Engagements & fees
Security support,
with a clear scope.
Choose a review, a focused project or ongoing leadership. Clear deliverables, practical starting fees and a fixed scope agreed before work begins.
Starting fees for a defined scope, delivered remotely. Larger or more complex engagements are quoted individually. Delivery windows assume an agreed start and timely input from your team.
Before we begin
Agree the work.
Know where you stand.
The proposal sets out the deliverables, responsibilities, fee and timing, so you can decide with a clear view of the engagement.
No software resale and no commercial interest in your buying decisions.
What does the starting fee cover?
Each option describes a defined starting scope for remote delivery. We discuss your current position, evidence and desired outcome, then confirm the deliverables, responsibilities, timing and fixed fee in a proposal. Larger or more complex work receives its own quote.
How long will the work take?
The indicative windows shown for each project run from an agreed start, with the initial evidence available and key conversations scheduled. We confirm the timetable in the proposal, taking account of scope and your team's availability. These are elapsed delivery windows, not a promise to start within that time of an enquiry. For awareness work, the window covers the plan and initial launch; your team runs the subsequent 90-day plan. If an input or decision is delayed, we discuss the effect on the schedule.
How much time will you need from our team?
A named contact helps coordinate the evidence and the right people. We agree the conversations, document reviews and approval decisions needed for your chosen package before work starts. Your team remains responsible for business decisions and implementation outside the agreed scope. Where you already have usable findings or documents, we build on them.
Can the work use NCSC guidance as well as NIST?
Yes. NIST CSF can help structure the outcomes to review, while relevant UK NCSC guidance informs practical improvements. ISO 27001 or CIS Controls may suit your requirements too. We agree the reference framework or review questions, coverage and depth before work begins; the starting review fee covers one agreed scope.
Can you help with ISO 27001 readiness?
Yes. A review can identify the gaps and the work needed for readiness. Implementation support is then scoped around your starting point and your team's capacity. Certification-body charges, independent audit, technical testing and any software are identified separately; certification is not guaranteed.
How does the monthly time work?
Two days provides 15 hours each month; four days provides 30 hours. Meetings, preparation, evidence review, advice and reporting all use that time. Initial discovery is included within the allocation, and we agree what can be achieved in it. Any additional work and fee are agreed before it starts.
Should we choose two or four days a month?
Two days can suit a focused set of priorities when your team can carry out the work between reviews. Four days gives more room for stakeholder discussions, evidence review and follow-through across the agreed priorities. We assess your starting point and the work you need before recommending an allocation. Neither option includes unlimited access, emergency response or delivery of every control.
What commitment does a retainer involve?
The proposal sets out the initial term, how the arrangement continues, the notice needed to change or end it, and how unused time is handled. We agree those terms before the engagement starts, alongside the monthly allocation and priorities.
What if the scope changes?
We discuss the change and agree its effect on the work, fee and timing before proceeding. Any on-site visits, travel or third-party costs are identified and agreed separately. You can also use the outputs with your own team without taking an ongoing retainer.