Services / 03 · Projects

Scoped projects. Hourly rate.

Migrations, identity, firewalls and continuity — scoped in writing, documented, and delivered at $165/hr. Work with the right depth of planning and verification so outcomes don't slip on cutover day. No managed agreement required to buy one.

Request an assessment Project rates

What is delivered

Four families of project, and what each one actually contains.

Scope defines delivery. A migration with a clear cutover window, an identity build, a network hardening — these are scoped precisely in writing. Work is charged at $165/hr; a typical project runs 40–120 hours depending on environment size and complexity. Estimates are provided upfront so you know the range.

Migration

The projects where the risk is entirely in the cutover, and the cutover is entirely in the preparation.

Microsoft 365 migration from POP/IMAP, Google Workspace, or on-premises Exchange
Google Workspace ↔ Microsoft 365, either direction
Tenant-to-tenant migration after an acquisition
On-premises file server to SharePoint and OneDrive, with permissions rebuilt rather than copied
Server to cloud or VPS, lift and shift, per server
Cloud repatriation — bringing workloads back off public cloud when the bill stopped making sense

Identity

Where small-business compromise now actually starts. Almost nobody in this market sells it as a project.

Entra ID and hybrid identity implementation
Conditional access and MFA rollout across every user, including the executives who negotiated an exemption
Intune and Autopilot device management build
Joiner / mover / leaver process, written down and actually followed
Privileged account separation — day-to-day accounts stop being domain admins

Network & infrastructure, on gear that exists

Configuration, hardening and cutover. The cable plant is a licensed trade and is contracted by you — see section 03.

Firewall replacement: ruleset rebuild, VLANs, VPN, documentation, cutover, racked into your existing rack
Site-to-site VPN tunnels between offices you already have
Network segmentation and hardening on existing switching
Wireless design, channel plan and RF tuning on access points already mounted
Server build and deployment, physical or virtual
Hypervisor cluster build — Proxmox, ESXi, Hyper-V — two or three nodes with failover
On-premises backup target deployment and configuration

Security & continuity

Bounded engagements that leave behind evidence, not a feeling.

Security baseline hardening mapped to CIS Controls IG1 across endpoints, Microsoft 365 and the network
Backup and DR design to a 3-2-1-1-0 shape, implemented and proven by a live restore
Backup and DR audit with a live restore test — roughly half of environments tested reveal gaps
Email authentication: SPF, DKIM and DMARC taken to p=reject with reporting, a configuration we operate in production
Written IT policy set: acceptable use, incident response, access control, BYOD, data retention
Tabletop incident-response exercise with your actual staff, not a slide deck
IT documentation build: network diagram, runbooks, asset register, credential vault, DR plan
Cyber-insurance questionnaire completion with a remediation plan for the answers that are currently no

Out of scope

Five things no quote from us will ever contain.

This is not modesty. California B&P §7031(b) lets a client sue to recover every dollar they ever paid for work that required a contractor’s licence and did not have one — flawless delivery is no defence, and no insurance policy covers disgorgement. A provider who quietly puts cabling on the same invoice as the firewall is handing you a contract that can be unwound years later. So the boundary is published instead.

Cable plant, jacks, patch panels, and anything mounted: New runs through walls or ceilings, terminating jacks, fastening a patch panel or wall rack to the structure, cable tray, raceway, drilling any penetration, and mounting an access point or camera are all C-7 low-voltage contracting under California B&P §7026. The Holm Team does not hold that licence and will not sub it out under our own contract — taking the job and subcontracting it makes us an unlicensed prime, which is worse. We write the specification and the drop schedule; you contract a licensed C-7 directly.
Electrical work: New circuits for a rack, receptacles, hardwiring a UPS or PDU, and conduit are C-10 electrical work. Plugging equipment into a receptacle that already exists is not, and that part is ours.
Alarm systems, monitoring, and door hardware: Installing, servicing, monitoring or responding to an alarm system requires a Bureau of Security and Investigative Services licence. Locks, strikes and maglocks are locksmith work. On access-control projects we handle the controller software, the credential directory, the network and the integration; the door itself is someone else's contract.
Forensic investigation for a dispute: Reconstructing an incident to fix it and to inform your insurer is systems work and we do that. Attributing an act to a named person, or producing findings intended for a proceeding, is licensed private-investigator work under B&P §7521. That goes to your attorney, who retains a licensed investigator — which also gets you privilege, the better outcome anyway.
Voice service under our own invoice: We will implement, integrate and support your phone system. We will not resell dial tone: billing you for voice service under our own brand would make us a carrier subject to CPUC registration, a performance bond and FCC filings. The carrier contracts with you and bills you directly.

What this means in practice on a whole-office project: we produce the design, the equipment specification, the drop schedule and the acceptance criteria; the licensed trades contract with you directly and are held to our specification; and we own everything from the moment it has power and a link light. You get a specialist on each half instead of a generalist on both.

What we need from you

The five conditions every project is built on.

Scoped projects are only honest if the assumptions behind them are written down. They appear in the statement of work rather than in the small print of an invoice afterwards.

A change window, agreed in writing: Cutovers happen when the business can absorb one. Evenings and weekends are available and priced accordingly. Nobody migrates a mail platform on a Tuesday at 10am because a calendar said so.
One decision-maker who can say yes: Not a committee reachable only by email. Projects overrun on approval latency far more often than on technical difficulty.
Administrative control of what is being changed: Tenant global admin, DNS, registrar, and current firewall credentials. If a prior provider holds any of it, recovering that access becomes step one and gets scoped explicitly rather than discovered at 2am on cutover night.
A verified backup before anything is touched: Every project starts by proving the rollback works. If your current backup cannot be restored, the project starts with fixing that — we identify this at scoping rather than at rollback time.
Licensing and hardware bought in your name: Subscriptions and equipment stay yours, purchased directly or through us at a stated markup. You should never be one commercial disagreement away from losing your own tenant.

Next step

Start with discovery.

The IT Health & Risk Assessment is discovery work at $165/hr (typically 20–40 hours) that clarifies your environment, identifies risks, and enables accurate project scoping. Assessment hours are credited fully against any subsequent project work if you engage within 30 days.

Request an assessment

Remote project delivery · serving businesses nationwide