Engagement models

Three ways to engage. Scoped to you.

Every engagement is advisor-led and priced to the size and complexity of your environment — there is no per-seat license. The structure below is the usual shape; the exact scope is set after a short scoping conversation.

Assessment

One-time · fixed scope
By engagementTypically 2–4 weeks
  • Full NIST CSF 2.0 assessment
  • Maturity scorecard & posture radar
  • 30/60/90 remediation roadmap
  • Coverage determination memo
  • Executive read-out
Scope an assessment

Program Build

Project · assessment + build
By engagementTypically 6–10 weeks
  • Everything in Assessment
  • Full policy & procedure set, drafted
  • Facilitated tabletop + after-action report
  • Reg S-P or FTC exam-readiness file
  • Registers, evidence file & breach clock
Scope a build

Retained vCISO

Ongoing · annual relationship
By engagementMonthly or annual
  • Everything in Program Build
  • Scheduled reassessment & trend reporting
  • Policy upkeep & new-vendor review
  • Quarterly threat & regulatory briefings
  • On-call advisor for incidents
Discuss a retainer

Decision-support, not an audit, certification, or legal advice. Engagements can be run entirely within your own environment.

Why advisor-led

Judgment, delivered through software — not a login.

Commodity tools hand you a dashboard and leave you to it. The hard parts of this work — deciding which rules apply, whether a control truly satisfies an obligation, whether an incident triggers a notification — are judgment calls a tool can't safely make alone. So we don't sell you software — we do the work alongside you, and the work (and the data) can stay entirely within your own environment.

A retained relationship

A fractional, virtual-CISO relationship: recurring assessments, policy upkeep, facilitated tabletops, and the roadmap project-managed to closure.

An adversary's eye

An intelligence-trained threat lens a SaaS can't credibly offer — social-engineering and wire-fraud drills, threat briefings, and the human attacker's perspective.

Discretion by design

Built for clients who value privacy: nothing is published, the engagement is confidential, and your data never has to leave your roof.

Illustrative scenarios

What an engagement changes.

Illustrative, hypothetical scenarios — not actual clients — that show the kind of change an engagement is designed to produce. Every real engagement is confidential, and nothing is published without written consent.

Single-family office

From "we think we're fine" to a real program

Situation: A family office moving large wires with informal email approvals and no written security program.
What we'd do: Full assessment, wire-authorization controls, an incident-response plan, and a wire-fraud tabletop with staff.
1.4→2.8
Avg maturity
0
Unverified wire paths left
State-registered RIA

Exam-ready ahead of the deadline

Situation: A registered adviser unsure whether it met the FTC Safeguards Rule, with an exam on the horizon.
What we'd do: Coverage determination, named Qualified Individual, MFA/encryption gaps closed, and a complete Safeguards evidence file.
100%
Safeguards items mapped
30d
Breach clock in place
SEC-registered multi-family office

One assessment, two regulatory lenses

Situation: Growing MFO subject to Reg S-P with fragmented vendor oversight.
What we'd do: CSF assessment doubled as a Reg S-P readiness file; vendor register flagged missing 72-hour clauses; roadmap project-managed to closure.
22
Reg S-P reqs tracked
9
Vendor gaps remediated
Begin

Let's scope the right engagement.

A confidential, no-obligation conversation about your firm or family office, what you're protecting, and which model fits.

Start the conversation →