Managed technology as a service · with accountability : A managed technology seat on your org chart. With ownership & accountable outcomes.
Golonex holds the technology seat in your company — a named vCISO, vCTO, vCAIO, or DPO who owns technology, security, and compliance — and runs what that seat directs: compliance readiness, business process automation, infrastructure, software, and the Microsoft estate. One named Golonex lead on every engagement.
New Jersey based · delivery from the United States and India
The seat. Readiness. Managed delivery.
Someone accountable holds the seat. Reviews get you ready for the assessor. And when the work has to be built or run, Golonex does it — with a name on every engagement and a monthly report. Nothing here asks you to manage anyone.
A named seat-holder who owns technology, security, and compliance.
vCISO, vCTO, vCAIO, or DPO — whichever the job needs — on your org chart, directing your vendors and answering to your board.
- Owns the estate, the program, and the evidence
- Faces the assessor and the board; reports to you monthly
- Fixed monthly seat price, six-month term
Reviews against the framework you are held to.
CMMC / NIST 800-171, EU AI Act and ISO 42001, ISO 27001, PCI DSS, and privacy — scope, assess, close the gaps, assemble the evidence, walk in prepared.
- A scored gap assessment, not advice
- The evidence pack the assessor expects
- Golonex prepares you; the assessor grades you
Seven ways to have the work built and run for you.
A managed Global Capability Center first, then talent, software, infrastructure, security assurance, the Microsoft estate, and process & AI automation — a named engineer or a dedicated team, one accountable lead.
- Fixed monthly pricing by seat
- Delivery team always dedicated
- Not an MSP or MSSP: we assure, we do not resell
If one of these landed on your desk, you’re in the right place.
You are in the DoD supply chain
CMMC Level 2 · NIST SP 800-171
AI is making decisions in the business
EU AI Act · ISO/IEC 42001
A customer or regulator wants proof of security
ISO/IEC 27001 · SOC 2
You store, process, or transmit card data
PCI DSS v4.0.1
Nobody owns the technology estate
vCTO · managed infrastructure
A process keeps breaking and no one owns it
Process & AI automation
Operating in India? DPDP Act readiness and a DPO of record are delivered through our India branch. India — DPDP, DPO & RBI →
The seat is for a specific kind of company.
Four things are true of every firm the seat works for. If they are true of yours, book the review. If they are not yet, you probably do not need a seat — you need a project, and we will say so.
- Something is forcing the question — an assessment date, a prime’s deadline, a customer questionnaire, a regulator’s letter.
- You are regulated, a contract requires you to prove that you are secure, or your technology has no owner.
- You have no full-time CISO or CTO, and no plan to hire one.
- The engagement makes sense against what’s at stake — for most firms, $3M+ in revenue or 25+ people, or a contract worth more than the fee.
You’re being asked to run, prove, and govern things nobody in the building owns.
You don’t know where you stand.
New obligations land monthly, the estate grew by accident, and “are we even in scope?” has no clear answer. Without a baseline, every plan is a guess.
You have vendors, not an owner.
An MSP, a cloud provider, developers, outside counsel — each optimising its slice. Nobody connects them, checks their work against the framework, or signs for the result.
Technology, compliance, and AI are three problems, handled by three vendors.
Your compliance advisor does not run infrastructure. Your MSP cannot govern AI. Your AI vendor is not a security practitioner. The controls never connect and the gaps hide in the seams.
One named leader. The whole mandate.
Golonex holds the technology seat in your company: one accountable, credentialed person — vCISO, vCTO, vCAIO, or DPO — who owns technology, security, and compliance, oversees delivery, and answers to your board.
You meet your seat-holder on the first call, by name, with their credentials. They sign the documents, face the assessor, and report to you monthly.
It does not matter who builds or who supplies talent. The seat owns the outcome.
Your MSP stays. Your cloud provider stays. Your engineers stay. What changes is that one accountable person now directs them, checks their work against the framework, and signs for the result. When the seat needs more hands, it can bring managed talent — supervised seats under the same leadership — or work with whoever you already have.
vCISO
Fractional Chief Information Security Officer
Owns the security program, the readiness reviews, the evidence, and the relationship with the assessor.
vCTO
Fractional Chief Technology Officer
Owns the technology estate and its vendors — cloud, identity, endpoints, backup — and the decisions about what gets built.
vCAIO
Fractional Chief AI Officer
Owns the AI inventory, risk tiering, human-oversight controls, and EU AI Act and ISO 42001 conformity.
