How it works
From the review on your desk to the sign-off.
Here is the order things run in, who is involved at each point, and how the dates and the price are set.
A free hour on whatever's blocking you, and my written read on it within one business day.
The Get Unblocked track
These are the same four stages you saw on the home page. Under each one, I've opened up the steps it is made of, so you can see how it works, who is involved, and what you get at the end of it.
First Look
One call and one write-up. Nothing to sign.
| Step | How it works | Who's involved | What you get |
|---|---|---|---|
| The hour meeting | We spend the hour on whatever's blocking you; bring the whole thing if you have it. We go through the finding that worries you most, and I get a read on the size of the rest. Mutual NDA on request. | You, anyone you want to bring, and me | An hour of my read on your findings |
| The write-up document | Within one business day I send my initial read on what we covered, ending with a line you can forward to whoever has to approve. It is yours to keep whether or not we go further. If you go ahead, you send the Discovery Package. | Me | The write-up |
Security Sign-off Plan
What you send, what I write, and the review that turns the draft into the accepted plan.
| Step | How it works | Who's involved | What you get |
|---|---|---|---|
| The Discovery Package intake | You send what the work needs: the review itself, the standard you're held to, who has to approve, and your release date. That sets the scope. Anything that surfaces later moves the date or becomes its own work. When the package is complete, we set the plan-draft date. | You and me | The plan-draft date |
| The draft document | I read every finding and gap and write the plan. Along the way I ask you for the context the review doesn't carry: an architecture view, an hour with the engineer who owns a component. Nothing needs access to your systems. Reducing a finding means a control that covers the risk another way; accepting one means a named executive on your side signs for it. | Me, with your engineers when I need them | The draft: a register of every finding and gap with its decision; for each fix or reduce decision, the approach and the evidence that will show it was made; per decision, an owner, a date, and whether it blocks the release; and the argument behind each, in the terms your approver works in. It is in your approver's hands on the plan-draft date. |
| The Plan Review meeting | We put the plan in front of the approver together. I present the case, your engineers answer for the system, and the approver says which decisions they accept. Anything they turn down, I revise and bring back. Acceptance sets which fixes block the release and which are deferred, and the sign-off date, which you set against your engineers' capacity and ahead of your release date. | You, the approver, and me | The accepted plan, and the sign-off date |
Guided Remediation
Your engineers make the fixes; I steer.
| Step | How it works | Who's involved | What you get |
|---|---|---|---|
| Engineering Sessions meeting | We design or debug a fix on a working call, with your engineers' hands on the keyboard. Each session takes one decision from the plan and leaves with the change designed or the blocker cleared. How many a week you want available is set at acceptance. | Your engineers, as many as want to join, and me | A fix designed, or a blocker cleared, per session |
| The weekly Checkpoint meeting | We take one look at what moved, what slipped, and what that does to the sign-off date, and we re-order the remaining work so the fixes that reach sign-off soonest go first. | You, your lead engineer, and me | The week's order of work, and the date's status |
| The Evidence Review meeting | We take each blocking item back to the approver with the evidence behind it, item by item. The approver signs off once every blocking item is accepted. That is the date On Time is measured against. | You, the approver, and me | The sign-off, in writing |
Deferred Remediation
The items deferred at acceptance, at your own pace.
| Step | How it works | Who's involved | What you get |
|---|---|---|---|
| The working sessions meeting | We take one session for each remaining item, with any sessions left over from Guided Remediation carried in. | Your engineers, as many as want to join, and me | Each deferred item closed |
| The monthly review meeting | We keep the list moving and the register current. It is priced at sign-off, billed monthly, and you can cancel any time. | You and me | A register with nothing left open |
Who does what
| I do | You do |
|---|---|
| Read the review and triage every finding | Send the review, the standard, and the context I need to follow the work |
| Write the plan and the argument behind it | Decide what risk the business accepts, and sign for it |
| Sit with the approver and revise until they accept | Name the approver and get them in the room |
| Run the Engineering Sessions and hold the schedule | Commit the engineer hours and make the fixes |
| Take the evidence back to the approver | Produce the evidence each decision calls for |
How the price is set
Every price is fixed and quoted before anything starts, so no meter runs while you decide whether to ask a question. The plan is priced after the First Look, against the review you showed me and the release date you're working to. Guided Remediation is priced at acceptance, against the blocking items. Deferred Remediation is priced at sign-off, against the deferred items. The channel stays open for the length of the engagement, inside that price.