One tier. Everything included. No surprise upcharges.
Every business we manage gets the full security posture and strategic input from day one. Cost is predictable, the scope is in writing, and your renewal looks exactly like your first month. Project work — cabling, fiber, migrations, network rebuilds — is scoped separately so you only pay for what you actually need.
Twelve services. One accountable team.
The cabling that connects your network is installed by the same engineers managing your M365 tenant and writing the automations that wire your business systems together — so when something breaks, there's no finger-pointing.
Managed IT & Help Desk
The everyday IT layer your team depends on — monitoring, patching, helpdesk, and clear escalation when something breaks.
- 24/7 endpoint monitoring
- Patch management within 72 hours of release
- Helpdesk M–F, 8 a.m. – 6 p.m. Pacific
- Average first response under 30 minutes
Cybersecurity & EDR
Endpoint Detection & Response with managed EDR alerting, DNS filtering, and the controls your cyber-insurance carrier now expects at renewal — included in every account, not sold as an upgrade.
- EDR on every endpoint, managed EDR alerting
- DNS-level threat filtering
- Security awareness training + quarterly phishing simulation
- CIS / NIST / HIPAA control mapping
Backup & Disaster Recovery
Daily endpoint backup, M365 mailbox + OneDrive + SharePoint backup, monthly restore tests, immutable offsite copy. Ransomware-resistant by design — not by promise.
- Daily incremental, 30-day retention
- Immutable Object Lock offsite copy
- Monthly restore test per client
- M365 mailbox + OneDrive + SharePoint backup included
Microsoft 365 & Cloud
Tenant administration, Conditional Access policies, mailbox audit, GDAP delegation — the controls most tenants are missing. (Microsoft licensing billed separately or BYO tenant.)
- Tenant administration + Conditional Access baseline
- Audit logs at 365-day retention
- GDAP-delegated admin (no permanent Global Admin)
- Defender for Office 365 hardening + SPF/DKIM/DMARC
Networks & Wi-Fi
VLAN-segmented networks, enterprise-grade Wi-Fi, 802.1X authentication. Same team that pulls the cable configures the controller.
- VLAN segmentation (corp/guest/IoT/voice)
- WPA3-Enterprise with RADIUS
- UniFi controller managed by us
- Wi-Fi heatmap survey on design
Structured Cabling
Cat6/6A cable runs, racks, patch panels — installed cleanly, labeled correctly, documented. Our roots are low-voltage.
- Cat6 / Cat6A drops
- Wall- or floor-rack installation
- Patch-panel labeling + documentation
- BICSI-aligned termination quality
VoIP & Business Phones
Cloud PBX deployment, on-prem switching support, mobile softphone setup. We deploy the SIP, we tune the QoS.
- Cloud PBX setup (3CX, RingCentral)
- QoS-tuned network configuration
- Phone hardware install + provisioning
- Number porting handled end-to-end
Video Surveillance
IP camera systems, NVR setup, integration with your existing network infrastructure. PoE-powered, network-segmented.
- UniFi Protect / vendor-neutral options
- PoE camera install + aiming
- IoT-VLAN segmented from corp
- Retention + access-control policies
IT Consulting & Advisory
Strategy and advisory work billed by the hour when you need it — security roadmap, vendor selection, M365 architecture review, compliance posture, due-diligence consulting. No padded retainer.
- Consulting available when used — rate quoted at discovery
- Security roadmap + vendor selection
- M365 architecture + compliance posture review
- Quarterly Business Review included in Entity Shield
Custom Software Development
When off-the-shelf software can't do what you need, we build it — internal tools, client portals, dashboards, and forms. Built around the IT stack you already have, with the documentation and ownership of a managed engagement.
- Internal tools, forms, dashboards, and client portals
- Built on your existing Microsoft 365 / cloud stack
- Documented and owned by you — no black-box lock-in
- Full custom apps for the right scope — fixed estimate, written
Automation & Business-App Integration
Connect the apps your office already runs so information moves on its own — no copying numbers from one screen into another. Giving into your books, new-hire setup, calendars in sync. Scoped as a project, quoted in writing.
- Giving / donation platform into QuickBooks Online — no manual entry
- New staff set up, departing staff shut off — across Microsoft 365 / Google Workspace
- Planning Center synced to your calendar and website
- Repetitive admin automated, documented, and handed to you
AI Phone Assistant & Scheduler
Never miss a call again. An AI assistant answers every call in a natural voice, books appointments on your calendar, screens and routes callers, and takes messages — day or night. Built on your phone system, so you keep your number. One-time setup plus a flat monthly fee, separate from the per-seat plan.
