An accountancy software business came through a private equity investment and started restructuring its cost base for the next phase of growth. At the same time it had an ISO 27001 audit booked for November, and needed senior security and compliance expertise it didn’t have in house.
Two routes looked obvious, and neither fitted.
A permanent chief information security officer (CISO) would have closed the capability gap and added a senior salary to a cost base under active review. A contractor on a day rate would have been faster to arrange, but a day rate buys time rather than a result, and leaves nobody accountable for whether the business is actually ready when the auditor arrives.
Why a Statement of Work fitted
A Statement of Work (SoW) gave the business access to the seniority it needed without committing to permanent headcount, and let the engagement be built around outcomes rather than time and materials.
Alfie Elliot, Director, puts it this way:
“The engagement worked particularly well because we were able to give the client access to senior-level security and compliance expertise at exactly the point they needed it, without the commitment of a permanent hire. By structuring it around clear outcomes through an SoW, we could focus on preparing the business for its ISO 27001 audit while also leaving them with stronger processes and capability for the future.”
The question stopped being who do we hire, and became what does this business need to be able to do by November.
How it was scoped
Three days a week on site, with a fractional CISO providing senior security and compliance leadership, against three deliverables:
- Audit readiness. Getting the business to the point where it can go into the ISO 27001 audit with evidence rather than intentions.
- The wider compliance position. Broader than the audit itself, and the part that decides whether the benefit outlasts it.
- Data protection officer on site. A specific role with specific responsibilities, held by someone senior enough to carry it.
Three days a week matters more than it looks. It’s enough presence to be known across the business and present for its decisions, without the cost of a full-time executive it doesn’t yet need.
Where it stands
The audit takes place in November. Ahead of it, the engagement has strengthened internal security and compliance processes, put senior security leadership in place, and established on-site data protection officer capability.
That last point is the one worth noticing. The objective was never only to pass an audit. It was to leave the business with stronger processes and more capability than it started with, so the next review is a smaller event than this one.
Where this structure doesn’t fit
Scoped delivery works when the end state can be described well enough for someone to be held to it. A fixed audit date does that. Where a requirement is genuinely exploratory, or depends on deep contextual knowledge the business already holds, contingent staffing or a permanent hire is usually the more honest structure, and we’d tell you so before quoting.
How Inscope Select approaches this
We scope, price and deliver Statement of Work engagements across technology, security and transformation. That means agreeing the outcome and the acceptance criteria before work starts, putting the right seniority against it at the right proportion rather than defaulting to full-time, and naming who is accountable for the result. Fractional and part-time structures are part of that, where what the business needs is judgement rather than volume of hours. We also tell clients when a SoW isn’t the right answer, because an engagement scoped around the wrong structure costs both sides more than the conversation would have.
Scope your requirement with Inscope Select
If you’re weighing a permanent hire against a scoped engagement, or you have a date you need to be ready for, send us the requirement and we’ll tell you which structure fits.
