Statement of Work
Automated Compliance & Audit-Readiness Platform
Prepared by Starks Enterprise — starksenterprise.com · Irving "Gene" Starks Jr. · [email protected] · (980) 355-9706
Purpose & Overview
Starks Enterprise will design, build, and deploy a continuous compliance monitoring platform that scans Client's cloud environment against a selected framework (SOC 2, NIST 800-53/CSF, PCI DSS, or HIPAA), identifies control gaps, and produces audit-ready evidence and reporting on an ongoing basis.
Scope of Work
Discovery workshop to select applicable framework(s) and define control scope
Cloud environment assessment (Azure/AWS) and connector configuration for automated evidence collection
Control-mapping engine configuration against selected framework
Automated gap detection with severity scoring and remediation guidance
Audit-ready evidence repository and exportable reporting
Role-based dashboard for compliance owners and executives
Initial baseline assessment and remediation roadmap
Deliverables
Configured compliance monitoring platform (multi-tenant SaaS or dedicated instance per Client requirement)
Control-mapping matrix for the selected framework(s)
Baseline gap assessment report with prioritized remediation roadmap
Admin and end-user documentation
30-day post-launch support window
Timeline
| Phase | Activities | Duration |
|---|---|---|
| Phase 1 | Discovery, framework selection, environment access | 1-2 weeks |
| Phase 2 | Platform configuration & connector setup | 2-3 weeks |
| Phase 3 | Baseline assessment, tuning, UAT | 1-2 weeks |
| Phase 4 | Go-live & knowledge transfer | 1 week |
Pricing & Payment Terms
| Item | Timing | Fee |
|---|---|---|
| Platform build & baseline assessment (one-time) | Due at kickoff (50%) / go-live (50%) | $12,000 - $18,000 |
| Ongoing monitoring & reporting (per month) | Monthly, in advance | $800 - $2,000/mo |
| Additional framework module (per framework) | One-time | $3,500 |
Invoices are due net 15. Monthly monitoring fee begins the month following go-live and continues until terminated per Section 9.
Client Responsibilities & Assumptions
Client will provide timely access to relevant systems, personnel, and documentation needed for discovery.
Client will designate a single point of contact for the duration of the engagement.
Cloud infrastructure costs (hosting, compute, storage) are billed separately to Client unless otherwise stated.
All work is performed remotely unless on-site work is explicitly scoped and priced separately.
Pricing assumes a single production environment and a single tenant/client instance unless stated otherwise.
Out of Scope
Formal third-party audit or attestation (Client engages its own auditor)
Remediation implementation of identified gaps (available as a separate SOW)
On-premises (non-cloud) environment scanning unless separately scoped
Acceptance Criteria
Platform successfully connects to and reports on all in-scope cloud accounts
Baseline assessment report delivered and reviewed with Client
Client sign-off on dashboard access and report accuracy
Term & Termination
This SOW is effective upon signature by both parties and remains in effect through delivery and acceptance of all deliverables, or until terminated by either party with 30 days' written notice. Fees for work performed and expenses incurred prior to termination are non-refundable. This SOW is governed by, and incorporated into, the Master Services Agreement between Starks Enterprise and Client.