Skip to content
ARXfidei— The Citadel of Trust

How we work

Six steps, no surprises

The engagement model below is the same for a three-week pack and a fourteen-month certification programme. It exists so that you always know what has happened, what is next, and whether we are on schedule.

The engagement model

  1. Step 1 of 6

    Qualification call

    45 minutes, free

    A senior consultant, not a salesperson. We ask what is driving the deadline, what exists already, how many entities and systems are in scope, and who will have to approve the result. You get an honest read on feasibility and a range before we hang up — including, when it applies, the fact that you do not need us for this.

    A clear view of scope, likely effort and order of work.

  2. Step 2 of 6

    Proposal

    Within 5 working days

    A written proposal with the scope, the deliverables listed item by item, the schedule with dates, the people involved, and a fixed price. No day-rate estimates with a range attached, and no discovery phase billed before the scope is known.

    A fixed-price proposal you can take to a budget meeting.

  3. Step 3 of 6

    Kick-off

    Week 1

    Framework contract and mutual non-disclosure agreement signed, insurance certificates provided, access requested and granted, stakeholders identified, and the reporting rhythm agreed. We confirm the schedule against your constraints — audits, releases, holidays — before anything starts.

    Signed contract, NDA, access, named contacts and a confirmed schedule.

  4. Step 4 of 6

    Delivery

    Per the schedule

    The work runs with a thirty-minute checkpoint every week: what was done, what was found, what is next, and anything that threatens the date. Significant findings are raised when we find them, not saved for the report. Work is done in your tools and your repository wherever possible.

    A weekly written summary and no surprises at the end.

  5. Step 5 of 6

    Readout and handover

    Final week

    A presentation to the people who have to act on it — usually the executive committee or the board — with the executive summary, the findings, and the costed action plan. Then a working handover with your team: the detail, the evidence, the configuration, and how to maintain it.

    Board-ready readout, full documentation, and a team able to continue.

  6. Step 6 of 6

    Follow-on proposal

    Within 15 days

    A written proposal for what comes next, if anything does: targeted missions from the action plan, a recurring service to hold the ongoing work, or nothing at all. Sent within fifteen days of the readout so the decision is made while the findings are fresh, with no obligation attached.

    A costed option for the next phase, and a clean stop if you prefer.

What you receive

Standard deliverables across our engagements. The proposal lists exactly which of these apply to yours.

Executive summary
Five to ten pages written for a board: the position, the exposure, the decisions required and what they cost. No technical vocabulary that needs translation.
Detailed report
The full findings with evidence, severity, reproduction steps where relevant, and the reasoning behind each recommendation.
Costed action plan
Prioritised actions with owner, effort, dependency and cost estimate, sequenced over a realistic horizon rather than listed by severity alone.
Registers and records
Risk register, asset inventory, supplier register, processing records, AI system register — whichever the engagement produces, in a format you can maintain.
Policy framework
Policies and standards written for your organisation and mapped to the frameworks you answer to, with the review cycle already defined.
Code and configuration
Infrastructure as code, pipeline definitions, policies as code and scripts, delivered in your repository under your licence. Nothing we build is held hostage.
Dashboards
Compliance and security dashboards connected to live sources, so the position is visible between our visits rather than only in the report.
Test reports
Penetration test reports, retest attestations, exercise observation reports and restore test results — the evidence an auditor, an insurer or a customer will ask to see.

Four things we hold to

  • Fixed price on defined scope

    If we estimated wrong, that is our risk. Scope changes are discussed and re-priced explicitly; effort overruns are not.

  • One senior contact throughout

    The person who scopes the work delivers it and presents it. No handover to a junior team after signature.

  • Findings raised immediately

    Anything critical is escalated the day we find it, with containment advice, whatever the reporting schedule says.

  • You keep everything

    Documents, code, configuration and evidence are yours. Our mission data is held in the EU and destroyed or returned on your instruction.

Step one costs nothing

Forty-five minutes with a senior consultant, and an honest answer about whether this is worth doing.

Book a 45-minute call