Packaged advisory engagements across six governance domains.

Every domain opens the same way

A Current State Assessment establishes the baseline, produces the evidence-based TruMaturity score, and generates that domain’s maturity roadmap.

The roadmap decides the order

Offerings are sequenced against assessed gaps rather than sold as a bundle. Most engagements start with a handful, not the whole menu.

Refreshed, not re-sold

The maturity roadmap is refreshed at each quarterly governance review rather than repurchased as a separate engagement.

The full security governance lifecycle.

From readiness and governance through identity, technical assessment, penetration testing, operations, and resilience. The Security Maturity Roadmap is produced within Offering 1 and refreshed at each quarterly governance review.

A comprehensive baseline of security posture across governance, technical controls, and operational readiness. The front-door engagement — stands alone or feeds the rest of the domain.

Design and documentation of the structures, roles, decision-making processes, and accountability mechanisms needed to govern security across the organization.

Development of the core security policy set — the operational rulebook governing acceptable use, access control, incident response, and third-party security requirements.

A reporting program that translates technical security findings into business-relevant metrics, with a repeatable cadence and a materiality framework.

A structured third-party risk program from vendor tiering and assessment methodology through continuous monitoring and contract standards.

A target-state IAM strategy spanning architecture, privileged access management, access governance, and authentication modernization.

Ownership, access scoping, and lifecycle control for the identities that do not belong to a person — a population that typically outnumbers human accounts.

Assessment of security posture across cloud and SaaS environments, addressing the configuration, entitlement, and consistency challenges of multi-cloud and hybrid architectures.

Assessment and design of the security operations function — in-house, outsourced, or hybrid — covering operating model, tooling, and detection coverage.

Business continuity and disaster recovery capability, from business impact analysis through recovery plan documentation and exercise facilitation.

A focused resilience program ensuring identity infrastructure itself can be recovered after compromise — a capability most organizations have never documented or tested.

An early-stage assessment of exposure to quantum computing risk, establishing a cryptographic inventory and a phased migration path toward post-quantum cryptography.

Broad-coverage identification of exploitable weaknesses through automated and manual assessment, paired with a focused evaluation of ransomware-specific exposure.

A hands-on adversarial simulation against network, applications, and workforce to validate whether controls hold up under active exploitation — proving impact rather than flagging theory.

Role-based training, phishing simulation, and a champion network to sustain security-conscious behaviour beyond initial training.

The full AI adoption lifecycle.

From readiness and governance through agentic risk, cost governance, use case analysis, and workforce strategy. The AI Maturity Roadmap is produced within Offering 1 and refreshed at each quarterly governance review.

A baseline assessment of readiness for AI adoption across technology, data, cybersecurity, governance, workforce, and procurement — including a shadow AI review. The front-door engagement.

Design of the structures, roles, and approval processes needed to govern AI responsibly before deployment begins, including steering committee and advisory council design.

Development of the Enterprise AI Policy — the operational rulebook covering acceptable and prohibited use, data handling, human-in-the-loop requirements, transparency, and vendor standards.

A targeted assessment of what Co-Pilot can see, whether M365 security controls are hardened, and whether sensitive data is exposed — with prioritized hardening recommendations.

Assessment of what deployed AI agents are authorized to decide and do autonomously, where oversight controls are missing, and what happens when an agent acts on incorrect information.

Cost governance for AI and GenAI spend — attribution, unit economics, forecasting, and optimization adapted to token pricing, GPU capacity, and training-versus-inference cost structures.

Structured discovery and evaluation to identify where AI creates genuine operational value, with ROI analysis and business cases for the top pilot candidates.

How AI adoption changes the operating model — which roles and workflows are augmented, displaced, or created, and how service delivery changes as a result.

A workforce readiness assessment and change management plan covering role-based proficiency targets, training strategy by tier, and an AI champion network.

Hands-on build, deployment, and execution of approved pilots through to measured results and a go/no-go recommendation.

For software platform and product teams building AI-assisted features into their own products: context architecture, model routing, evaluation, guardrails, and audit-ready telemetry.

Grounded in the COSO ERM Framework.

From readiness and governance through quantitative risk modeling, operational resilience, third-party risk, emerging risk, crisis management, and insurance strategy. The Risk Maturity Roadmap is produced within Offering 1.

A baseline against the COSO ERM Framework’s five components — governance and culture, strategy and objective-setting, performance, review and revision, and information and communication.

Design of the governance structures, reporting lines, and operating model that embed risk management into board oversight and daily decision-making.

Risk appetite and tolerance statements by category, escalation thresholds, and the risk acceptance and exception process.

Building or refreshing the enterprise risk register through structured workshops tied explicitly to strategic objectives.

Quantitative modeling of prioritized risks, translating register entries into dollar-denominated exposure ranges that support risk-informed decisions.

An enterprise-level impact analysis covering people, facilities, suppliers, and processes — complementing rather than duplicating technical BC/DR work.

An enterprise view of financial, operational, and concentration risk from suppliers and partners — the risk counterpart to technical vendor security assessment.

A recurring process for identifying and assessing emerging technology, geopolitical, regulatory, climate, and workforce risks before they become register entries.