DPO
Data Protection Officer of record
Owns personal-data obligations where the law requires a named officer, including the DPDP Act in India.
The technology seat, held fractionally.
One owner for security, compliance, and the people who run them. The seat comes with the work that proves it is filled.
Included
- The seat on your org chart — a named vCISO, vCTO, vCAIO, or DPO who answers to your board
- A 90-day baseline assessment against the frameworks you are held to
- The System Security Plan and POA&M — or the equivalent for your framework
- The policy set, written for the team that has to follow it
- A one-page monthly report, signed by the seat-holder
- Vendor oversight — your MSP, your cloud, your software suppliers
- Oversight of the day-to-day — your Microsoft 365, EDR, backup, and patching vendors held to the framework; assurance that their controls work is a separate seat Security assurance →
- A quarterly re-assessment so readiness is a state, not a date
- Cyber and AI-literacy training with attendance evidence
How it is scoped
In writing, before kickoff: the frameworks in scope, the mandates the seat owns, and the monthly price. When the work includes a build, it is scoped on its own through managed software delivery.
One control program. Every framework you are held to.
Each review runs the same way: scope, assess, close the gaps, assemble the evidence, walk in prepared. The controls are implemented once and crosswalked across every framework you are held to.
CMMC Level 2 readiness
CUI scoping, gap assessment against the 110 controls, SSP and POA&M, evidence pack, and a mock walkthrough before the C3PAO.
AI governance readiness
AI inventory, provider-vs-deployer mapping, risk classification, human oversight, and the logging that proves how your systems behave.
Security program readiness
A real ISMS, not paper — risk assessment, Statement of Applicability, Annex A controls, and the evidence to take you to certification.
Cardholder-data readiness
Scope reduction, the twelve requirements, SAQ or RoC preparation, and QSA coordination.
The readiness attestation
Evidence-based proof for boards, primes, and customers when no statutory audit applies. Not an accredited certification.
Comply once, satisfy many.
Most firms carry several of these at once — 800-171 and ISO 27001 and PCI. We implement the controls once and map them across every framework, so you do not run three projects to clear the same control.
Seven practices. One accountable lead on each.
When the work has to be built or run, Golonex does it. Seven practices under one named Golonex lead — a named engineer or a dedicated team, sized to the service, one monthly report. Golonex is not an MSP or MSSP.
Managed GCC
Your Global Capability Center — set up, run, and handed over
02Managed talent
Supervised engineering seats in six practices
03Managed software delivery
Teams and builds with a Golonex lead on every engagement
04Managed infrastructure
Azure, AWS, Google Cloud, on-prem, and the data center
05Security assurance
Recovery, patching, evidence, identity, and people — tested, not assumed
06Managed Microsoft ecosystem
Microsoft 365, Azure workplace, and Dynamics 365
07Managed process & AI automation
A process lead in your business, automating the work
Fixed monthly pricing by seat — dedicated or fractional — everywhere; a fixed-scope software build is the one exception, priced per milestone. All managed delivery →
Scope. Close. Evidence. Maintain.
Start with a review. Stay for the seat.
Scope & Assess
We establish what applies to you — the frameworks, the estate, the process — and benchmark you against it. A scored gap assessment, not a vague “you should improve.”
Close the Gaps
Policies, controls, builds, migrations, automations — done by Golonex or by the vendor you already have, overseen either way.
Evidence & Attest
We assemble the evidence pack, and where appropriate issue the Golonex Ready attestation. You walk into the assessment — or the board meeting — prepared.
Maintain
Readiness is a state, not a date. The seat keeps you there with quarterly re-assessment and a signed monthly report.
Four things the seat-holder does that a tool cannot.
The knowing part of compliance is cheap now. The part that costs something is a named person who signs, shows up, holds the seat, and reports.
Signs
Your seat-holder’s name goes on the System Security Plan, the Statement of Applicability, the DPIA, the risk register, and the monthly report. You know whose name it is before you sign anything.
