How it works
The engagement calendar is built backwards from your customer's deadline, not from the platform's window. Here is what happens in each week, and what you actually have to do.
Week 0
You grant read access to the systems that carry evidence: identity provider, endpoint management, backup console, ticketing. We return an engagement plan with the submission date working backwards from your customer's deadline.
What you do: one round of access grants.
Week 1
Every control is scored against the questionnaire you received, and the gaps are ranked by how many points they cost. Logging is switched on straight away, because several controls need dated evidence and evidence cannot be backdated.
What you get: a gap readout within 7 days, and the first dated evidence on file.
Weeks 2 to 4
Policies, procedures and registers are drafted for you, matched to how your company actually operates rather than to a template. In parallel, the remediations that carry the most points get applied.
What you do: validate documents. You write nothing.
Week 5
Each control is paired with the evidence that proves it is applied, not just designed. The complete file is reviewed against the threshold before anything is submitted, so there are no surprises in the scoring.
What you get: a file ready to submit, reviewed.
Week 6
The file is submitted and you receive a readout you can present to your customer, in their language rather than in security jargon.
What you get: the submission, and a deck for your customer.
The target score is set together after the diagnostic, and we guarantee it: we work until it is reached, at no extra cost. Three conditions make that outcome certain, and they are the only things we need from you: access granted at signature, your validations within a few days, and the priority remediations applied.
Evidence scores, documents do not. A control declared without evidence scores zero, and the evidence has to show both design and operating effectiveness.
The threshold often applies per focus area, not just overall. You can clear the overall bar comfortably and still fail on a single area.
The platform window is not your real deadline. The date that matters is your buyer's own campaign deadline. Submitting on time with a score below the threshold protects nothing.
Twenty minutes, no obligation. Bring the questionnaire or the assessment invitation.
Book the assessment readiness check, 20 minutes