ARCHITECTURES, DELIVERABLE MANIFEST & FIXED-FEE CONFIGURATOR
Choose your documentation architecture.
Select your target frameworks, review the mandatory deliverable manifest, and calculate your fixed project fee. Standard pricing covers one defined legal entity and one primary cloud production environment, with automatic duplicate-billing protection on Multi-Framework suites.
CONTRACTUAL CLARITY · PUBLIC FIXED PRICING ($2,900 / $4,800 / FROM $7,500) · ZERO DOUBLE BILLING · 10 TO 20 BUSINESS DAYS FROM VALIDATED INTAKE
01 · INTERACTIVE PROJECT CONFIGURATOR
Select your architecture tier, framework combination, and extensions.
Selecting Architecture 03 (Multi-Framework) includes baseline EU DORA/NIS2 and ISO 27701:2025/Privacy modules at $0 additional charge to prevent overlapping fees.
02 · CONTRACTUAL DELIVERABLES MANIFEST
Mandatory documentary deliverables engineered inside your repository.
We sell a coherent documentary architecture rather than fragmenting policies to inflate file counts. Every contracted register, manual, and functional policy domain below is guaranteed and delivered unlocked in Word, Excel, and Git Markdown.
| Document ID | Deliverable Title & Architectural Function | Native Formats | Normative Mapping | Architecture Configuration |
|---|---|---|---|---|
| BPS-MAN-01 | Governance Manual & Executive Charter (Clauses 4 to 10 Context, 2024 Climate Amd, Leadership, Planning, Review) | .docx + .md | ISO 27001:2022 / ISO 42001:2023 Clauses 4-10 / SOC 2 CC1-CC5 | Core / Integrated / Multi-Framework |
| BPS-SOA-01 | Relational Statement of Applicability & Control Matrix (All 93 Annex A Controls / 38 AI Controls / TSC Links) | .xlsx | ISO 27001 Clause 6.1.3(d) & ISO 42001 Annex A.2-A.10 | Core / Integrated / Multi-Framework |
| BPS-RSK-01 | Semi-Quantitative 5x5 Asset & Risk Treatment Register (Likelihood/Impact Matrix & Residual Risk Owners) | .xlsx | ISO 27001 Clauses 6.1.2 & 8.2 / SOC 2 CC3 | Core / Integrated / Multi-Framework |
| BPS-POL-01..20 | Consolidated Operational Security & Cloud Control Policies (IAM, Crypto, SDLC, Terraform IaC, DLP, Logging, BCDR) | .docx + .md | ISO 27001 Annex A.5-A.8 / SOC 2 CC1-CC9 | Core (~18) / Integrated (~26) / Multi (~36) |
| BPS-AIM-01 | AI System Impact Assessment (AIA), Model Cards, RAG Data Provenance & LLM Supplier Ledger | .docx + .xlsx | ISO 42001 Normative Annex A.2-A.10 (Guidance B) / EU AI Act | Core (AI) / Integrated (AI) / Multi-Framework |
| BPS-SIG-01 | SOC 2 Control-to-Evidence Matrix & 320-Question Enterprise Vendor Due Diligence Vault (CSA CAIQ v4 / TPRM Aligned) | .xlsx | AICPA SOC 2 TSC + Enterprise TPRM Domains | Core (SOC 2) / Integrated (SOC 2) / Multi-Framework |
| BPS-DOR-01 | DORA ICT Risk Management Framework, Competent Authority (4h/24h/72h) & NIS2 CSIRT Playbook + 15-Table RoI | .docx + .xlsx | EU Reg. 2022/2554 Art. 5-30, ITS Reg. 2024/2956 (B_01-B_99) & NIS2 | Multi-Framework / DORA Extension |
| BPS-PRI-01 | ISO/IEC 27701:2025 PIMS Architecture, Dual-Role GDPR Art. 30 RoPA, Art. 35 AI DPIA & Transfer Impact Assessment | .docx + .xlsx | ISO/IEC 27701:2025 & GDPR Art. 28, 30, 35, 44-49 | Multi-Framework / Privacy Extension |
| BPS-SSP-01 | NIST SP 800-171 Rev. 2 (110 Requirements) & Rev. 3 (97 Requirements) System Security Plan (SSP) & POA&M | .docx + .xlsx | NIST SP 800-171 Rev. 2 & Rev. 3 / CMMC 2.0 | NIST SSP Extension |
| BPS-AUD-92 | Clause 9.2 Internal Audit Programme, Sampling Matrix, Pre-Audit Gap Review & Clause 9.3 Agenda Record Template | .docx + .xlsx | ISO 27001 / ISO 42001 Clauses 9.2 & 9.3 | Core / Integrated / Clause 9.2 Review |
03 · WHAT HAPPENS AFTER DELIVERY (STAGE 1 VS. STAGE 2)
Clear division of responsibility between documentary engineering and operational evidence.
