ISO 27001 . ISO 42001 . SOC 2 . NIS2

BC.HERO.01 // EINDHOVEN . NL

FRACTIONAL COMPLIANCE LEAD

Rent a compliance lead. Keep the deals. Your biggest customers ask for ISO 27001, SOC 2 and proof that your AI is governed. You can hire a head of compliance. Or you can rent one who has done it as a COO, from two days a month.

See the plans Take the free readiness check

Prices are published and exclude VAT. I prepare. Your certification body certifies.

Bram & Company

01 // TRACK RECORDLed ISO 27001 certification as COO, full SoA

02 // AI GOVERNANCECompany AI policy aligned to the EU AI Act

03 // PROCUREMENT20+ years across 25+ countries

04 // RETAINER ENTRYFrom a monthEUR 2,000

INSIDE THE WORKSPACE // LIVE COMPLIANCE OPERATIONS

BC.STAGE.01 // VANTA . DRATA . PORTAL DOSSIER

BC.WORKSPACE.01 // VANTA & DRATA

Your platform, owned and kept green every week.

✓A.5.15 Access Control PolicyVERIFIED

✓A.8.28 Secure Coding Evidence93 / 93

✓EU AI Act Art. 9 Risk LogSIGNED

OWNER: BRAM HIRSCH100% READY

BC.QUESTIONNAIRE.02 // ENTERPRISE CAIQ5 DAYS SLA

200-question buyer security review answered.

EUR 495

Backed by your real Statement of Applicability, risk register, and supplier inventory so enterprise procurement signs off without stalling the deal.

SOC 2 TYPE IIISO 27001 SOADORA / NIS2DEAL UNBLOCKED

BC.READINESS.03 // CLAUSE GAP SCOREBROWSER-LOCAL

Clause-by-clause readiness check

Score your ISO 27001, ISO 42001, SOC 2 or NIS2 posture in ten minutes. Nothing leaves your browser.

10 MIN

Start the check →

BC.DOSSIER.04 // AUDITOR SIGN-OFF

Prepared and in the room when the auditor arrives.

Every control evidenced, internal audit completed, and management review minuted before Stage 2.

INTERNAL AUDITMGMT REVIEW0 MAJOR NC

ACCREDITED CB AUDITSTAGE 2 PASSED

The plain truth

BC.MANIFESTO.02 // OPERATOR OVER AUDITOR

Compliance is not a software problem. It is an ownership problem.

A 200-question security questionnaire lands on a Tuesday. The procurement team behind it does not care how good your engineers are. They need a document to file. Until they have it, the contract waits.

Most companies buy a compliance platform. The dashboard shows 140 red controls. A dashboard is a to-do list. Someone still has to write the risk assessment, run the review and sit the internal audit.

01 // NO JUNIOR HANDOFF

I know what to skip

02 // PLATFORM FLUENT

I have done the AI part

03 // ZERO LOCK-IN

I speak procurement

FIG. 02 // STRUCTURAL CONTROL CUBEANNEX A . 93 CONTROLS

STATEMENT OF APPLICABILITYVERIFIED BY OPERATOR

The fractional compliance lead

BC.RETAINER.03 // PUBLISHED MONTHLY RATES

Rent the lead. Skip the EUR 145k hire.

Prices per month, excluding VAT. Invoiced monthly in advance. One month's notice. No minimum term.

2 days a month

Basis

EUR 2,000

a month . excluding VAT

You are certified and between audits, or you have a platform and nobody to run it.

I own your Vanta, Drata or spreadsheet instance
I run the monthly control and evidence cycle
I prepare the yearly surveillance audit
One review call a month with your management

Talk to me about Basis →

Plus

EUR 3,800

a month . excluding VAT

Your enterprise customers send questionnaires and want security calls.

Everything in Basis
I answer your customers' security questionnaires
I join customer security and procurement calls
I own the risk register and the incident log

Talk to me about Plus →

8 days a month

Premium

EUR 7,200

a month . excluding VAT

You need a compliance function and do not want to hire one yet.

