// Engagement approach
How we scope and deliver an engagement.
We do not publish client names, engagement counts, or outcome metrics we cannot evidence. What we can describe plainly is how the work runs. Every Dephiant engagement follows the same four phases, with written success criteria agreed before work begins.
- 01
Assessment
Every engagement starts with a structured assessment of your current posture: policies, controls, architecture, and the obligations you actually face. We interview the people who run the environment, review the evidence that exists, and document gaps against the framework that matters to you, whether that is NIST SP 800-171, SOC 2, ISO 27001, or a customer requirement.
- 02
Prioritized roadmap
Findings become a sequenced roadmap, not a binder. Each item carries an owner, an effort estimate, a risk rating, and a plain-language rationale, so leadership can fund the work that reduces the most risk first and defer the rest with eyes open.
- 03
Implementation support
We work alongside your team to close the gaps: drafting policies and procedures, configuring controls, preparing evidence, and coaching staff. We use the tooling you already own where possible, and we tell you when a purchase is genuinely necessary instead of padding a stack.
- 04
Executive reporting
You get reporting a board can read: current posture, progress against the roadmap, residual risk, and the decisions that need a human. When the engagement ends, you keep every artifact, and the success criteria we agreed on at the start are how the work is judged.
What we will not do
- ›Claim certifications, clearances, or contracts we have not been awarded.
- ›Publish client names or results without written permission and evidence.
- ›Sell hours without defined success criteria and a clear off-ramp.