AI strategy assessment and setting
Where AI pays, what it may touch, and the controls that let a board say yes.
Sheet 01 · Fractional
Fractional CISO and CTO
Security and AI leadership, about a day a week, for companies whose customers, auditors, or board just started asking harder questions. Engagements are contracted through Bleenq.
02 · Services
What I do on an engagement.
Four services, each backed by the record.
Core issue diagnosis
The real cause, in writing, before anyone spends on a fix.
Architecture and delivery guidance for correction
The fix, sequenced, and the team that can run it after I leave.
Compliance acceleration
SOX, SOC 2, FedRAMP, and HIPAA on the business’s schedule, not the auditor’s.
03 · Engagement
Two ways to start.
Start with a fixed assessment, or put me in the seat.
Model A
Assessment
Focused and fixed scope on one of the four services. It ends in a written plan and a readout.
- Duration
- Typically 4 to 6 weeks
- Fee
- Credits toward the retainer if you continue
Model B
Retainer
Fractional CISO or CTO. I own the lane and work inside your leadership team.
- Time
- About a day a week
- Minimum term
- 3 months
Scoped and priced in writing after a 30-minute call.
A typical rhythm, not a rigid contract: a written report each month, board material each quarter, and an assessment staged from kickoff, through interviews and data, to the readout.
04 · The seat
What I own.
CISO
- A security program and roadmap the board can read
- SOC 2, SOX, FedRAMP, and HIPAA readiness
- AI governance: policy, data controls, and model risk
- Incident readiness and the board report
CTO
- Architecture and platform decisions
- Cloud operations and cost
- AI into production, with evals and guardrails
- Technical diligence for a raise or acquisition
Not a fit: a signature-only CISO for a checkbox audit, 24x7 SOC monitoring, pen testing as a service, or IT helpdesk scope.
05 · Book
Bring the problem.
Leave with the next three moves.
- Length
- 30 minutes
- With
- Paul, directly
- Reply
- Within 24 hours
- After
- Scoped and priced in writing after a 30-minute call.