Crisis management capability and scenario-based stress testing of the risk profile against severe-but-plausible events.

A review of insurance program adequacy relative to quantified exposure, with recommendations for risk transfer and financing strategy.

Training and culture work that builds risk-aware decision-making among department leads and reinforces accountability for risk ownership.

Grounded in the DOJ ECCP.

Covering readiness, governance, risk assessment, regulatory gap analysis, training, whistleblower protection, and third-party and M&A due diligence. The Compliance Maturity Roadmap is produced within Offering 1.

A baseline against the ECCP’s three fundamental questions — is the program well designed, is it adequately resourced and empowered, and does it work in practice.

Design of the compliance function’s structure, reporting lines, independence, resourcing adequacy, and audit committee reporting cadence.

The code of conduct and a policy library mapped to applicable regulatory obligations, with a defined lifecycle and attestation process.

Design and execution of the compliance risk assessment methodology, incorporating the DOJ’s current emphasis on emerging technology and AI risk.

Framework-by-framework gap analysis with sample-based controls testing to validate that documented controls operate effectively in practice.

A training program that is accessible and role-appropriate rather than a one-size-fits-all module, with effectiveness measurement beyond completion tracking.

Design of the confidential reporting mechanism, investigation standards, and anti-retaliation controls, reflecting heightened regulatory focus on reporting culture.

Third-party risk tiering, due diligence standards by tier, sanctions screening, contract clause standards, and ongoing monitoring.

Compliance due diligence and post-acquisition integration process, including the post-acquisition audit that surfaces inherited issues in time to act.

Whether compliance has adequate access to relevant data, and whether the analytics used for monitoring are validated for accuracy — a growing area of regulatory scrutiny.

Review and design of incentive structures and disciplinary consistency, so compliant behaviour is rewarded and misconduct is addressed regardless of seniority.

Grounded in the NIST Privacy Framework.

Covering readiness, governance, data mapping, impact assessment, rights fulfillment, cross-border transfer, incident response, and AI privacy risk. The Privacy Maturity Roadmap is produced within Offering 1.

A baseline against the NIST Privacy Framework’s five functions — Identify-P, Govern-P, Control-P, Communicate-P, Protect-P — mapped to applicable regulatory obligations.

Design of the structures, roles, and accountability mechanisms needed to govern privacy responsibly.

The core privacy policy set — public-facing notices, internal handling standards, consent mechanisms, and vendor and processor contractual requirements.

Technical mapping of personal data flows across systems, vendors, and processes, producing the ROPA required under GDPR and equivalent documentation elsewhere.

A repeatable PIA/DPIA methodology and execution of initial assessments for identified high-risk processing activities.

The end-to-end process for receiving, verifying, and fulfilling access, deletion, correction, and opt-out requests across applicable regulations.

Assessment and governance of personal data transfers across borders and through processors, ensuring lawful transfer mechanisms and contractual safeguards.

Privacy incident response capability including breach detection, assessment, and regulatory and individual notification procedures.

Privacy risk arising from AI systems and automated decision-making — profiling disclosure obligations and opt-out rights — coordinated with the AI Governance domain.

How embedding privacy-by-design changes existing workflows across product, engineering, and business functions.

Training and change management so the workforce understands privacy obligations and is equipped to act on them.

Grounded in the DAMA-DMBOK framework.

Covering readiness, governance, architecture, master data, quality, metadata, integration, analytics enablement, and data ethics. The Data Maturity Roadmap is produced within Offering 1.

A baseline across the DAMA-DMBOK’s eleven knowledge areas, anchored on Data Governance at the centre of the DAMA Wheel.

Design of the Data Governance Council, the steward and owner network, and the decision-making structure that anchors every other knowledge area.

The core data policy set — classification scheme, retention and lifecycle policy, access standards, and quality standards.

A technical assessment of data architecture and modeling practices — reference architecture, data models, and alignment to business strategy.

An MDM program establishing golden-record standards for core business entities such as customer, product, vendor, and employee.

Design and initial execution of a data quality program — measurement, monitoring, and remediation prioritization across priority data domains.

A metadata management program and data catalog approach, providing the searchable inventory that underpins governance, quality, and AI-readiness work.

How data moves between systems — integration architecture, API standards, and the interoperability gaps that affect quality and availability.

Assessment and design recommendations for the warehousing and analytics platform, so governed data supports reliable self-service reporting.

Training and change management that builds data literacy across the workforce and stands up the steward network.

Assessment of data ethics practices and preparation of governed data pipelines to support AI use cases responsibly, coordinated with the AI Governance domain.

Establish the governance baseline: ownership, assessment, charter, and the core policy set in the domain under the most pressure.

Integrate the governance functions so evidence, reporting, and review cadence are shared across domains instead of duplicated.

Enterprise governance architecture: quantified risk, cross-domain measurement, and reporting that feeds decisions rather than describing them.

Each domain has an executive counterpart — vCISO, vCAIO, vCRO, vCCO, vCPO, vCDO. A standing seat is available where the roadmap calls for someone accountable week to week, rather than as the default engagement model.

Hour ranges and rates are provided in a written proposal against the scope drivers for each offering. Enterprise and government engagements are always custom-scoped.