Engagement models: how clients and partners work with us
We work directly with end clients, and as a delivery partner or subcontractor to consultancies, law firms and IT service providers who need specialist capacity. Every engagement starts with a written scope, before any commercial figure is discussed.
Four ways to work with us
Direct engagement
Full programme ownership for the client, from scope determination through to external audit. Fixed-scope proposal with defined deliverables, milestones and acceptance criteria.
Associate / subcontract
We deliver named workstreams under your brand and your client relationship — ISMS documentation, gap analysis, internal audit, supplier remediation. Common where a partner has the client but not the standards depth or the capacity.
Referral partnership
For Slovak and Romanian firms whose clients have Turkish suppliers or operations: we take the Türkiye-side work, you keep the client relationship. Reciprocal arrangements welcome.
Retained advisory
vCISO or standing compliance advisory on an annual retainer, with a defined meeting cadence and reporting calendar.
Engagement models
| Model | Best suited to | How it works |
|---|---|---|
| Fixed-scope project | Certification programmes, NIS2 compliance build, data protection programmes | Defined deliverable list, milestones and acceptance criteria. Priced as a whole against a written scope. |
| Annual retainer | vCISO, standing compliance advisory, post-certification maintenance | Fixed monthly or quarterly commitment with an agreed meeting and reporting calendar. |
| Assessment | Gap analysis, internal audit, supplier audit, pre-certification readiness review | Short, bounded engagement producing a scored report and prioritised action plan. |
| Training | Awareness, foundation and internal auditor courses | Per course or per programme, on site or online, with materials and records. |
| Day rate | Subcontract delivery, expert support, surge capacity | Agreed rate against a purchase order or framework agreement. |
Scope first, price second
Introductory call
30–45 minutes. Sector, size, scope, member state, existing documentation, and the deadline you are working to.
Written scope
Deliverable list, assumptions, exclusions and indicative timeline — before any commercial figure is discussed.
Proposal
Fixed price against that scope, with payment tied to milestones.
What we will tell you honestly
- If your deadline is not achievable with the scope you want, we will say so at the scoping stage and propose what can realistically be completed first.
- If part of the work is better done by your own team with our oversight — and it often is, because they will have to run it afterwards — we will structure the engagement that way and price accordingly.
- If a standard or a framework is not going to help you, we will not sell it to you.
- If we are not the right people for the work, we will say so.
Languages, contracting and confidentiality
Languages
English and Turkish at working level. Deliverables in English by default for all EU clients.
Contracting
Through Infosec Academy, a registered Turkish practice (infosecacademy Eğitim Danışmanlık Hizmetleri), Istanbul.
Confidentiality
An NDA before any client material is exchanged, as standard.
Document hygiene
Metadata cleaned, version control and document IDs applied to every deliverable.
Remote and on-site
Documentation and advisory remote; gap analysis, audits and training on site where they need to be.
One accountable person
Every engagement is led personally by our founder, from scoping to handover.
Let us start with a scoping conversation
Thirty to forty-five minutes is usually enough to establish scope, a realistic timeline, and whether we are the right people for the work.