Scope and timeline agreed after reviewing your infrastructure

Make client access, recovery, and security evidence easier to defend.

A practical readiness engagement for remote agencies facing a customer security requirement, uncertain contractor access, or an operational risk without a clear owner. Scope and timing follow an initial review of your environment.

Email Sebastian ↗

What an agreed engagement can cover

Priority controls and a usable handover.

Depending on the agreed scope, I can review access to critical systems, endpoint and backup practices, and the records behind customer security answers. Former freelancers with access, shared administrator accounts, an incoming questionnaire, or an untested backup are examples of possible triggers, not a promise to assess every system.

  • Inventory of people, administrator accounts, critical systems, data, and access paths
  • Review of MFA, password management, privileged access, and contractor lifecycle
  • Review of endpoints, backup recovery, monitoring, and available evidence
  • Agreed priority changes implemented where authorised
  • Written findings, evidence gaps, named owners, and a prioritised remediation roadmap
  • Leadership handover in plain language, with a walkthrough if useful

Indicative sequence

How we agree and deliver the work.

  1. 01

    Understand

    Gather the system overview, known concerns, customer requirements, documentation, dependencies, available authority, and desired deadline.

  2. 02

    Agree

    Propose systems in scope, deliverables, exclusions, responsibilities, price, prerequisites, and an achievable schedule in writing.

  3. 03

    Improve

    Review agreed controls and make authorised changes within the accepted scope.

  4. 04

    Hand over

    Provide findings, evidence, owners, and a prioritised remediation roadmap.

I propose a realistic timeline only after understanding the environment and agreeing scope. A requested deadline helps assess feasibility; it is not a delivery commitment.

What I need from you

A clear contact and scoped access.

For the first email, describe your concern or customer requirement, the systems you know are involved, and any deadline. No privileged credentials are needed for that first conversation. During scoping, we can identify a contact, relevant documentation, dependencies, access needs, change authority, and coordination with your IT provider.

You receive a written proposal with agreed scope, deliverables, exclusions, responsibilities, price, prerequisites, and timeline before delivery begins. Fixed scope and fixed price are possible after this review. If understanding the environment needs a substantial technical assessment, we define that work separately before undertaking it.

Illustrative deliverable — fictional example

What a clear handover looks like.

This fictional sample shows the format only. It is not evidence from a client engagement.

Illustrative deliverable — fictional example
AreaExample findingAgreed next actionOwnerEvidence to collect
Contractor accessLeaver access has not been reviewedConfirm the leaver list and remove authorised accessAgency operations leadAccess-review record
RecoveryRestore capability has not been demonstratedSchedule a scoped restore testIT providerRestore-test record
Customer questionnaireAnswers lack supporting recordsMap answers to existing controls and evidence gapsAgency ownerEvidence register

Scope boundaries

A strong fit when

  • A customer review or questionnaire is approaching
  • Contractor access or administrator ownership is uncertain
  • Backups exist but recovery has not been tested
  • You need priority fixes and a practical follow-up plan

Outside the agreed engagement

  • Formal SOC 2 or ISO 27001 certification
  • Penetration testing or legal compliance opinions
  • 24/7 incident response coverage
  • Unlimited technology transformation

Questions before starting

Practical answers.

How long will it take?

I propose a timeline after reviewing your infrastructure and agreeing the scope. The schedule depends on the systems involved, available access, existing documentation, change windows, and coordination with your team or providers. Tell me about any deadline so I can assess whether it is achievable.

Can you work with our existing IT provider?

Yes. I agree responsibilities and change windows with them. Your agency retains control of accounts and decisions.

Can this be delivered remotely?

Yes. We use written intake and scoped access, with meetings when they help resolve decisions.

Who owns the agency and client accounts?

Your agency and its clients keep ownership. I work only within the access and authority you approve.

Will this certify us or guarantee a customer review?

No. The engagement improves agreed controls and documents evidence. Certification and customer decisions remain separate processes.

Do we need an initial phone call?

No. Start by email. We can arrange a call later if it will help scope or deliver the work.

Start by email

Tell me what you need help with.

Tell me your company, what concerns you or what a customer is asking for, and any deadline. I’ll reply with clarifying questions and a proposed way forward. A call can follow if useful.

Email Sebastian ↗

No mail app? Write to sebastian@rex5.com.