinished or disconnected. | How HOZHO helps reduce riskUse routine risk assessments and a CIS-based roadmap to assign owners and focus effort on practical safeguards. CIS 4, 6, 14, 17NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityAdvisory service Start with foundational safeguards and build as needs grow. |
Especially relevant to Small businessesTribal governmentsLocal governmentsNonprofitsHealthcareEducation |
| Compliance & insurance readiness gaps | What could happenMissing policies and supporting records can slow customer reviews, renewals, or insurance applications. | How HOZHO helps reduce riskMap relevant safeguards, organize evidence, and prioritize policy, training, and process improvements. CIS 7, 14, 15, 17NIST CSFNIST SP 800-53ISO 27001PCI DSSSOC 2HIPAA |
Service availabilityAdvisory service Requirements depend on your contracts, data, sector, and insurer. |
Especially relevant to Small businessesTribal governmentsLocal governmentsHealthcareNonprofits |
No risks match both selections. Try a different framework or organization type.
Availability describes HOZHO service options, not your organization’s implementation or compliance status. Services depend on your plan, systems, and agreement. Framework tags indicate related safeguards, not complete coverage or certification. Audience examples are not eligibility restrictions.
Scalable vCISO plans for your organization.
Start with a cybersecurity foundation, then add capabilities and leadership support as your needs grow.
Essentials
Practical protection for small organizations.
Let's talk
- Build a cybersecurity foundation
- Monitor key exposures
- Support employee awareness
- Access practical governance resources
Advanced
Stronger protection for greater operational risk.
Let's talk
- Expand monitoring and threat detection
- Strengthen cloud and identity security
- Develop your security program
- Coordinate additional protection options
Premium
Executive guidance for more complex needs.
Let's talk
- Strategic vCISO leadership
- Governance and security roadmaps
- Compliance alignment guidance
- Executive cybersecurity reporting
Services and pricing are tailored to your organization and confirmed in your agreement. Add-ons and retainers support assessments, remediation, specialized projects, and incident response needs.
Build your cybersecurity roadmap.
Start where you are. Your HOZHO vCISO helps you understand your risks, take practical action, and improve over time.
-
Step 1 Audit Upcoming
Connect
Meet your vCISO to discuss your goals, operations, and cybersecurity concerns.
-
Step 2 Audit Upcoming
Understand
Review your current protections and identify gaps across people, policies, email, cloud, and identity.
-
Step 3 Audit Upcoming
Prioritize
Build a practical action plan based on your risks, resources, and compliance needs.
-
Step 4 Audit Upcoming
Protect
Put agreed safeguards in place through your membership, training, policies, and selected add-ons.
-
Step 5 Audit Upcoming
Improve
Review progress with your vCISO and adjust your cybersecurity program as your organization grows.