Engagement Principles
A clear basis for agreeing professional services and responsibilities.
These principles describe how VLK InfoSec Consulting structures engagements. The signed proposal and contract define the terms of a particular assignment.
Scope and outcomes
Before work begins, the parties agree objectives, entities and systems in scope, deliverables, exclusions, milestones, acceptance criteria, contacts and dependencies. Assessment, certification readiness and ongoing advisory are distinct scopes.
Responsibilities
The client provides authorized access, accurate information, available stakeholders and relevant evidence. VLK InfoSec Consulting identifies material limitations and supports informed decisions. Management retains ownership of business decisions, risk acceptance and implementation.
Confidentiality, access and personal data
Access and information sharing are limited to the agreed purpose. The parties agree secure channels, confidentiality, permitted recipients, retention, return and deletion. Where VLK InfoSec Consulting processes personal data for a client, appropriate processing terms and instructions are agreed. Client material is not authorized for external AI processing merely by engaging VLK InfoSec Consulting.
Fees, changes and intellectual property
The agreement specifies currency, taxes, payment milestones, expenses and any advance payment. Changes to scope, access or client dependencies are documented with their timing and fee consequences. Usage rights distinguish client-specific outputs, VLK InfoSec Consulting’s pre-existing methods and third-party materials.
Professional boundaries
Readiness work supports the client’s preparation; independent certification bodies make certification decisions. No engagement guarantees certification, full compliance or freedom from incidents. Penetration testing, intrusive scanning, production changes and specialist legal services require an expressly agreed scope and appropriate authorization.
Completion and continuing support
The agreement defines acceptance, correction of material deviations, termination, handover, access revocation and information return or deletion. Ongoing monitoring or updates are included only when explicitly agreed.