Service prices and scope
- A fixed price only means something if the scope is fixed too.
- You get a cap on your own spend, not an open-ended engagement.
- A 30-person company should not be paying for the complexity of a 500-person one.
- If scoping shows you are in a larger band, you hear it before you sign — never as a surprise invoice.
- Named targets — domains, entities, systems — are listed in the contract annexe, agreed in writing before the price is fixed.
| Service | Included in the base scope | Beyond the base scope — confirmed extras |
|---|---|---|
| Business email and domain review from €2 400 |
|
|
| DORA / NIS2 readiness and evidence pack from €7 900 |
|
|
| AI use and governance review from €5 900 |
|
|
A customer request may need a written applicability assessment, a questionnaire response or one technical correction. Each can be commissioned separately. The combined DORA budget applies only if you commission both the assessment and implementation.
Written applicability from €900 · Customer questionnaire · Register diagnostic €2 600 · Focused improvement
DORA / NIS2 applicability note — from €900 →
For pricing, employee counts are the average headcount over the last 12 months within the agreed scope. This is a commercial service limit, not a method of deciding DORA or NIS2 applicability; regulatory size and group criteria are assessed separately.
A minimum price reflects preparation, evidence review and professional checking. Headcount is one scope limit; it does not measure all the work. Systems, contracts, existing records and unresolved questions also affect effort.
Contract review and processing an ICT arrangement in the register are separate activities. If both are required beyond the included limits, the quotation lists each additional fee separately.
A larger scope is one quotation, not stacked add-ons. The extra for a second entity applies to shared systems, policies and governance — a genuinely separate environment is quoted individually. Limits do not multiply automatically; the from €13 900 figure is the starting price for the expanded project as a whole; its scope is described in one quotation.
At the walkthrough, review outputs, sources, usable files and unknowns. You have ten working days for specific comments and one included clarification round. Defects in our agreed work are corrected without extra charge, including when discovered later; the review window does not waive those rights. Silence is not final acceptance. New facts or requirements are distinguished before quoting additional work. Specific terms are included in the agreement.
BoundariesNot included
- Implementing the remediation — that is quoted separately as a fixed-scope project
- 24/7 cover or emergency incident-response hours
- Unlimited security-questionnaire answering
- Certification, statutory audit or legal opinions — these are performed by certification bodies, registered auditors and lawyers respectively
Monthly support has a defined allowance
Monthly support includes an agreed allowance of senior time, not unlimited availability. We publish it so that you can compare the service clearly.
A monthly engagement includes a planned allowance, the agreed response window and the published rollover terms. An individually booked day is a scheduled piece of work and does not by itself establish ongoing response availability. Named substitute arrangements must be confirmed in the agreement.
| Monthly option | Per month | Included |
|---|---|---|
| 1 day per month | €1 400 | 8 hours of senior work |
| 2 days per month | €2 600 | 16 hours of senior work |
| 4 days per month | €4 900 | 32 hours of senior work |
| Published day rate | €1 300 |
One expert day is eight hours of senior time, usable in parts — preparation, analysis, meetings, written responses and agreed coordination all count towards it. There is no unlimited work between meetings.
Outside the agreed service window, the standard retainer provides no committed immediate response or technical containment. Use your organisation’s arranged incident route. The agreement defines hours, time zone and escalation; a meeting in another time zone does not extend the window.
Compare the responsibilities, not just the hours. An IT provider may already perform some security tasks. We identify what is covered, what remains with management and where extra leadership or independent review is useful. If recurring work exceeds the agreed capacity, we discuss a larger allowance or an internal role. Compare cost and responsibilities →
These tiers cover ongoing senior work in security and ICT risk governance. DPO and other specialist functions are scoped and priced separately according to the capacity and independence required.
- Unused time rolls over for one month, up to half of that month’s allowance; carried-over time is used first and expires at the end of that next month.
- Before additional days are used, we confirm in writing whether they remain a one-off day or whether a larger monthly option applies, and from which month. Where the larger option costs less for the requested capacity, we propose it.
- Response to a critical issue within 4 working hours during the agreed service window means acknowledgement and first guidance, not resolution of the incident; one business day otherwise. The service window, contact channel and a named substitute are set in the contract.
- No 24/7 promise in the standard service. Where you need round-the-clock cover, we arrange it separately with a vetted partner once availability is confirmed. Who receives an incident alert, when, and what Dyasol does is set out under incident help.
- 30 days’ notice to cancel, at any time.
Specimens and preparation for commissioning
These specimens and worksheets show how outputs, your participation and acceptance are recorded. Specific terms are completed and agreed for the engagement.