Three Ways to Work With Sitoo.
Engagement model options
Fixed-scope projects, an ongoing advisory retainer, or stay-through-closure remediation — each model is designed to match where you are, not lock you in. No retainer required to start.
Fixed Fee. Fixed Scope. Fixed Deliverables.
The right starting point for organizations with a defined need and no appetite for open-ended hours. A gap assessment, SOC 2 readiness sprint, DPIA, data inventory, or incident response plan — scoped, priced, and delivered against milestones. You see the full scope and fee before work begins, and every deliverable is defined in the SOW before you sign.
Project-based engagements are ideal for organizations evaluating advisory fit before a longer commitment, or those with a specific compliance deadline and a clear deliverable to produce. Retesting of remediated controls is included in project scope — not a separate invoice.
Signed SOW Before Work Begins
Defined deliverables, timeline, and acceptance criteria agreed before any work starts. No scope creep, no moving goalposts, no surprise fees.
Milestone-Based Payment
Payment tied to defined milestones — not hours. You pay for completed, accepted deliverables, not time on the clock.
All Work Product Delivered
You receive every deliverable regardless of whether you continue the engagement. No retainer required to unlock the output of your project.
Retesting Included in Scope
Every assessment and readiness project includes a retesting milestone. Closure is a deliverable, not an option.
The Accountability Function Without the Full-Time Hire.
A monthly retainer that gives you a named, certified advisor, structured governance support, and ongoing security and privacy program oversight — at a fraction of the cost of an in-house hire. This is the model for organizations that want a credible, independent advisor on call between projects, operating with a documented scope and reporting directly to senior management.
Most teams don’t need a fresh statement of work every time a question comes up — they need a trusted advisor who already knows their environment. The retainer provides that continuity: a named advisor, a predictable monthly cadence, and the governance function your boards, auditors, and enterprise clients expect to see.
Named Advisor & Defined Scope
A named, certified advisor with a documented scope of engagement and a direct reporting line to senior management — continuity you can count on, not a rotating bench.
Monthly Office Hours
Regular availability for internal questions, ad hoc reviews, data subject requests, and emerging regulatory questions — without waiting for a new SOW.
Board & Executive Reporting
Quarterly risk dashboards and plain-language briefings for senior management and boards — covering posture, open risks, regulatory calendar, and remediation status.
Regulatory & Audit Liaison
Support for regulator, auditor, and enterprise-client inquiries — evidence packages, security questionnaire responses, and cross-border transfer documentation.
Quarterly Project Block
One structured project per quarter — DPIA, policy refresh, assessment cycle, or TPRM review — included in the retainer and not separately invoiced.
Retesting on Quarterly Projects
Remediation work completed within the quarterly project block includes retesting as a deliverable — no separate billing to close the loop.
We Stay Until the Gap Is Closed.
A structured remediation engagement that goes from roadmap through implementation through verified closure — not just findings and recommendations left for your team to interpret. We document the gap, design the fix, oversee implementation, retest the control, and produce the closure report. The engagement does not end when we deliver the roadmap. It ends when the gap is closed and the evidence is documented.
This model is for organizations that have already received a gap assessment, audit finding, or regulator inquiry — and need to close the finding, not just understand it. The closure report produced at the end is structured for board reporting, cyber insurance underwriting, and regulatory response.
Remediation Roadmap
Prioritized, effort-sized action plan with defined owners, timelines, and dependencies — sequenced for your team’s capacity and budget.
Implementation Oversight
We review, advise, and verify at each milestone — not as a bystander but as the accountable advisor through to closure.
Retesting of Every Control
Every remediated control is retested and documented in the SOW. No findings remain open-ended at engagement close.
Closure Report & Evidence Package
A structured closure report documenting before/after control state with evidence — suitable for board presentation, insurer review, or regulator submission.
Not Sure Which Model Fits?
A 20-minute scoping call is enough to recommend the right engagement structure for where you are. No commitment required, no sales pressure.