Written Scope Qualification
Select your target architecture and submit your infrastructure parameters (cloud provider, identity/SSO, CI/CD workflow, AI models, and current control maturity) via our written intake form.
ISO/IEC 27001 · ISO/IEC 42001 · SOC 2 · EU DORA
Audit-ready documentation. Engineered for your systems.
We design and engineer custom compliance policies, relational control registers, and audit-preparation documentation mapped to your actual cloud environment. Delivered in editable Word (.docx), Excel (.xlsx), and Git-ready Markdown (.md) files on a fixed-scope schedule from 10 business days.
Standalone or GRC-Ready: Works directly in Git, SharePoint, or Confluence, and imports into Vanta, Drata, Secureframe, and Sprinto custom policy slots. Strict ISO/IEC 17021-1 non-attestation boundary.
01 · Core$2,900 · 10 Days
02 · Integrated$4,800 · 15 Days
03 · Multi-SuiteFrom $7,500 · 20d
10-20 BUSINESS DAYS
Fixed-scope engineering schedule
.DOCX · .XLSX · .MD
100% client-owned native files
60-DAY WARRANTY
Documentary integrity guarantee
Core Architecture · Single-Standard Governance System ($2,900 · 10 Business Days)
Consolidated repository (~18 documents) for ISO/IEC 27001:2022 ISMS, AICPA SOC 2 Type I/II, or ISO/IEC 42001:2023 (AI).
| Core Deliverable | Engineered Scope & Coverage | File ID |
|---|---|---|
| Governance Manual Clauses 4 to 10 / TSC |
System boundaries, 2024 climate context, leadership roles, risk methodology, and document control. | BPS-MAN-01 .docx · .md |
| Statement of Applicability 93 Controls + 5x5 Risk Ledger |
Multi-sheet workbook linking all 93 Annex A controls to Risk IDs, owners, and target evidence. | BPS-SOA-01 .xlsx workbook |
| Consolidated Policies Tailored to Cloud & IAM |
~14 functional policies covering SSO/IAM, KMS cryptography, Terraform CI/CD, IR, and BCDR. | BPS-POL-01..14 .docx · .md |
| Internal Audit Framework Clause 9.2 & 9.3 Templates |
Clause 9.2 internal audit programme, sampling matrix, and Clause 9.3 management review record template. | BPS-AUD-01 .xlsx · .docx |
Integrated Architecture · Dual-Framework System ($4,800 · 15 Business Days)
Unified repository (~26 documents) combining ISO/IEC 27001:2022 with ISO/IEC 42001:2023 (AI) or SOC 2 + 320Q Vault.
| Integrated Deliverable | Engineered Scope & Coverage | File ID |
|---|---|---|
| Unified Dual Manual ISMS + AIMS / SOC 2 |
Single harmonized governance manual satisfying two standards without duplicate procedures. | BPS-MAN-INT .docx · .md |
| Cross-Walk Matrix & SoA Bidirectional Mapping |
Maps ISO 27001 Annex A directly to ISO 42001 Annex A (A.2-A.10) or AICPA SOC 2 TSC (CC1-CC9). | BPS-SOA-CW .xlsx workbook |
| AI Impact or TPRM Vault Selected Domain Pack |
Includes either the ISO 42001 AI Impact & Model Register or the 320-Question Vendor Due Diligence Vault. | BPS-AIM / TPRM .xlsx · .docx |
| Unified Policy Suite ~20 Dual-Header Policies |
Consolidated policies covering cloud, IAM, SDLC, AI guardrails, and vendor risk in Word & Markdown. | BPS-POL-01..20 .docx · .md |
Multi-Framework Architecture · Unified Governance Suite (From $7,500 · 20 Business Days)
Unifies ISO 27001, ISO 42001 (AI), and SOC 2 + 320Q Vault, with scoped EU DORA (B_01.01-B_99.01) & ISO 27701:2025 modules.
| Multi-Framework Deliverable | Engineered Scope & Coverage | File ID |
|---|---|---|
| Master Multi-Standard SoA ISO 27001 · 42001 · SOC 2 |
Master relational control ledger unifying security, AI, privacy, and resilience requirements. | BPS-SOA-MST .xlsx master |
| EU DORA 15-Table RoI Reg. 2024/2956 B_01-B_99 |
Complete Register of Information (B_01.01 to B_99.01), CIF mapping, and Art. 30 ICT supplier pack. | BPS-DOR-01 .xlsx (15 tabs) |
| AI & Privacy Governance ISO 42001 + ISO 27701:2025 |
AI System Impact Assessment (A.5), EU AI Act file, GDPR Art. 30 RoPA, and Art. 35 DPIA. | BPS-AIM-PRI .docx · .xlsx |
| 320Q Vault & Policy Library ~36 Consolidated Documents |
Pre-answered enterprise procurement vault plus unified operational policies in Word & Git Markdown. | BPS-MST-36 .docx · .xlsx · .md |
DOCUMENTATION ARCHITECTURE · ISO 27001:2022 ISMS · ISO 42001:2023 AIMS · AICPA SOC 2 TSC · EU DORA (2022/2554) · NIST SP 800-171
01 · DELIVERABLE ARCHITECTURE
Four connected document layers in every repository.
