How Petronella Technology Group Engages With Clients

Regulated-business security and compliance work is custom by nature. Two defense contractors of similar headcount can have wildly different scopes. One has a clean single-domain Microsoft 365 tenant, a small CUI enclave, and documented policies from a prior assessor. The other has shadow IT across three business units, legacy on-prem file servers with mixed CUI and non-CUI data, an expired POA&M, and three untracked SaaS tools that touch sensitive data. Same employee count. Very different project.

We have watched competitors publish "CMMC Level 2 for $X" pricing and then pile on change orders once the real scope becomes visible. That is not a quote. That is a trap door. Petronella Technology Group does not work that way. We scope in writing before we bill in full, and our assessment phase exists precisely so nobody gets surprised.

If you need a firm number before you can have a real conversation, that is a signal the engagement is not ready yet. In that case, book the free 15 minutes with Penny and we will tell you honestly whether an assessment is the next step, whether you need internal prep work first, or whether a different firm is a better fit.

For commodity, fixed-package offers (AI starter kits, self-serve readiness sessions, off-the-shelf compliance templates), see petronella.ai. Those packages are priced publicly because the scope is fixed by design.

The first call exists to protect both sides. You find out within 15 minutes whether we are the right firm for your situation. We find out whether your timeline, budget, and regulatory footprint are compatible with how we work. About 30 percent of intake calls end with a referral out to another firm. That is by design, not a failure.

Penny does not try to close you. She does not push for a calendar hold on the senior engineer. She captures the intake, confirms your email, and sets the expectation: "Someone senior will reach out within 48 hours with a real answer, including the answer no if we are not a fit." If the qualifying questions reveal an obvious mismatch during the intake itself, she will tell you politely and offer to recommend an alternative.

Everything Penny collects is encrypted at rest and only visible to the senior engineer reviewing the intake. No third-party call-tracking tools are plugged into this pipeline. Craig Petronella personally reviews every enterprise-scope intake.

A typical assessment runs along these lines. Week one: stakeholder interviews (IT lead, compliance officer, sometimes CFO or general counsel), system inventory, data-flow mapping, review of existing policies and prior audit reports. Week two: technical scans, access review, identity and key-management posture, SaaS sprawl audit, network and boundary review. Week three: written report with prioritized findings, a gap-closure roadmap, and a line-item implementation proposal.

We do not subcontract assessment work. The engineer who scopes your environment is the engineer you work with during implementation. That matters because tacit knowledge from interview conversations does not always make it onto paper, and we want that knowledge staying with the project.

If the assessment reveals that your project is larger, smaller, or fundamentally different from what Penny intake suggested, we say so. We do not stretch scope to match an artificial budget, and we do not pretend a bigger problem is smaller just to get a signature. The value of the assessment is the honest number at the end, not the number you were hoping to see going in.

Many clients proceed directly from assessment to engagement. Some take the written report and implement fixes internally. Some shop the report against other vendors. All three are legitimate outcomes. The assessment is a standalone deliverable, not a bait-and-switch intake for an implementation contract.

Assessment timelines can flex for urgent breach or deadline work. A 72-hour forensic-triage scope obviously does not wait 3 weeks for a written report. In those cases, senior engineer time deploys within 24 hours and a written summary follows once the active response stabilizes. If a regulatory-notification clock is already running, tell Penny that first and everything else reshapes around it.

What assessments are not: vendor-selection beauty contests where three firms each do two-week free discovery and the winner bills for implementation. That model rewards whichever firm is most willing to swallow unpaid scoping time, which is not the firm you want implementing your compliance posture. We bill assessment work because the work is real. If you are comparing us against firms offering free assessments, please read their statement of work carefully to understand what they expect to recover in the implementation phase.

This section exists so you do not waste a week getting excited about a potential engagement that is never going to close. If you see your situation here, we respect you enough to tell you up front. In most of these cases, there are excellent firms we can refer you to.

Our reputation lives in the referral network. An accountant who sends us an incident-response client, a defense-contractor attorney who sends us a CMMC client, a business coach who sends us a mid-market IT advisory client: those relationships exist because we do not burn trust by forcing every intake into a Petronella-shaped box. When we refer out, we refer to firms we would hire ourselves if the shoe were on the other foot.

Common referral paths include: specialty mobile-forensics firms for Cellebrite, EnCase, and traditional law-enforcement-chain-of-custody work; boutique e-discovery firms for document-review-heavy matters; local generalist MSPs for small-business commodity IT; large assessor organizations for Level 3 CMMC projects that exceed our scope; and private-investigator firms for surveillance, interview, and physical-investigation work outside of digital forensics.

If you need a referral, just ask. We maintain the network so you do not have to cold-call five firms.

You do not need a full vendor questionnaire answered before calling. You do not need an RFP. You do not need every system inventoried. What you do need is enough context that Penny can tell a senior engineer what this engagement actually is, so the follow-up call is not a second intake. Here is what moves a conversation from exploratory to actionable.

The regulatory driver and deadline. Is this a prime-contractor flow-down demanding CMMC Level 2 by a specific date? A hospital-system BAA deadline? A cyber-insurance renewal with a new security questionnaire? A breach that already happened and needs forensics on a 72-hour regulatory-notification clock? The driver and the deadline shape every recommendation we make. Without them, we are guessing.

The current-state stack at a high level. Not a full inventory. Just: Microsoft 365 or Google Workspace? On-prem file servers, cloud-only, or hybrid? How many physical sites? Any specialty systems (ERP, EHR, CAD, PLM, lab instruments, legacy line-of-business apps)? This lets us estimate scope within the first call rather than treating the assessment itself as the intake.

Who signs the statement of work. A CEO, CFO, general counsel, COO, or named owner. If the person calling us cannot confidently say "yes, I sign" or "my boss signs and she is on board with this conversation," the engagement is not qualified yet. That is not a judgment. It is a signal that the internal alignment work still needs to happen, and we would rather you do that first than waste your own time on our follow-up call.

If those three pieces exist, the first call can close with a real next step: assessment proposal in hand, or a referral out, or a written "come back to us in 90 days when your RFP closes." All three are respectful of your time.