Question 1

Is the engagement under NDA?

Accepted Answer

Yes. Every Diagnostic is delivered under a mutual NDA executed before kickoff. We routinely operate under outside-counsel privilege for IPO readiness, board-level cyber assessments, M&A diligence, and post-incident reviews. Engagement letter routed through your counsel on request.

Question 2

Who sees our data?

Accepted Answer

A need-to-know team only, typically the lead partner and one senior practitioner. Access is read-only, scoped to the engagement, and revoked at delivery. We do not subcontract, we do not use offshore resources, and we do not feed client data to third-party AI tools.

Question 3

What is in scope, and what is not?

Accepted Answer

Scope is locked in writing on the 30-minute scoping call before any money moves. In scope: document review, stakeholder interviews, read-only systems review, and a written report. Out of scope: remediation, implementation, configuration, training, and any hands-on fix work. Those are separate engagements priced from the report.

Question 4

What deliverable do we actually receive?

Accepted Answer

A written report, typically 20 to 40 pages, with current state, prioritized gaps, quantified remediation (cost and timeline ranges), and next-engagement options. Plus a 60-minute walkthrough with your stakeholders and a 30-day clarifying-question window. The report is yours to hand to your board, auditor, regulator, or next vendor.

Question 5

How long does it take, end to end?

Accepted Answer

Two to three weeks from kickoff to final report. Week one: discovery, document access, interviews. Week two: analysis and draft. Week three: delivery and walkthrough. We do not run multi-month assessments. If the problem needs that, we tell you on the scoping call.

Question 6

What if our problem doesn't match one of the five shapes?

Accepted Answer

The five shapes cover the majority of what we see, but they're patterns, not menu items. The scoping call confirms fit. If the problem is outside what we can deliver well in three weeks, we tell you and point you to a firm that can.

Question 7

Does the Diagnostic roll into a retainer?

Accepted Answer

No. There is no automatic rollover, no implied next engagement, and no hourly billing. If you want follow-on work, it is scoped and priced from the report as a separate engagement. The Diagnostic stands on its own.

Question 8

What does the fixed fee cover, and how is it sized?

Accepted Answer

Senior partner time across the full engagement: scoping, discovery, interviews, systems review, analysis, the written report, and the walkthrough. Pricing starts at $10,000 and scales with scope: number of entities, regulatory frameworks in play, environments to review, and stakeholder count. The exact fee is fixed and disclosed before kickoff, in writing. Billed 50% at kickoff, 50% on delivery. No change orders, no add-ons, no expenses.

The Securem Diagnostic: a fixed-scope written assessment