It is a decision about how much of the governance work stays inside your organization. Three organizations with identical record counts can land in three different places, and one of them should not hire me at all.
Below is the whole structure: the three paths, how the fee is built, where the upfront money goes, how I am compensated, and what I will not sell you. No quote appears here, and there is a reason for that, explained at the bottom.
After you complete the Governance Proof Status and we walk through what it says, you choose one of these. All three are real. I have recommended the first one to organizations that could have afforded the third.
You designate your own Qualified Individual, you build the program, and you hold the evidence. You leave the review knowing what applies to you, what you are exempt from, and what records you should be able to produce.
For organizations with real internal capacity, this is the right answer, and choosing it is not a failed sale.
Your people and your existing vendors keep doing their work. I sit above it as the governance and evidence layer: verifying that what was promised is happening, keeping the record current, and telling leadership what is provable and what is pending.
Best fit where compliance staff already exist and the gap is verification, not execution.
I serve as your designated Qualified Individual under 16 CFR §314.4(a) and operate the governance process alongside a senior person inside your organization, who directs and oversees my work. Specialists handle technical controls within their scope.
The senior person is not optional. The Rule contemplates that accountability stays with you.
Paths 2 and 3 have two components. The structure matters more than the number, because of when each half is collected.
Half the Governance Foundation at signing. This is the money that gets spent on your behalf, not banked.
Your evidence portal is stood up, the tooling is purchased and installed, and service-provider oversight is put in place.
The second half is collected only after that work is implemented, dated, and verified by your own leadership.
Begins in month two and runs the ongoing governance: evidence collection, reporting, service-provider verification, and program adjustment.
The activation half funds three concrete things before it funds me: your evidence portal, where the record actually lives and can be produced on demand; the technical tooling your program needs to operate; and putting service-provider oversight in place so the vendors handling your customers' information are documented and monitored.
I buy that tooling and that portal on your behalf, out of what you pay me. You hold one contract, which is mine, and you are never handed a stack of vendor invoices to reconcile.
One. The Governance Foundation and the QI Monthly Retainer, paid by you, for governance work I perform.
Two. I receive compensation from the technology partner whose platform I place clients on. That is a real financial interest, and I am telling you about it on a public page rather than letting you find it later.
A conflict you can see is a conflict you can price in. If any of this changes, this page changes with it, and the date at the bottom will tell you when.
Penetration testing and vulnerability assessment are contracted by you, directly, with a firm that has no relationship to me. I will help you scope it and read the results with you. I will not sell it, mark it up, or take a fee on it.
If I were paid on your tester, the independence the requirement exists to produce would be gone, and the report would be worth less to whoever you eventually have to show it to.
I don't sell monitoring, scanning, or remediation. The people implementing controls shouldn't be the only ones documenting whether leadership oversaw them.
Three inputs, in order of how much they move it: the consumer records you maintain, which determines whether four of the written requirements are legally required of you at all; your number of locations; and which elements the Governance Proof Status confirms apply, not which ones a vendor says apply.
Organizations maintaining information on fewer than 5,000 consumers are exempt from four written requirements under 16 CFR §314.6: the written risk assessment, the penetration testing and vulnerability assessment regime, the written incident response plan, and the annual written report. That is a materially smaller engagement, and a meaningful number of the businesses I speak with are in it and do not know.
Two obligations are never exempt at any size: service-provider oversight at §314.4(f), and the notification duty at §314.4(j), which is not a program element at all but an event-triggered reporting requirement.
| Program level | Typical scale | Foundation | QI Monthly Retainer | Build time |
|---|---|---|---|---|
| Designated | Under 5,000 records, single location. Exempt class. | from $6,000 | from $600 | 2 weeks or less |
| Coordinated | 5,000 to 9,999 records. Written requirements apply. | from $7,500 | from $2,000 | 2 to 4 weeks |
| Governed | 10,000 to 19,999 records, or multi-site. | from $12,000 | from $3,500 | 3 to 6 weeks |
| Fortified | 20,000+ records. Examination-grade record. | from $20,000 | from $7,500 | 4 to 8 weeks |
Ranges, not quotes. Independent testing under §314.4(d)(2) is contracted separately by you and is not included in any figure above.
Because a number that arrives before you know your own coverage becomes the whole conversation.
Until we know which activities bring you inside the Rule, how many consumer records you maintain, and which elements you are exempt from, any figure I published would be a guess dressed up as a price. It would also tempt you to buy things the Rule does not require of you, which is the specific outcome this business exists to prevent.
So the sequence runs the other way. You complete the Governance Proof Status, we walk through what your own answers say, and only then does an investment figure appear, built on facts rather than averages. If it turns out you are exempt from most of this, I would rather tell you that in week one than in month six.
Twenty questions, about six minutes. No sales call attached to it, and you'll know more when you finish than when you started.
Check where you stand Have a direct question? Get on my calendar