Faces
In the room with the C3PAO, the QSA, the certification auditor, and the prime’s security team. Not a slide sent ahead.
Holds
A seat on your org chart, with the reporting line to match. DPO-of-record where the law requires one.
Reports
One page, every month, signed. What changed, what is open, what the board needs to decide.
Accountability is real, and it is bounded. It is scoped per engagement and never unlimited. The specific terms are set per engagement and walked through on the first call.
What stands behind the name.
Golonex Ready
An evidence-based readiness attestation against published criteria mapped to ISO 42001, ISO 27001, the EU AI Act, and DPDP. Three levels — Assessed, Ready, Maintained — so a board, a prime, or a customer can see where you stand when no statutory audit applies.
Golonex Ready is a readiness attestation against Golonex’s published criteria. It is not an accredited or statutory certification, and does not replace certification by an accredited body, a C3PAO assessment, or a regulator-mandated audit.
About the attestation →Credentialed practitioners
Every seat is held by a credentialed practitioner — CISM or equivalent, with framework-specific certification. You see your seat-holder’s credentials before the engagement starts.
Registered
Registered Practitioner (RP) registration with the Cyber AB in process for CMMC readiness. The assessment itself is always performed by an independent C3PAO — never by us.
Cyber and AI-literacy training with attendance evidence — for ISO 27001, CMMC awareness, and EU AI Act Article 4. Delivered via Genbay.
genbay.co ↗Questions every buyer asks
Do we need a compliance trigger to work with you? +
No. An audit date is the most common reason firms call, but “nobody owns our technology” is the same exposure — no owner, and no one whose name is on the outcome. The seat works either way: vCTO-led where the estate or the delivery is the problem, vCISO-led where the framework is. Enterprises most often come to us for compliance readiness or business process automation first.
What is the difference between readiness and certification? +
We deliver readiness — we assess you against the standard, close the gaps, and assemble the evidence. The formal result is issued by the accredited party: a C3PAO for CMMC, a QSA for PCI DSS, an accredited certification body for ISO, a licensed CPA firm for SOC 2. We get you ready, sit beside you during the assessment, and stand behind the evidence. We do not issue the report.
What does “accountable” actually mean — and is it unlimited? +
A named, credentialed seat-holder owns the program and the evidence: signs the System Security Plan and Statement of Applicability, serves as officer of record where the law requires one, faces the assessor, and reports to your board monthly. Accountability is real, and it is bounded. It is scoped per engagement and never unlimited. The specific terms are set per engagement and walked through on the first call.
Why do AI governance and information security belong together? +
The standards converge. ISO 42001 is built on the same management-system logic as ISO 27001, and the EU AI Act turns on the same data protection, logging, and traceability controls. Treating them as two projects is how firms pay twice and still fail. One seat runs one control program and crosswalks it across every framework you are held to.
Can you work alongside our existing IT provider or legal counsel? +
That is the most common arrangement. The seat-holder sits above your IT provider, your MSP, and your outside counsel — attending the relevant meetings, reviewing vendor contracts, and directing the work rather than replacing the people. It does not matter who builds or who supplies talent. The seat owns the outcome either way.
Are you the assessor? +
No, and that separation is required. Golonex prepares organisations for CMMC assessment — our CMMC Registered Practitioner registration with the Cyber AB is in process — and the assessment itself is performed by an independent C3PAO. The same separation applies to the QSA for PCI DSS and the certification body for ISO. A firm that prepares you cannot also grade you.
Do you also build and run things, or only advise? +
Both. Managed Delivery is seven practices that build and run the work the seat directs — a managed Global Capability Center, managed talent, software delivery, infrastructure, security assurance, the Microsoft estate, and process & AI automation. Each runs the same way: a named Golonex lead, a named engineer or a dedicated team, and one monthly report to you. Pricing is fixed by seat everywhere; the one exception is a fixed-scope software build, priced per milestone. You own everything that is built.
Thirty minutes tells you what you owe, what nobody owns, and exactly what we stand behind.
Bring the trigger — the contract clause, the questionnaire, the regulator’s letter, or the estate nobody runs. Leave with a scope, a gap list, and a name.