Four ways to work with Northstar, each with a set length and price range. The fit call settles which one, and the written scope fixes the price.
Mara joins your leadership meeting every week, owns the security roadmap, and answers customer security questions for you.
A 90-day program that takes you from no formal compliance work to ready for a SOC 2 Type II audit window.
A 2 to 3 week review of your security against NIST CSF, CIS Controls or SOC 2, delivered as a written report with a ranked list of fixes.
Live onboarding sessions, quarterly phishing tests and short monthly scenarios, written for engineering-heavy teams.
Every engagement runs through the same five phases. Each phase ends with a document you keep.
| Phase | Length | What happens | What you keep |
|---|---|---|---|
| 1Discovery | 2 weeks | Data-flow map, frameworks in scope, and where your program stands today. | Discovery Document, 6 to 12 pages |
| 2Roadmap | 1 week | Prioritized work with owners and a budget, reviewed with your leadership team. | 12-month roadmap |
| 3Build | 8 to 16 weeks | Policies written, controls configured, and your compliance platform collecting evidence. | Policies, controls and evidence collection in place |
| 4Validate | 2 to 4 weeks | Tabletop exercise, penetration test coordination, and a mock audit. | Readiness report and gap-closure plan |
| 5Operate | Ongoing | Weekly leadership meeting, questionnaire answers, and incident response readiness. | Quarterly security review |
1Discovery 2 weeks
Data-flow map, frameworks in scope, and where your program stands today.
You keep: Discovery Document, 6 to 12 pages
2Roadmap 1 week
Prioritized work with owners and a budget, reviewed with your leadership team.
You keep: 12-month roadmap
3Build 8 to 16 weeks
Policies written, controls configured, and your compliance platform collecting evidence.
You keep: Policies, controls and evidence collection in place
4Validate 2 to 4 weeks
Tabletop exercise, penetration test coordination, and a mock audit.
You keep: Readiness report and gap-closure plan
5Operate Ongoing
Weekly leadership meeting, questionnaire answers, and incident response readiness.
You keep: Quarterly security review
Ledgerline had three enterprise contracts waiting on a SOC 2 report. Mara joined one day a week, ran the readiness program, and the report came back clean nine months after kickoff. All three contracts were signed within six weeks of it.
Read the Ledgerline case studyTell her what is driving the work. If Northstar fits, you get a written scope and price within three business days.