Everything in Plus
I lead a certification project to its audit
I run supplier reviews and the management review
I report to your board each quarter

Talk to me about Premium →

ECONOMICS COMPARISONWHY OPERATORS RENT BEFORE THEY HIRE

Full-Time Head of Compliance6-month recruiting cycle + pension + holiday pay + platform seatEUR 145,000 / YR

Big-4 / Traditional ConsultancyJunior associates billing hourly for 80-page PDF gap reportsEUR 65,000+ / PROJ

Bram & Company RetainerFormer COO owning your Vanta/Drata, questionnaires & auditsFROM EUR 2,000 / MO

Free readiness checkBC.CHECK.01

Ten minutes. A score per clause. No email needed to see it.

Pick a standard. Answer the questions. Read your gap report. The score is worked out in your browser and never leaves it.

CLAUSE READINESS PREVIEWLIVE IN BROWSER

Clauses 4-10 Management System14 QUESTIONS

Annex A Controls & Evidence18 QUESTIONS

AI Governance & EU AI Act10 QUESTIONS

Start the check →

Standard services

BC.WEDGE.MATRIX

Fourteen fixed-price products

See all fourteen →

WEDGE.01Ready in 5 working days

Security questionnaire answered

A customer's security questionnaire answered from your own practices and evidence.

EUR 495

Order What you get →

WEDGE.02Ready in 5 working days

ISO 27001 internal audit

An independent ISO 27001 internal audit on a date you book, with a report 5 working days later.

EUR 1,450

Order What you get →

WEDGE.03Ready in 10 working days

EU AI Act classification

Up to three AI systems classified under the EU AI Act, with your role and the obligations that follow.

EUR 750

Order What you get →

WEDGE.04Ready in 10 working days

DPIA for one processing activity

A data protection impact assessment for one processing activity, from a two-hour session to a signed-off report.

EUR 1,250

Order What you get →

WEDGE.05Ready in 10 working days

NIS2 and Cyberbeveiligingswet scan

Whether NIS2 and the Cyberbeveiligingswet apply to you, and the gaps against the required measures.

EUR 950

Order What you get →

WEDGE.06Ready in 10 working days

Information security risk assessment

A three-hour risk session with your team, a risk register and a treatment plan.

EUR 1,250

Order What you get →

FOUNDER & PRINCIPALEINDHOVEN . NL

APPROVED BY
BRAM HIRSCH

"I am Bram Hirsch. I spent twenty years running operations across more than 25 countries: shared services, process architecture, transitions and complex IT implementations, most recently as COO of a software company. I was nominated for a Gartner award for business process management. I treat compliance as a process someone owns, not a document someone produces. That is why I review everything that leaves this practice."

BRAM HIRSCH . FOUNDERAbout us →

CLIENT OUTCOME // B2B SAASISO 27001 + EU AI ACT

"We had Vanta for eight months and zero closed enterprise deals. Within ninety days we cleared two bank security reviews and passed Stage 2."

Every engagement runs inside your existing tooling. Your engineers keep building product while the risk register, Statement of Applicability, supplier reviews, and internal audits get done on schedule.

340

CONTROLS MAPPED & EVIDENCED

MAJOR NON-CONFORMITIES

SECURITY REVIEW SLA

Questions

BC.FAQ.06 // DIRECT ANSWERS

What people ask before they start

Do you certify us?

No. Nobody who advised you may. An accredited certification body audits you and issues the certificate. I prepare you and I am in the room when they come.

What does the certification body cost?

Typically EUR 6.000 to 12.000 for the audit, paid by you to them. Never part of my price.

How is a retainer billed?

Monthly in advance. One month's notice. No minimum term. Most clients start at two days a month before an audit and move to four when the questionnaires pick up.

Is this legal advice?

No. I am a compliance specialist, not a lawyer. Five standard services sit next to legal questions and each page says so. For a legal opinion I refer you to a privacy lawyer I work with.

Can we start small?

Yes. A security questionnaire answered costs and takes five working days. Most retainers started that way.

Bram & Company

Compliance is not a software problem. It is an ownership problem.

Rent the lead. Skip the EUR 145k hire.

Basis

Plus

Premium

Ten minutes. A score per clause. No email needed to see it.

Fourteen fixed-price products

Security questionnaire answered

ISO 27001 internal audit

EU AI Act classification

DPIA for one processing activity

NIS2 and Cyberbeveiligingswet scan

Information security risk assessment

APPROVED BYBRAM HIRSCH

What people ask before they start

Tell me what your customer asked for

APPROVED BY
BRAM HIRSCH