Engagement Models

Engagements shaped to your need.

Start with a fixed-scope assessment, commission a full program build, or retain senior advisory and vCISO leadership. We recommend the right fit after the first conversation, and every engagement is scoped in writing before work begins.

Model 1

Fixed-scope assessment

Know exactly where you stand.

A defined assessment with a clear deliverable and timeline. The fastest way to an independent, expert view before you commit to a larger program.

Typically includes

  • —Gap assessment against one or more frameworks
  • —Audit or certification readiness review
  • —Risk assessment (NIST SP 800-30, ISO/IEC 27005)
  • —Findings report with prioritized remediation roadmap
  • —Executive read-out

Duration depends on scope; agreed before work starts.

Model 2

Program build

Design it, stand it up, hand it over.

A multi-phase engagement to design and stand up a security, privacy, resilience, or compliance program that your teams can operate.

Typically includes

  • —Governance structure, roles, and ownership
  • —Policies, procedures, and standards
  • —Controls mapped once across applicable frameworks
  • —Evidence collection approach and control-owner coaching
  • —Readiness support through the first audit or assessment

Phased; each phase has its own scope and deliverables.

Model 3

Retained advisory / vCISO

Senior leadership, on a steady cadence.

Ongoing senior support on a monthly retainer, including vCISO, fractional CISO, fractional CTO, CISO advisory, and executive advisory.

Typically includes

  • —Security governance and priority setting
  • —Board and executive reporting
  • —Audit, customer review, and vendor-risk oversight
  • —Incident response leadership support
  • —Ongoing compliance operations

Monthly retainer; scope and hours agreed up front and reviewed regularly.

Every engagement is priced to its scope and agreed in writing before work begins, so you know the cost and the deliverables up front.
How every engagement runs

A disciplined method, every time.

01 · SCOPE

Define boundaries, obligations, assets, and applicability before assessment work begins.

02 · ASSESS

Evaluate controls and risks using documented criteria and relevant evidence.

03 · EVIDENCE

Connect findings and decisions to traceable supporting artifacts.

04 · REVIEW

Review recommendations with you, so every decision has a clear, accountable owner.

05 · IMPROVE

Build remediation and retesting into the plan from day one.

06 · REPORT

Deliver results leadership can understand and defend.

Find the right fit.

Tell us about the requirement and timeline. We will recommend an engagement model and scope it with you.