The necessary ones make the site work. The others measure which pages help and which ads bring the people who need DM11. Your choice, and you can revisit it from the footer.
Governance and compliance
The shields the studio checks before it sends you the content.
We prepare your operation for registration on the Trusted Partner Network, or TPN, which the content production supply chain uses to decide who receives content before release. We translate what the studio asked for into an assessment scope and lead the preparation through the assessment that publishes your shields on the registry.
The work starts by locking down the scope in writing. Then comes the gap assessment against the content security best practices, with evidence organized by site or by service, which is how the assessor views your operation. We complete and review the self-assessment in the format the assessor expects and build the security file that answers not only this assessment but the next client who asks.
For the work to move, we need access to the facilities and systems in scope, to the people responsible for them, and to the studio's original request. How far we go is your choice: from the gap assessment with an action plan to full support, with a rehearsal before the assessment. The assessment is always conducted by a TPN-authorized assessor, and the shields are published by the network itself.
The stages and deliverables below describe the Full compliance work modality. The other modalities appear when you request the proposal.
Scope definition
We agree in writing what is in and what is out, and why. A badly defined scope is the most common cause of a project running over.
Gap assessment
We compare what exists today with what the reference requires, item by item, and classify each gap by risk and by effort to fix. The result comes out in order of attack: what to do first and why, instead of an inventory of everything that is wrong.
Implementation
We stand the controls up together with your team, write down what needs to exist on paper and train the people who will operate them. Nothing counts as implemented until it works in practice and someone on your side can sustain it.
Evidence routine
We set out how each control proves it worked, with an owner and a frequency, so the audit does not turn into a scramble.
Usually comes together with
Not a bundle, and it changes nothing you have already chosen. It is what tends to come up next, in the experience of companies that have been through this.