The platform is usable on day one because the frameworks and the control library ship with it. What takes the time is getting your own controls, evidence and history into it, and making sure the people who have to keep it current actually can. That is what these engagements are for.
Each one has a duration and a list of what you receive. Take any of them on its own, or the first with any of the others.
Two to four weeks01 · Core
Implementation
Get the platform running against the frameworks you report on, with what you already have loaded into it. Cloud deployments are usable on day one; this is the work that makes them useful.
Deliverables
Your frameworks switched on and mapped to the control library
Existing policies, procedures and evidence loaded and linked
Roles and approval chains scoped to your organisational units
The people who will use it trained on their part of it
Where you actually stand against a framework, requirement by requirement. The output is the remaining work as owned tasks with dates, not a percentage on a slide.
Deliverables
A position on every requirement, with the evidence behind it
Gaps written as tasks against named owners
An inventory of the evidence you hold and what has aged out
A report you can take to a committee without rewriting it
Almost everyone arrives from spreadsheets, email threads and folders of PDFs. That baseline is the starting point, not something to throw away and retype.
Deliverables
Risk register imported with your scoring preserved
Your control set mapped onto the shared library
Evidence filed against the control it proves
A written record of anything that could not be mapped cleanly
Rehearse the examination before the examiner arrives. Most findings are not surprises about your security; they are gaps in what you can show and how quickly.
Deliverables
Evidence completeness checked against the scope being examined
Expired and missing evidence flagged and refreshed
Auditor access scoped to read-only on the right records
Sample requests answered from the platform rather than by email
The shape is the same whichever engagement you take. Only the third phase varies much in length, and it varies with how much you already have.
01
Scope
One call. Which frameworks you report against, how many people need access, where it has to run, and how much you already have written down.
One call
02
Configure
Frameworks switched on, organisational units and roles set up, approval chains agreed. Nothing here is a code change, so it moves in days rather than months.
Two to four days
03
Load
Your policies, register and evidence go in and get linked to the controls they support. This is the week that decides whether the platform is useful to you.
One to two weeks
04
Hand over
Training for the people who will live in it, then we step back. It stays your programme; we are not a seat at your compliance function.
Sign-off, then it is yours
Isolation architecture
Four deployments, one product
The same platform and the same 8 frameworks in every case. What changes is where the data sits and whether AI assistance is available at all.
