01Public bodies deserve evidence, not estimates.
Procurement rules, citizen data at scale, and legacy systems mean a scope cannot be set on a sales call.
Authorized assessment
Scoping and written approval with leadership happen before any review begins.
Citizen data obligations
NDPA obligations, plus NDPC directives that apply to public and private controllers alike, run through every diagnostic.
Independent by design
Syndik8 advises and coordinates. Penetration testing goes to vetted third parties, so findings carry weight with auditors.
02Two diagnostics. Fixed fees, set by scope, not by conversation.
Fees depend on what is being assessed, one institution or a whole state, and are not negotiated.
Agency Diagnostic
- For one ministry, agency, parastatal or public institution
- Authorized security and data protection assessment
- External exposure review
- NDPA / NDPC readiness check
- Owner interviews and process walkthroughs
- Severity-graded, plain-language findings report
- Phased, procurement-ready roadmap and leadership briefing
State-wide Security Diagnostic & Blueprint
- Whole-of-government posture review
- Estate-wide asset and exposure inventory
- NDPA / NDPC readiness across controllers and processors
- Findings graded by severity and by MDA, quick wins separated from structural work
- Costed, phased blueprint
- Briefing to the Executive Council
The ongoing programme is priced from the roadmap. Third-party services, including independent penetration testing, are billed at cost plus a 15% coordination margin and quoted separately.
03Diagnose first. Then choose how much we own.
The diagnostic delivers findings and a roadmap whether or not the engagement continues. Programme fees are quoted from that roadmap.
Tier 1 · Security Oversight
Independent retainer oversight. Syndik8 sets the target design and holds vendors and internal teams accountable. The agency or state executes.
Tier 2 · Security Transformation
Fixed and milestone fees to close the roadmap through consolidation, hardening and monitoring, with independent delivery assurance.
Tier 3 · Outcomes Partnership
A retainer plus a performance fee tied to independently verified milestones: baseline reached, filings completed, findings closed. Never tied to incident counts, and settled only after verification.
Fixed pricing for certainty. Performance-based payment only on verified milestones. Vendor-neutral and independent throughout. A lean senior team leads every engagement, with vetted specialists added as needed.
04Start with a conversation at the top.
A short, free, no-obligation briefing for leadership on the diagnostic, the engagement model, and what comparable bodies face under the NDPA and the Cybercrimes Act.
Request the briefing or write to hello@syndik8.com.