Services Frameworks About Contact
Core Services

Institutional GRC & Emerging Tech Architecture

Executive-grade advisory tailored for banks, fintechs, telecoms, and healthcare institutions operating under strict regulatory oversight. Each engagement follows the same three-phase Kulan Compliance Lifecycle — see our Frameworks page for the full methodology.

01 — Regulatory Compliance

Audit Readiness & Reporting

For institutions facing an inspection window, a breach-reporting obligation, or a new regulatory mandate. We pre-audit against applicable frameworks, structure compliant breach-reporting pipelines, and run mock inspections before regulators arrive.

Deliverables
  • Pre-audit gap assessment against applicable mandates
  • Breach-reporting pipeline design and escalation mapping
  • Data sovereignty and residency review
  • Mock regulatory inspection / audit simulation
  • Final audit-readiness certification report
Typical Timeline

4–8 weeks for a full diagnostic-through-validation cycle, depending on institution size and number of frameworks in scope.

See frameworks covered → Regulatory Frameworks Reference
02 — Governance

InfoSec Governance & Policy Architecture

For institutions that need their security program formally documented and governed — or that need an experienced risk voice without a full-time hire.

Deliverables
  • Custom-authored Corporate Information Security Policy (CISP)
  • Incident Response Plan (IRP), tested against a tabletop exercise
  • Vendor / supply chain and payment pipeline risk review
  • Fractional CISO-as-a-Service engagement (ongoing advisory retainer)
CISO-as-a-Service — Tailored Engagement

Cadence and scope are scoped to your institution's size and regulatory exposure — not a fixed package. Engagements typically fall along this range:

Lighter touch
Monthly check-in. Policy review, ad hoc Q&A, annual IRP refresh.
Active partnership
Bi-weekly. Active policy management, vendor reviews, quarterly reporting.
Full coverage
Weekly plus on-call. Full fractional CISO function, audit liaison, AI oversight.
03 — AI Governance

AI Governance & Risk Advisory

For institutions deploying or evaluating AI systems — credit scoring, customer-facing chatbots, fraud detection — that need to ship without creating regulatory exposure.

Deliverables
  • AI system risk assessment against the NIST AI RMF
  • Data boundary review preventing leakage into public LLMs
  • Model bias and fairness review for customer-facing AI
  • AI governance policy and approval workflow
Typical Timeline

2–6 weeks per system reviewed, depending on system complexity and data sensitivity.

04 — People

Security Awareness Training

Most incidents start with a person: a convincing email, a reused password, a link opened in a hurry. We train your staff to recognise phishing and scams and to keep basic cyber hygiene, in plain language, with records your auditors and regulators can rely on.

Deliverables
  • Live or remote sessions for staff and leadership
  • Phishing and social-engineering awareness exercises
  • Cyber hygiene guides: passwords, devices, mobile money and payments
  • Attendance and completion records for audit evidence
  • Short refreshers through the year
Typical Timeline

A first programme in 2–4 weeks, then quarterly or yearly refreshers. Delivered in English or Somali.

05 — Digital Sovereignty

Digital Independence

Governments and institutions across Europe are reducing their dependence on foreign software and clouds, for control, compliance and cost. We help you do the same: know where your data and critical tools sit, then move what matters to systems you control, built on Kulan OS, Kulan Group's own secure desktop, and Kulan Fleet, its device and identity management.

Deliverables
  • Dependency and data-residency assessment, with a costed migration plan
  • Staff laptops on Kulan OS: encrypted, updated automatically, compliance-checked
  • Devices and staff accounts managed in Kulan Fleet: policies, lock, lost mode, joiners and leavers
  • Open-source office, email, files and video calls, hosted where you choose
  • Evidence for auditors: compliance scores and a full activity log
How We Start

An assessment of 2–4 weeks, then a pilot on a small group of laptops before any wider move. Some specialist work may stay on existing tools, and the plan says so honestly.

Engagement
Assessment
Where your data and tools sit, the risks, and a costed plan.
Migration
A pilot, then laptops, accounts and tools moved, with staff training.
Managed service
We run Kulan Fleet for you monthly: updates, compliance reports, people joining and leaving.
Common Questions

Before You Reach Out

How is this different from hiring a full-time CISO?
A full-time CISO is a six-figure salary commitment most mid-tier institutions can't justify year-round. Our fractional model gives you the same caliber of strategic oversight — policy authoring, audit liaison, AI governance — scoped to the cadence your institution actually needs, without the fixed overhead.
What if we still fail the inspection after working with you?
Our diagnostic and validation phases are built specifically to surface gaps before a real inspection, including mock audits that mirror what regulators actually check. No advisor can guarantee a regulator's outcome — but our job is to make sure nothing in your control is left exposed when that inspection happens.
Do you only work with large banks?
No. We work with banks, fintechs, telecoms, and healthcare organizations of varying sizes — the fractional CISO model in particular exists because smaller and mid-tier institutions face the same regulatory exposure as large ones without the same internal resources.
How long does a typical engagement take?
Audit readiness engagements typically run 4–8 weeks from diagnostic through validation. AI governance reviews run 2–6 weeks per system. Ongoing governance and CISO-as-a-Service engagements are continuous, scoped to a cadence that fits your institution.
Is everything we share with you confidential?
Yes. Every engagement is covered by a mutual NDA before any sensitive information changes hands, and our internal Business Ethics & Compliance Policy governs how client data is handled throughout and after an engagement.

Ready to scope an engagement?

Schedule a Compliance Briefing