Case study · Full-lifecycle engagement
How a compliance deadline at a 320-person manufacturer turns a $12,000 assessment into an 18-month, $513,240 relationship — every workstream justified by the findings of the one before it.
Illustrative composite. The client described here is fictional, assembled from the patterns we see across regional manufacturing and supplier engagements. Every figure is modeled directly from our published indicative price list. It is published to show how our engagement model compounds — not as a guarantee of scope, price, or result.
The question
Yes — and not by inflating any single line item. Our published prices are scaled for small and mid-sized entry points: assessments from $4,500, retainers from $2,500 a month, delivery at $135–$175 an hour.
What produces a large engagement is the structure, not the rate card. One client relationship can stack four distinct workstreams — fixed-fee consulting, time-and-materials delivery, a recurring advisory retainer, and staffing — across a multi-month lifecycle. When a mid-market client with a hard compliance deadline engages across the full consult–design–deliver arc, a total engagement value in the $450K–$600K range is the natural outcome rather than an outlier.
The walkthrough below traces exactly how that happens, line by line.
The client
Exactly the profile our positioning targets: too small for a national integrator, too complex for a break/fix MSP, and facing a deadline it cannot meet with internal staff alone.
Engagement timeline
Phases overlap by design. Advisory begins the moment delivery starts, and hiring begins as soon as the assessment confirms which gaps are people rather than technology.
Multi-site IT and security assessment against NIST CSF 2.0 and CIS Controls v8, gap analysis mapped to the prime contractor’s flow-down requirements, and a costed 18-month remediation roadmap with a board-ready business case.
Target-state architecture: identity consolidation, network segmentation across three sites, appropriate Microsoft 365 tenant design, endpoint management, backup and disaster recovery, and a security architecture mapped control-by-control to the compliance baseline.
Phased implementation by a blended Acorn team — engagement lead, two senior consultants, project manager — working alongside the client’s IT staff: infrastructure refresh, migration, security control deployment, documentation, and evidence preparation for the prime’s audit.
Enterprise retainer covering vCIO and vCISO scope: monthly steering cadence, budget and vendor management, board reporting, and ongoing ownership of the compliance program.
The assessment confirmed the constraint was people as much as technology. Acorn fills the two open roles permanently — systems administrator and security analyst — and supplies contract service-desk coverage through the migration crunch.
The math
Every line traces back to a published price. Multi-site figures are scaled instances of our “from” pricing — which is exactly what “from” pricing is for. Bar lengths are shown relative to the largest workstream.
Where the value concentrates
51%
Delivery is the engine
The $60K of fixed-fee consulting is the entry point; the 12-month implementation is where a compliance-driven program compounds. At about 1,650 hours over twelve months — roughly 32 hours a week across a three-to-four person team — it is a deliberate, senior-led load, not a body-shop ramp.
18%
The retainer turns a project into a relationship
The Enterprise tier exists for clients who need a named vCISO for auditors and a board-level reporting cadence. It typically continues past month 18, which means the relationship’s lifetime value runs beyond the figure shown here.
19%
Staffing solves a gap the client already had
About $99K of placement and contract work came straight out of the assessment findings. The client was going to fill those two roles regardless; because the same firm designed the environment, the screening tested for the environment the hires were walking into.
Sensitivity
Most engagements are not this size. The same structure scales down cleanly — and, when a client renews, up.
| Scenario | Engagement value | What changes |
|---|---|---|
| Lean version | ~$219,000 | Single site, 6-month delivery of roughly 800 hours, Growth retainer instead of Enterprise, one direct-hire placement. |
| Base case | ~$513,000 | Three sites, 12-month delivery, Enterprise retainer, two placements plus contract service-desk staffing — the engagement detailed above. |
| Expanded version | ~$680,000+ | Adds a second-year retainer renewal, continuation of fractional CISO coverage, and two further placements as the program matures. |
Takeaway
The price list opens the door at $4,500. The consult–design–deliver structure is what walks a qualified client from that first assessment to an 18-month relationship — and at every step, the next workstream was justified by the findings of the one before it.
That is also why we publish prices at all. A client should be able to see the entry point, understand what each phase produces, and choose to stop after any one of them still owning something useful.
If the assessment says spend less, the assessment says spend less. We are vendor-neutral and we do not resell — there is no product quota shaping the roadmap.
Thirty minutes, no obligation. We will tell you plainly whether we are the right partner for the work — and if we are not, who is.