Engagements
Start small. Ship something real.
Fixed scopes, clear deliverables and no open-ended retainers unless you want one. Every engagement starts with a free 30-minute call.
01AI Risk and Readiness Review
A fast, honest look at where your AI stands and what blocks production.
Best forOrganizations with AI pilots, or AI tools already in use
How it runs
Week 1
Interviews with the workflow owner, IT, security and compliance. We collect vendor contracts and architecture.
Week 2
We map data flows and vendors, test the riskiest paths and draft the gap analysis.
Week 3
We walk your leads through the findings and the prioritized plan.
You get
- AI use and vendor inventory
- PHI data-flow map
- BAA and control gap analysis
- Threat model and prioritized remediation plan
What we need from you
- A workflow owner, about 2 hours a week
- Vendor contracts and architecture documents
- One working session each with security and compliance
02Pilot-to-Production Sprint
Take one workflow live with controls, evaluation and monitoring in place.
Best forOne workflow that works in a pilot and needs to go live
How it runs
Weeks 1-2
We build an evaluation set from your real cases and measure a baseline.
Weeks 3-6
We harden the workflow: PHI controls, injection testing, human review and integration.
Weeks 7-10
We set up monitoring, run the go-live review and hand over to your owner.
You get
- Production-hardened workflow
- Evaluation suite and baseline metrics
- Monitoring and human review design
- Go-live evidence pack
What we need from you
- An engineer or vendor contact with access to the system
- Subject-matter reviewers to label a sample of real cases
- A BAA with Nisha Health if the work touches PHI
03Audit and Questionnaire Readiness
Answer buyers in writing and walk into your assessment prepared.
Best forAI vendors facing SOC 2, HITRUST or healthcare procurement reviews
How it runs
Weeks 1-2
We collect your recent questionnaires and map AI components, data flows and current controls.
Weeks 3-5
We write the answer library and close control gaps.
Weeks 6-8
We organize evidence and prepare you for your assessor.
You get
- Control mapping for your AI components
- Evidence collection plan
- Security questionnaire answer library
- Assessor-ready documentation
What we need from you
- Your most recent security questionnaires
- An engineering lead, a few hours a week
- Current policies and architecture documents
04Fractional AI Governance
Senior guidance on call as your AI footprint grows.
Best forOrganizations adding AI use cases faster than they can review them
How it runs
Monthly
Risk and vendor review of AI in use.
As needed
Intake and triage of new use cases.
Quarterly
Briefing for leadership and the board.
You get
- Monthly risk and vendor reviews
- Policy and standard updates
- New use-case intake and triage
- Board and leadership briefings
What we need from you
- A named internal owner for AI governance
- A standing monthly meeting
Scopes are examples. Every engagement starts with a free 30-minute call.
Questions
What buyers ask us first.
Do you sign BAAs?
Yes, when the engagement needs access to PHI. Many readiness reviews don't, and we use synthetic or de-identified data wherever the task allows.
Do you build, or just advise?
Both. Readiness reviews are analysis and documentation. Sprints are hands-on: we write evaluations, controls and integration code with your team, and you keep all of it.
Do we have to switch AI vendors?
No. We start with what you have. If a vendor can't meet your requirements, we show you exactly where and what your options are.
Do you replace our auditor or assessor?
No. We prepare you and work alongside your assessor. That independence matters, and we'll help you choose one.
Do you provide legal advice?
No. We map obligations and controls; your counsel makes the legal calls. We work directly with them when you want us to.
What does it cost?
Every engagement has a fixed scope. We quote after the first call, once we understand the workflow.
Have a pilot stuck in review?
Tell us what you built and where it's blocked. We'll tell you honestly whether we can help.