Three engagements, each with a fixed scope, a fixed fee and a fixed end date. Buy one, or run them in sequence. Nothing is billed hourly and the scope does not move without your written agreement.
Choose by situation
| If this is true | The service | What you end up with |
|---|---|---|
| A customer sent a security questionnaire, an insurer wants specifics, or the board asked what protects the business | Security Program Deployment | A documented program, evidence it operates, and a ninety-day roadmap with owners |
| You would be improvising if something happened tonight, or your plan has never been read aloud | Incident Readiness Deployment | A plan in force, playbooks, a tested team, and the gaps closed |
| You have a roadmap from us or anyone else, and nobody independent is checking it | Program Support | Monthly verification of what actually closed, and documentation kept current |
The services
Assess, document, implement, train, verify. Controls established against evidence, a documentation set tailored to your environment, an improvement roadmap your team executes, and confirmation each action genuinely closed. Foundation covers 123 core controls; Full Program covers all 242.
Learn moreReadiness assessed against evidence rather than intentions, a complete response set deployed and tailored, a ninety-minute facilitated exercise with your own people, incident training, and verification that the gaps found are closed.
Learn moreMonthly. A defined number of roadmap actions verified against their criteria, the risk register and tracker maintained, documentation updated as frameworks move, and a management report that goes to you rather than to whoever did the work.
Learn moreHow every engagement runs
Everything that could become an argument later is written down before the work starts.
| 01 Scoping | What is covered, what is excluded, what evidence we need and from whom. Signed before anything begins. |
| 02 Evidence | The request is issued at scoping with named owners and dates. Nothing we ask for later is a surprise. |
| 03 Fieldwork | Each control assessed against evidence, with the population, the sample and any limitation recorded. |
| 04 Review | One consolidated round. Facts corrected without argument. Severity disagreements recorded alongside the finding, not instead of it. |
| 05 Briefing | What we found, what it would cost you, and a ninety-day plan with owners and verification criteria. |
If we find something urgent, you hear about it the same day. We do not hold serious findings for the report.
Boundaries
Before you buy anything
Take the free readiness assessment, send us the result, and we will spend forty-five minutes going through it at no charge. If our honest view is that you do not need a paid engagement yet, we will say so.