Cloud cost and security services
Cloud Cost and Security Retainer for Public Agencies
Kapstone Systems reduces an agency's Azure and AWS spending and reports its cloud security posture every month, for a flat fee priced below the savings identified.
The service is designed for county and city governments, public health departments, tribal programs, school districts and special districts that operate in Azure or AWS without a dedicated cloud engineering team.
The problem
Spending that is not reviewed, and risk that is not visible
- Resources sized once and never revisited. Development environments run continuously, logs are retained at full price, and no one is assigned ownership of the bill.
- Grant-funded systems outlive their grants. Resources deployed for a project continue to accrue charges after the project ends.
- Security posture is not visible to leadership. The cloud provider's own assessment tools are available, frequently at no additional cost, but their findings are not reviewed.
Record
Experience applied
The founder of Kapstone Systems reduced a state agency's Azure spending by more than 20 percent through rightsizing, scaling idle containers to zero, autoscaling, scheduled compute, storage tiering, reservations, budgets and alerting, tagging and log-retention tuning.
25+ years in information technology. AWS and Microsoft Azure certified. Experience in HIPAA/HITECH and 21 CFR Part 11 regulated environments.
Engagement
Three steps, each confirming the value of the next
Snapshot (no cost)
A 30-minute session in which agency staff share their own cost and security dashboards. Kapstone Systems returns a one-page summary of the five largest findings with an estimate of annual savings. No credentials are shared.
Assessment ($4,500 fixed)
A full review of cost and security posture, a prioritized remediation list with estimated savings per item, and a 30-minute briefing for agency leadership. If annual savings identified are less than twice the fee, the fee is refunded.
Retainer (monthly)
Monthly cost and posture reports, hands-on remediation within the included hours, and a monthly check-in. The monthly fee is set at or below half of the monthly savings the assessment identifies.
Retainer pricing
Three retainer levels, flat monthly fees
Fees are flat and are not calculated as a percentage of savings. Additional work outside the included hours is quoted separately.
Essentials
$2,000/month
Approximately 4 hours per month. Flat fee; 12-month term billed monthly.
- Monthly cost report with anomaly review
- Monthly security posture report
- Up to 2 hours of remediation
- Next-business-day email support
Standard
$3,500/month
Approximately 6 hours per month. Flat fee; 12-month term billed monthly.
- Everything in Essentials
- Up to 4 hours of remediation
- Budget, alerting and tagging policy
- Reservation and savings-plan management
- Quarterly briefing for agency leadership
Plus
$5,000/month
Approximately 10 hours per month. Flat fee; 12-month term billed monthly.
- Everything in Standard
- Up to 8 hours of remediation
- Audit and ATO evidence support
- Deployment of Kapstone hardened images
- Priority response
Access and security
Least-privilege access within the agency's own tenant
- Azure: read-only access delegated through Azure Lighthouse for security posture; cost data through the Cost Management Reader role on a guest account or a cost export the agency provides. Elevated roles are time-limited and used only for approved changes.
- AWS: a cross-account read-only role; a separate change role enabled by the agency when remediation is scheduled
- No agency data is copied out of the agency's environment; no software or agents are installed
- Every change is approved in advance, made within the agency's change window and logged in the agency's own tenant
- Multi-factor authentication on every Kapstone Systems account
Tools
The cloud provider's own tools
Findings come from tools the agency already has: Azure Cost Management, Azure Advisor, Microsoft Defender for Cloud and Azure Policy; AWS Cost Explorer, Trusted Advisor and Security Hub. Kapstone Systems converts those findings into a monthly report and a prioritized action list.
Some provider tools carry their own charges at higher tiers. Any such charge is identified and approved by the agency before it is enabled.
Procurement
Sized for small-purchase procurement
The first-year cost of an assessment and a 12-month retainer is designed to fall within common small-purchase limits for professional services. Each agency should confirm its own limit and quotation requirements.
| Level | Assessment | 12 months of retainer | First-year total |
|---|---|---|---|
| Essentials | $4,500 | $24,000 | $28,500 |
| Standard | $4,500 | $42,000 | $46,500 |
| Plus | $4,500 | $60,000 | $64,500 |
Quotations, a W-9, certificates of insurance and vendor registration documents are provided on request. Applicable gross receipts tax is additional. See also Procurement and the capability statement.
Scope
Included
- Cost analysis, rightsizing, scheduling, storage and log-retention tuning, reservations and savings plans
- Security posture review and remediation of configuration findings
- Budgets, alerting, tagging and governance policy
- Reporting suitable for agency leadership, auditors and security officers
Scope
Not included
- Application development and migrations (quoted as separate projects)
- 24-hour incident response and help desk services
- On-premises systems
- Any service requiring Kapstone Systems to store agency data
Frequently asked questions
Common questions
Is the fee a percentage of savings?
No. Fees are flat, which is simpler to budget and consistent with public procurement rules that restrict contingency-based fees.
What happens if the assessment finds little to save?
If the annual savings identified are less than twice the assessment fee, the fee is refunded. The no-cost snapshot is intended to establish whether meaningful savings exist before any fee is incurred.
Does Kapstone Systems install software or collect agency data?
No. The work uses the cloud provider's own tools within the agency's tenant. No agents are installed and no agency data is stored by Kapstone Systems.
Does Kapstone Systems require standing administrative access?
No. Access is read-only by default. Changes are made with time-limited elevated access, only after the agency approves them.
Are both Azure and AWS supported?
Yes. Agencies using both are reviewed in a single monthly report.
How does this relate to the hardened images?
The services are independent. Where a hardened image fits an agency's need (for example, secure file exchange or document OCR), it is recommended and deployed under the Plus level or as a separate project. See Hardened Images.
Request a no-cost snapshot
A 30-minute review of the agency's own cost and security dashboards, followed by a one-page summary of the five largest findings and an estimate of annual savings. No credentials are shared and no software is installed.
Email: info@kapstone.systems