Trust comes from
clear responsibilities.
Secure. Trust. Efficient. These principles guide how an engagement is defined, evaluated, and delivered.
Project-specific requirements
Security requirements start with the information, users, systems, and responsibilities involved. Work with the client’s designated IT and process owners to establish access, information handling, review, and support requirements before implementation.
A software provider’s certifications do not automatically certify an application or its configuration. Relevant claims and evidence need to be checked for the proposed deployment and applicable scope.
Appropriate specialist involvement
An operational assessment can identify concerns that require deeper investigation. Technical security testing, legal interpretations, accounting assurance, and other specialist conclusions require the appropriate expertise and authorization.
The engagement should name who performs the work, who reviews it, and who accepts the result.
Information handling and AI
Use only information authorized for the engagement. Define secure exchange methods and minimize unnecessary copies. Client records and credentials should not be submitted through this website’s project-brief tool.
Before AI is used with client information, establish approved providers, data boundaries, retention considerations, accuracy testing, and human review. A proposed automation must preserve the organization’s required approvals.
Vendor relationships and delivery ownership
If a project includes referral, resale, or white-label licensing, disclose the relationship and confirm the relevant rights. Contracts should establish responsibility for hosting, configuration, incident handling, maintenance, data ownership, and exit.
Acceptance and ongoing support
Define acceptance criteria before launch. Important controls should be tested using appropriate scenarios and independent expertise where needed. Training and documentation help staff understand ordinary work and exceptions.
An ongoing support agreement should specify included tasks, response expectations, exclusions, escalation routes, and ownership. It should not imply that a general support retainer covers the client’s entire cybersecurity environment.
A practical starting point
Start with the process that needs attention.
Tell us where work slows down. We will help define an appropriate first step.