Customer questionnaires
We own your answers to enterprise and government security and AI questionnaires, and join the buyer calls where they are asked.
Due diligence
Startups and scale-ups · Readiness
A named CISO and DPO for your startup, for a fraction of a full-time hire
Enterprise questionnaires, investor diligence, a regulator asking who your data protection officer is. We take the role part-time, under one named consultant, on a monthly retainer you can stop.
A senior security lead before you can hire one
A full-time CISO is a senior Gulf hire that most seed to Series B companies cannot justify. Yet the work arrives anyway: enterprise security questionnaires, a regulator's data protection officer requirement, an investor's diligence list, an ISO 27001 or ISO/IEC 42001 programme someone has to own.
We take the role part-time, under a named consultant, with the authority and the continuity a questionnaire answered by a different freelancer each month does not have.
What the role covers
Agreed at the start and reviewed every quarter.
Programme lead
An ISO/IEC 27001 or ISO/IEC 42001 programme planned and run to certification readiness. Certification itself stays with an accredited body.
ISO 27001ISO 42001
Data protection officer
Where your regime requires a DPO, or you want one, a named and qualified officer in the role.
DIFCADGMSaudi PDPLOman
Board and investor reporting
A quarterly security and AI risk report your board and investors can read in five minutes.
Quarterly
Incident leadership
When something goes wrong, we lead the response, the regulator notifications and the customer communication alongside your team.
Notification clocks
Supplier and AI tool decisions
Reviewing the cloud, SaaS and AI tools you adopt before your data goes into them.
Supplier risk
What it costs
A monthly retainer, paid monthly in advance. A three-month initial term, then rolling month to month with one month's notice.
Fractional CISO or DPO: Starter
About two consultant days a monthOne role
Questionnaires, policies, a monthly risk review and the quarterly board and investor report. Suited to seed and Series A.
AED 7,500 per month≈ USD 2,042. Excludes VAT and other taxes.
Fractional CISO and DPO: Growth
About four consultant days a monthBoth rolesCertification programme
Adds the data protection officer role, an ISO 27001 or 42001 programme, buyer calls and incident leadership. Suited to Series A and B.
AED 15,000 per month≈ USD 4,084. Excludes VAT and other taxes.
Additional days
Busy months happen: a large tender, an audit, an incident.
AED 3,500 per consultant day≈ USD 953. Agreed and paid in advance.
The firewall
While we hold your CISO or DPO role we will not assess you, issue you an AI Trust Passport, or carry out investor due diligence on you. If an investor asks us to, we decline and tell them why. Your independent audits are done by someone else, and we sit on your side of the table during them.
What a fractional role is not
Not a 24-hour security operations centre, a managed security service or a penetration tester. We tell you when you need those, and help you choose a provider without taking commission from them.
Questions
Who will actually do the work?
A named consultant for the whole engagement, not a rotating pool. You will know who it is before you sign.
Can you be our DPO if we are in DIFC or ADGM?
Yes, where the regime allows an external officer. We confirm the requirements of your regime on the scoping call.
What happens when we hire a full-time CISO?
We hand over properly: the risk register, the programme, the questionnaire library and a briefing for your new hire. Most clients move to ad hoc days at that point.
Tell us what is landing on your desk
The questionnaire, the investor or the regulator. We will tell you whether Starter or Growth fits, or whether you need something else.