Our deliverables establish your complete Stage 1 documentary design and SOC 2 control narratives. Here is what we hand over versus what your team operates prior to the external audit.
| Compliance Phase | Delivered by The Blueprint In Studio (Day 10 to Day 20) | Operated by Your Internal Team After Delivery (Stage 2 / Type II) | Auditor Verification Target |
|---|---|---|---|
| 01 · Governance & Policy Design | Complete Clauses 4-10 Manual, consolidated operational policies, and Clause 7.5.2 document control blocks tailored to your stack. | Executive approval sign-off, internal publication in Git/SharePoint/Vanta, and workforce policy acknowledgment. | Stage 1 Desk Review / SOC 2 Type I Design |
| 02 · Risk & Applicability Spine | All 93 Annex A controls (or 38 AI controls) mapped in BPS-SOA-01.xlsx and linked to the 5x5 Risk Register (BPS-RSK-01.xlsx). | Confirming internal risk owner sign-offs and tracking any 'Planned / In Remediation' controls to closure. | Clause 6.1.2 & 6.1.3(d) Traceability Check |
| 03 · Technical Control Execution | Explicit policy rules and target evidence identifiers (e.g., EVD-IAM-Q4-REVIEW.xlsx, EVD-KMS-ROTATION.json) bound to your cloud tools. | Operating the controls in AWS/GCP/Azure, Okta, and GitHub over your observation window and exporting the referenced logs/tickets. | Stage 2 Audit / SOC 2 Type II Sampling |
| 04 · Internal Audit & Management Review | Clause 9.2 Internal Audit Programme, sampling matrix, and Clause 9.3 Management Review agenda & record template. | Executing the internal audit sampling (independently of system authors) and recording signed Management Review minutes. | Clauses 9.2 & 9.3 Mandatory Records |
04 · REPRESENTATIVE B2B PROCUREMENT & AUDIT MANDATES (M1 - M4)
When engineering, security, and legal teams commission a repository.
Anonymized engagement profiles illustrating how cloud-native SaaS, AI, and FinTech organizations deploy our fixed-fee architectures to clear enterprise procurement and Stage 1 audits.
| Mandate ID & Client Profile | Commercial / Regulatory Trigger (RFP / Audit) | Selected Architecture & Scope | Delivered Repository & Outcome |
|---|---|---|---|
| M1 · Series A B2B AI SaaS (45 FTE · AWS + Bedrock + Okta) | Tier-1 enterprise customer procurement blocked pending ISO/IEC 27001:2022 + ISO/IEC 42001:2023 AI governance proof and RAG tenant isolation documentation. | Architecture 02 · Integrated ($4,800 · 15 Business Days) · ISO 27001 + ISO 42001 AI (~26 unified documents). | 93-control ISMS SoA + 38-control AIMS Annex A SoA, Algorithmic Impact Assessment, and KMS/Bedrock IAM policy delivered; cleared customer security review and Stage 1 desk audit. |
| M2 · Cloud FinTech & API Platform (110 FTE · EU / UK) | Contractual deadline from three European banking clients requiring an EU DORA Art. 28(3) Register of Information (Reg. 2024/2956) and NIS2/DORA incident playbooks. | Architecture 03 · Multi-Framework ($7,500 · 20 Business Days) · ISO 27001 + SOC 2 + DORA + Privacy (~36 documents). | 15-table DORA RoI workbook (B_01.01-B_99.01), dual 4h/24h/72h Competent Authority & CSIRT playbooks, and 320Q due diligence vault delivered in editable Excel/Word/Markdown. |
| M3 · Cloud DevTools Vendor (28 FTE · GCP + GitHub + Vanta) | Subscribed to a GRC automation platform for technical checks, but lacked audit-grade Clauses 4-10 governance manuals, a 5x5 risk methodology, and custom Terraform/CI-CD policies. | Architecture 01 · Core ($2,900 · 10 Business Days) · ISO/IEC 27001:2022 ISMS (~18 consolidated documents). | Replaced generic platform boilerplates with a stack-bound 93-control SoA, 5x5 Risk Register with live formulas, and consolidated policies imported directly into Vanta and Git. |
| M4 · Dual-Role HR & Health-Tech Processor (85 FTE · US / EU) | Enterprise DPA negotiations requiring standalone ISO/IEC 27701:2025 PIMS alignment, segregated Controller/Processor GDPR Art. 30 RoPA, and Art. 35 AI DPIAs. | Architecture 02 · Integrated ($4,800) + ISO 27701 Extension (+$950) · 15 Business Days. | Delivered dual-role RoPA, Transfer Impact Assessments, quantitative Art. 35 AI DPIA, and SOC 2 + 320Q vendor assurance vault under a single 7-domain control spine. |