Every engagement delivers a relational archive where risks, controls, policies, and audit evidence share deterministic IDs. Download real sample files (.xlsx, .docx, .md) →
| Architecture Layer | Core Deliverable Family | Normative Scope & Engineering Content | Native Format |
|---|---|---|---|
| Layer 01 · Risk & Assets | Semi-Quantitative 5x5 Risk & Asset Register | 5x5 likelihood/impact methodology, cloud asset boundaries, risk owners, and treatment plans (ISO Clause 6.1.2 / SOC 2 CC3). | BPS-RSK-01 (.xlsx) |
| Layer 02 · Control Hub | Statement of Applicability & Cross-Walk | Relational control matrix binding all 93 ISO 27001 Annex A controls (plus ISO 42001 Annex A / SOC 2 TSC) to Risk IDs, policies, and evidence. | BPS-SOA-01 (.xlsx) |
| Layer 03 · Operations | Consolidated System Control Policies | Functional operational policies (~18 to ~36 consolidated documents) written around your cloud provider, SSO/IAM, CI/CD, and KMS controls. | BPS-POL (.docx & .md) |
| Layer 04 · Assurance | AI Governance, DORA RoI & Audit Pack | ISO 42001 AI Impact Dossier (Annex A.5), EU DORA 15-table RoI (B_01.01-B_99.01), 320Q Vendor Vault, and Clause 9.2 readiness pack. | BPS-AIM / DOR (.xlsx) |
02 · WRITTEN ENGINEERING METHOD
Three written steps from technical intake to delivery.
All scoping, architectural mapping, and delivery occur asynchronously in writing - with explicit 5-point QA verification before handoff.
Intake Validation, Control Worksheet & Procurement
Within one business day, our engineering desk confirms your exact deliverable manifest, issues the 45-question Stage-2 Technical Control Worksheet (~25 minutes to complete), and provides your fixed-fee order (Card or B2B Invoice / PO with W-9 / W-8BEN-E).
10-to-20-Day Engineering Delivery & 60-Day Integrity Warranty
You receive your complete .docx, .xlsx, and .md repository on schedule (10 business days for Core, 15 for Integrated, 20 for Multi-Framework). Under our 60-Day Documentary Integrity Warranty, any confirmed cross-reference defect or clause omission within scope is corrected at no additional charge.
03 · ARCHITECTURAL PACKAGES & FIXED SCOPE
Three documentation architectures, defined by scope.
Fixed-fee documentation engineering for one legal entity and one primary production environment. Final deliverable manifest confirmed in writing before payment.
Core Architecture
Single-standard documentation system
$2,900
1 Standard · 10 Business Days · ~18 Consolidated Documents
Complete documentary repository for one primary standard: select ISO/IEC 27001:2022 ISMS, AICPA SOC 2 Type I/II Policy Suite, or ISO/IEC 42001:2023 AI Management System.
- Governance manual & charter Clauses 4-10 / TSC
- 93-Control SoA & 5x5 Risk Register Multi-sheet .xlsx
- Consolidated operational policies ~18 core documents
- Each document delivered in 3 formats .docx / .xlsx / .md
Integrated Architecture
Harmonized dual-standard control system
$4,800
2 Standards · 15 Business Days · ~26 Unified Documents
Unified repository combining ISO/IEC 27001:2022 with either ISO/IEC 42001:2023 (AI Governance + EU AI Act File) or SOC 2 + 320-question Vendor Due Diligence Vault.
- Unified dual-standard manual ISO 27001 + AI / SOC 2
- Cross-mapped SoA & 5x5 Risk Ledger Single .xlsx source
- AI Impact Dossier or 320Q TPRM Vault Scope-selected
- Harmonized operational architecture ~26 unified documents
Multi-Framework Suite
Unified multi-regime governance repository
From $7,500
Multi-Standard · 20 Business Days · ~36 Consolidated Documents
Comprehensive architecture unifying ISO 27001:2022, ISO 42001:2023 (AI), and SOC 2 + 320Q TPRM Vault, with scoped EU DORA (B_01.01-B_99.01) and ISO 27701:2025 / GDPR modules.
- Multi-framework master control library .docx + .md
- DORA 15-table RoI + 320Q TPRM Vault Included ($0 add-on)
- ISO 27701:2025 RoPA, TIA & AI DPIA Included ($0 add-on)
- Consolidated multi-regime suite ~36 unified documents
04 · TECHNICAL RESEARCH
Selected normative monographs.
Reference studies on ISO/IEC 27001:2022, ISO/IEC 42001:2023, AICPA SOC 2, and EU DORA. View all 6 monographs →
ISO/IEC 27001:2022 · MONOGRAPH 01
Designing an ISO/IEC 27001:2022 ISMS & 93-Control Statement of Applicability Without Platform Lock-In
Why Stage 1 certification audits flag generic policy exports, and how a relational 93-control Statement of Applicability (SoA) mapped to real repository and cloud artifacts eliminates recurring software lock-in for documentary governance.
ISO/IEC 42001:2023 · MONOGRAPH 02
Structuring an ISO/IEC 42001:2023 AI Management System (AIMS) & EU AI Act Technical Documentation
How ISO/IEC 42001:2023 Clauses 4 to 10 and normative Annex A.2 through A.10 (with Annex B implementation guidance) unify foundation model supplier oversight, RAG data provenance, and EU AI Act technical documentation into a single certifiable AIMS.
SOC 2 TSC & VENDOR ASSURANCE · MONOGRAPH 03
Aligning AICPA SOC 2 Trust Services Criteria (CC1-CC9) with Enterprise Vendor Due Diligence
How B2B SaaS teams streamline enterprise Third-Party Risk Management (TPRM) reviews by pairing audit-oriented SOC 2 Trust Services Criteria policies (CC1 to CC9) with a pre-referenced 320-question Vendor Due Diligence Vault.