- Answers every call, day or night, in a natural voice
- Books, confirms, and reschedules appointments on your calendar
- Screens callers and routes the right ones to a person
- Takes messages and sends them to you by text or email
Entity Shield
This is the entire monthly engagement. There is no "lite" version, no premium add-on, no extra-cost security stack. Every account gets the same scope — the full security stack, the M365 licensing, the Quarterly Business Review — from day one. Workstations, servers, and mobile devices are all priced the same flat rate.
Predictable per-seat fee — custom-scoped to your organization at discovery. We quote in writing within 48 hours of an intro call, and your renewal looks the same as your first month. Workstations, servers, and mobile devices are priced the same flat rate.
Request a quoteWhat's included — every account, every month
- 24/7 monitoring of every workstation and server
- Patch management for Windows, macOS, Linux, and third-party apps — security patches within 72 hours
- Unlimited helpdesk, M–F 8 a.m. – 6 p.m. Pacific
- Average first response under 30 minutes
- After-hours emergency response — phone + on-call engineer for P1 incidents
- 4-hour P1 / 8-hour P2 response SLA
- Monthly health report to your designated contact
- EDR (Endpoint Detection & Response) with managed EDR alerting on every endpoint
- DNS-level filtering — blocks malware, phishing, and C2 domains
- Microsoft 365 email security — Defender for Office 365 hardening, SPF / DKIM / DMARC alignment
- Microsoft 365 tenant management — MFA enforcement, Conditional Access, mailbox + Teams + SharePoint admin
- Security awareness training — monthly micro-lessons + quarterly phishing simulation
- Endpoint backup — daily incremental, 30-day retention, monthly restore test
- Microsoft 365 mailbox + OneDrive + SharePoint backup — separate from M365 native retention
- Quarterly compliance reporting — NIST / HIPAA / PCI-DSS evidence package
- Annual third-party penetration test for accounts with public-facing systems
- Quarterly Business Review — operational review of the prior quarter (tickets, incidents, recommendations)
- Documentation — your environment is documented in our IPAM; copy available any time and at offboarding
- Onboarding + offboarding runbook for staff transitions
- Strategy + advisory work available when you need it — no padded monthly retainer
Microsoft 365 licensing billed separately — we'll quote retail or use your existing tenant. Tenant management, Defender hardening, and M365 backup are part of Entity Shield.
What you'll never see on an invoice
- Charges for the EDR, DNS filter, security training, or backup that "weren't in your tier"
- Per-ticket fees
- Onboarding-fee surprises after the contract is signed
- A higher per-seat rate for servers or mobile devices — everything is priced the same
- After-hours emergency surcharges
- "Tier upgrade" pressure to unlock features
If a real out-of-scope situation comes up (custom application development, third-party vendor escalation, major one-time projects), it's quoted in writing before any work happens.
Cabling, migrations, network rebuilds.
Project work is not part of the monthly Entity Shield fee. We scope it, quote it, and you approve it before we start.
Projects
| Microsoft 365 migration | $75 / mailbox |
| Network audit + Wi-Fi heatmap | $1,200 |
| New office deployment day (8 hrs, 2 techs, <50 mi) | $1,800 |
| Automation & business-app integration build | scoped at discovery |
| AI phone assistant — setup + flat monthly | scoped at discovery |
Low-voltage, cabling, network infrastructure
California C-7 Low Voltage Contractor — physical work done in-house, not subcontracted.
| Cat6 cable drop (up to 200 ft) | $145 / drop |
| Cat6 long-run drop (200–400 ft) | $245 / drop |
| Fiber backbone (per pull, length + strand dependent) | quoted |
| Wall- or floor-rack installation | $850 |
| UniFi U7 Pro access point (installed) | $285 |
| UniFi USW-Pro-24-PoE switch (installed) | $1,295 |
| UniFi G6 / G7 Dome camera (installed) | $425 – $475 |
| UniFi Dream Machine Pro (installed + configured) | $595 |
Bulk pricing applies at 20+ drops or 10+ APs. Existing Entity Shield clients receive 15% off all hardware install fees.
Quoted in writing. Almost never used.
When something falls outside Entity Shield AND isn't a defined project — custom development, third-party vendor escalation, true emergencies outside SLA — we scope and quote it in writing before any work starts. These situations almost never apply to Entity Shield clients during the normal scope. If you're seeing out-of-scope charges, something has changed and we should have a conversation.
Premium, above-board, predictable.
The published number is the number. Everything you need to run a secure SMB is included from day one. If your environment grows beyond what the tier covers — new servers, new sites, a new compliance regime — we requote in writing, never silently.
We're not the lowest price in Sacramento. We're the most predictable, and the most security-included, at our price point. For organizations that have outgrown "the cheap MSP" and don't want a vendor that nickels them on the security layer, that's the value.
Ready to scope a quote?
Tell us your seat count and any compliance constraints. Written proposal within 48 hours.
Request a proposal