Discover
Typical engagements begin at $1,500.You know the operation should run better, and you may be under pressure to “do something with AI,” but nobody has mapped where the hours and the risk actually go.
What BSTS does
- The Bevier Breakdown — structured discovery of workflows and systems
- Business and technology discovery with the people doing the work
- Workflow and process assessment
- AI opportunity assessment — including where AI is the wrong answer
- Security and compliance gap assessment
- Existing platform and tool inventory
- Data-flow discovery — where sensitive information actually travels
- Prioritized implementation roadmap
What you are left holding
A written roadmap ranked by cost and risk, a systems and data-flow map, and an executive briefing. Yours to keep and act on — with us or without us.
Engagement format
A facilitated engagement, typically two to three weeks.
Discovery comes first, always. No forced AI, and no solution looking for a problem — sometimes the honest recommendation is a better process rather than new software.
Build
Typical projects begin at $5,000.The same information gets typed into three systems. Reports are assembled by copy-paste. Approvals get chased through inboxes, and the work scales by adding people.
What BSTS does
- Secure AI implementation
- Intelligent workflow automation
- Business-process automation
- System and application integration
- Secure RAG and knowledge systems
- AI assistants and agents with guardrails
- Reporting and reconciliation workflows
- Document and form processing
- Email and inbox workflows
- Workflow orchestration
- Deterministic scripts where AI is unnecessary
What you are left holding
A working system in production — not a slide deck — with data boundaries tested before it touches live records, human approval on consequential actions, logging, documentation and staff handoff.
Engagement format
A fixed-scope sprint, typically 30 days, with acceptance criteria agreed in writing first.
BSTS does not recommend AI where a simpler, safer automation does the job. A deterministic script that runs the same way every time often beats a model, and we will say so.
Secure
Scoped after discoveryPeople are already pasting company information into AI tools, and nobody can say which tools, which data, or under what rules.
What BSTS does
- AI security architecture
- AI governance program development
- AI use-case inventory — including shadow AI
- Approved-use and acceptable-use policies
- Data classification
- Data-flow review
- Access-control recommendations
- DLP recommendations
- Human-in-the-loop design
- Vendor and model risk review
- Platform risk review
- Logging and evidence requirements
- Responsible-use and oversight controls
- NIST AI RMF alignment where useful
What you are left holding
A governance and security policy set with named control owners, a use-case inventory, and architecture decisions that put payment and identity data structurally out of a model’s reach — excluded by design, not by policy alone.
Engagement format
Scoped from the discovery roadmap; delivered alongside or after implementation.
Prove
Scoped after discoveryA large customer has asked for your SOC 2 report, security questionnaires keep getting harder, and controls that exist informally cannot be demonstrated.
What BSTS does
- SOC 2 readiness
- Security and compliance readiness assessments
- Control inventory and control mapping
- Gap analysis
- Remediation tracking
- Evidence requirements and evidence organization
- Policy and procedure alignment
- Security questionnaire support
- Audit-readiness support
- NIST CSF 2.0 · NIST SP 800-53 · ISO 27001
- CJIS · HIPAA · CMMC
- FedRAMP-related environments where applicable
What you are left holding
A control inventory mapped to the frameworks that actually apply to you, a tracked remediation list, and evidence organized so an examination is a retrieval exercise rather than a scramble.
Engagement format
Scoped following an assessment; often runs as a program rather than a project.
BSTS prepares organizations for audits and is not a party to the auditor's opinion. BSTS does not issue SOC 2 reports. SOC 2 examinations and attestation reports are performed by qualified independent CPA firms.
Maintain
Scoped following an assessment.Evidence goes stale, vendors change, staff turn over, and the automation nobody owns quietly drifts out of alignment with how the business now runs.
What BSTS does
- Continuous assurance
- Ongoing control monitoring
- Evidence-refresh support
- Policy and documentation maintenance
- Vendor reassessment
- Platform reassessment
- AI-governance reviews
- Workflow performance reviews
- Maintenance of implemented automations
- Change-impact reviews and control reviews
- Security and compliance advisory support
What you are left holding
Audit-readiness maintained between cycles, evidence automated where the systems allow it, and a quarterly roadmap that keeps the next decision in front of you.
Engagement format
A recurring retainer. Deliberately capped so delivery quality holds.
Supporting category
Digital Foundations is the infrastructure layer underneath the work above — secure, dependable, and maintained. It is not the centre of what BSTS does.
Digital Foundations
Scoped after discoveryThe website is slow, unmaintained or quietly broken; the domain, email and forms were set up years ago by someone who has since left; and nobody is watching whether any of it is still up.
What BSTS does
- Secure website creation
- Website modernization
- Website repair
- Managed website maintenance
- Website security monitoring
- Uptime monitoring
- Backup and recovery
- Domain and DNS configuration
- Business email setup
- Secure forms
- Lead-routing workflows
- Privacy-conscious analytics
- Accessibility remediation
- Performance improvements
- Basic business-system connections
What you are left holding
Infrastructure that stays up, stays patched, stays backed up, and routes enquiries to a person instead of a mailbox nobody owns.
Engagement format
Project work, or a monthly managed arrangement.
Digital Foundations pricing
- Secure website build$2,500 – $7,500
- Website refresh or repair$1,250 – $4,000
- Managed maintenance and security$175 – $500 per month
- Domain, email, forms and analytics setupStarting at $750
Not offered: paid advertising, social-media management, content campaigns, generic SEO packages, logo creation, branding packages, or general marketing-agency services.
How pricing works here
Each stage stands on its own — nothing here requires committing to the whole sequence up front. The roadmap that discovery produces is yours to keep whether or not you continue. Most organizations start with an assessment and decide from there.
- Published starting prices are floors, and floors are never discounted — when budget is tight, scope shrinks instead.
- No final price is quoted before scope is agreed in writing, with acceptance criteria.
- The recurring program is never quoted before an assessment.
- No hourly rates, and no return-on-investment guarantees.
Final scope and pricing follow a discovery conversation.
BSTS does not issue SOC 2 reports. SOC 2 examinations and attestation reports are performed by qualified independent CPA firms.
Start where it makes sense.
The Bevier Breakdown is a short self-assessment — plain language, nothing sensitive, and nothing is transmitted until you choose to send it.