Procurement Packet
A procurement-aware overview of Cichocki Advisory's vendor posture: company facts, compliance summary, security controls, contract templates, and the workflow your team can expect from inquiry to engagement kickoff.
At a glance
The basics your procurement intake form needs. Sensitive details (EIN/TIN, banking, COI limits) provided through secure procurement channel.
Frameworks & current posture
Honest yes / no / partial / not-applicable status. I do not claim third-party attestation or certification.
| Framework / Requirement | Status | Details |
|---|---|---|
| Mapped | Controls mapped to applicable SOC 2 TSC areas (Security, Availability, Confidentiality). No SOC 2 Type II attestation currently claimed. | |
| Not certified | Not pursuing certification for the advisory practice at this time. | |
| Engagement-scoped | Advisory engagements typically do not involve PHI. BAA requirements are evaluated during contracting if PHI is in scope. | |
| DPA available | Where personal data processing is in scope. Cross-border transfer arrangements are agreed at onboarding; the control mapping (SOC 2 TSC) is documented under NDA. | |
| Handled where applicable | Consumer privacy requests handled where applicable; no sale of personal information. | |
| Not applicable | Cichocki Advisory does not process or store cardholder data. | |
| Not applicable | Advisory engagements operate outside FedRAMP-authorized cloud boundaries. | |
| Reviewed per engagement | Specific requirements assessed during scoping based on client industry and jurisdiction. |
What I actually do
Procurement-ready specifics. Items requiring third-party attestation are marked as such.
Data handling
Engagements are scoped to minimize sensitive data exposure. If client data access is required, scope, access method, and retention are documented in the SOW.
- Working drafts — retained only for the active engagement window and deleted within the agreed retention period after close
- — engagement working materials deleted within 30 days of engagement close unless SOW, NDA, legal hold, or procurement requirement specifies otherwise; engagement records retained per regulation
- Categories of data — defined per engagement; documented in DPA where applicable
Access & security controls
Principal-led practice means access discipline is tightly scoped; control-level detail is documented under NDA.
- — advisory work does not involve live client system access
- Personnel — engagement-specific personnel requirements reviewed during onboarding
Incident response
- as required by applicable law
- Principal-led response — incidents affecting an engagement are handled by me directly; no third-party SOC
- Control-level detail — documented under NDA
Subprocessors & tooling
Principal-led practice has no static "vendor stack" that touches every engagement. The tools that handle a given engagement's materials are disclosed during scoping.
- Disclosed per engagement rather than published in a static list
- Typical tools — email, calendar, document collaboration, secure file transfer, working drafts
- No confidential materials submitted to AI providers by default; exceptions require written approval
- — delivery channels and cross-border transfer arrangements are agreed at onboarding; the control mapping (SOC 2 TSC) is documented under NDA
- ThreadSync subprocessors handled separately on the ThreadSync Trust Center
Legal & financial
A certificate of insurance, contract templates, and financial onboarding documents are part of the NDA procurement packet; EIN/TIN is delivered after NDA.
- Certificate of insurance (COI) — part of the NDA procurement packet
- Cyber liability coverage, if required, is reviewed during procurement onboarding
- — MSA, SOW, NDA, DPA (use yours or mine)
- — provided through secure procurement channel
- Indemnification & LOL caps — negotiated per engagement, scoped to engagement value
Documents & timeline
Standard vendor-onboarding artifacts are returned within stated SLAs once NDA and engagement scope are confirmed.
- Initial response — 1 business day on inquiry receipt
- NDA: your template or mine
- — 5 business days from NDA + scope confirmation (SIG Lite, SIG Core, CAIQ v4, custom)
- Procurement packet — COI, W-9, NDA, DPA, data-handling overview within 2 business days of NDA (not including a newly completed questionnaire)
- Contract package — MSA / SOW / DPA / insurance evidence within stated procurement window
- Onboarding documents — W-9, banking, vendor-portal steps completed before kickoff
- Delivery format — follows your procurement workflow: a bundled PDF packet or upload into your vendor portal; questionnaires in Excel, Word, PDF, or your web form; NDA and DPA on your template or mine
From inquiry to engagement kickoff
Six steps. NDA before sensitive material is exchanged. Each step has a stated SLA so your team can plan downstream procurement actions.
Initial inquiry
Procurement, legal, or security sends onboarding requirements, desired documents, and target timeline. Acknowledged within one business day.
NDA & scope
Mutual NDA executes before confidential controls, subprocessors, COI details, or questionnaire responses are shared. NDA: your template or mine.
Security review
Questionnaire, control mapping, data handling notes, incident posture, and subprocessor disclosure completed for the confirmed engagement scope. Within 5 business days of NDA + scope confirmation.
Contract package
MSA, SOW, NDA, DPA, insurance evidence, and vendor forms exchanged through the approved procurement channel.
Vendor onboarding
Tax forms, payment instructions, procurement portal steps, and required approvals completed before kickoff.
Engagement kickoff
Access paths, data boundaries, retention expectations, and escalation contacts confirmed before client materials are shared.
What I don't claim
Cichocki Advisory does not claim SOC 2 Type II attestation, ISO/IEC 27001 certification, FedRAMP authorization, HITRUST certification, or PCI DSS applicability. Controls are mapped to relevant SOC 2 Trust Services Criteria for advisory engagements, and non-applicable domains are marked with the reason. I answer security questionnaires with yes, no, partial, or not-applicable responses, supported by scope notes rather than inflated compliance claims.
Start a procurement conversation
Send your vendor onboarding checklist, required security questionnaire, contract templates, and target timeline. I will confirm scope, NDA path, and available materials within one business day.
Direct procurement inquiries: advisory@cichocki.com · Security inquiries: security@cichocki.com
