Fractional IT leadership

From scrappy startup to grown-up IT.

Bantam gets growing companies security- and audit-ready — starting with the IT Gap Scorecard, then SOC 2 or PCI readiness and fractional IT & security leadership. Fixed scope, senior-only, no surprises.

Start with the Gap Scorecard See services
14-day Gap Scorecard Fixed-scope readiness audits & sprints Senior-only delivery
bantam-engagement.ts
1const engagement = await Bantam.run({2  phase: 'gap-scorecard',3  company: yourCompany,4  scope: ['identity', 'security', 'vendors'],5  guardrails: { fixedScope: true },6}); 7// → IT Gap Scorecard            delivered8// → Risk-scored gap list        prioritized9// → 90-day readiness plan       documented  ✓ Your team, owning it.
Built on operational fundamentals
Identity & Access Security program & IR readiness Vendor & License Management Documentation & Handoff

Each pillar maps to a concrete engagement — so you always know what you are buying and what "done" looks like.

What we do

Four engagements, one throughline: build IT that outlasts you.

01 / SERVICE

IT Gap Scorecard

$2,500 fixed · 14 business days. A structured look at how your company actually runs IT — identity, devices, vendors, security posture, and the gaps nobody has had time to close. Surfaces and prioritizes; does not fix. You leave with a signable 90-day plan you could take to anyone.

  • Stack & vendor inventory + duplication report
  • Risk-scored gap analysis
  • Executive-ready 90-day plan
  • Joiner/mover/leaver gap assessment
  • 30-min executive debrief — top 3 risks

Fixed fee, fixed 14-business-day window. The full $2,500 credits toward a Compliance Readiness Audit, SOC 2/PCI Readiness Sprint, or the first retainer month if you sign within 30 days of delivery. Two Gap Scorecard / Compliance Readiness Audit slots per month. If both are taken, we hold a start date for the next open window.

This is an assessment and a written plan. Your team implements — or we help through a SOC 2 / PCI Readiness Sprint or a Fractional Leadership retainer. Fixed price means fixed scope. If something material is out of scope, we pause and write a change order before more work starts. Not included: remediation work, penetration testing, and the formal audit or attestation.

02 / SERVICE

Compliance Readiness Audit & SOC 2 / PCI Readiness

$6,500 fixed · 3–4 weeks. Everything in the Gap Scorecard, plus a control-gap map against your target framework — SOC 2 Security criteria, PCI DSS SAQ, or NIST 800-171 — and a realistic budget and timeline for reaching audit.

  • Control-gap map against the target framework
  • Policy inventory + incident-response readiness check
  • Scoping memo — systems, vendors, data flows
  • Budget & timeline to audit
  • 60-min executive readout

Then: SOC 2 Readiness Sprint ($18,000 fixed · 12 weeks) or PCI Readiness Sprint ($8,500 fixed · 6 weeks). Weekly working sessions; your team implements. Fixed price means fixed scope. If something material is out of scope, we pause and write a change order before more work starts.

This is an assessment and a written plan. Your team implements — or we help through a SOC 2 / PCI Readiness Sprint or a Fractional Leadership retainer. Bantam prepares you for audit readiness. We are not your auditor and we do not issue SOC 2 reports or PCI attestations — only a CPA firm (or QSA, for applicable PCI work) can do that. Not included: fixing gaps, penetration testing, the audit itself, auditor or compliance-platform fees, and hands-on Microsoft 365 administration.

03 / SERVICE

First 90 Days Foundation Program — currently waitlisted

From $30,000 · 90 days. Hands-on stand-up of IAM/MFA, device baseline, vendor consolidation, and handoff docs. Currently waitlisted.

Join the waitlist at info@bantamitconsulting.com. Until then, start with the Gap Scorecard or Compliance Readiness Audit, then a SOC 2 / PCI Readiness Sprint or Fractional Leadership retainer.

04 / SERVICE

Fractional Leadership

Advisory $3,000/month (up to 8 hours) · Program $5,500/month (up to 16 hours). Ongoing player-coach engagement for companies not ready for a full-time IT Director. Architectural decisions, vendor wrangling, and compliance program ownership — capped hours, without another headcount.

  • Strategic & hands-on, not slide-deck-only
  • Async support, two-business-day response
  • Internal team mentoring

Hours are capped and written into the SOW. No 24/7 incident response.

How it works

A 90-day arc from "we need IT" to "IT runs."

Deliberate, senior, small engagements. We don't show up with a team of ten — we show up with one person who has done this before, and a written plan you can actually hold us to.

  1. 01

    Discover

    Interview the team, inventory tools, map how work actually happens.

  2. 02

    Prioritize

    Score gaps by business risk, compliance exposure, and how much pain they cause weekly.

  3. 03

    Implement

    Close the priority gaps — controls, policies, access reviews — with the team, not around them.

  4. 04

    Operate

    Document, hand off, and stand up the runbooks so the next person doesn't have to call us.

The Bantam promise

Senior, transparent, and built to be handed back.

These aren't marketing lines — they show up as clauses in the SOW, security plan, and runbook documentation delivered with every engagement.

SOW

Fixed-scope engagements.

Scope, timeline, and deliverables defined up front. Change control is explicit — no silent scope creep, capped monthly retainers with written hours — no open-ended time-and-materials, no "we'll figure it out as we go."

SEC

Security-first, from incident experience.

Every engagement is shaped by real incident work — malware outbreaks across large site fleets, compromised cloud credentials, and access drift nobody had mapped. We build for the day something goes wrong, not just the demo.

DOCS

Documented for handoff.

Runbooks, decision logs, and vendor inventories are deliverables, not afterthoughts. The goal is a self-sufficient team — not a permanent dependency on us.

Common questions

Answers before the first email.

What is the IT Gap Scorecard?
A 14-business-day, $2,500 fixed-fee engagement that maps your stack, vendors, and security posture against where a company your size should be. You get a risk-scored gap analysis, vendor duplication report, joiner/mover/leaver gap check, and a 90-day plan an executive can sign off on — not a 60-page report nobody will read. Fixed fee and a fixed 14-business-day window. The fee credits toward follow-on work if you sign within 30 days.
Does the audit fee apply if we keep working together?
Yes. The full $2,500 credits toward a Compliance Readiness Audit, a SOC 2 or PCI Readiness Sprint, or the first retainer month if you sign within 30 days of audit delivery. The audit also stands alone — take the plan to anyone if you prefer.
How long does an engagement take?
The IT Gap Scorecard runs 14 business days. The Compliance Readiness Audit runs 3–4 weeks; a SOC 2 Readiness Sprint runs 12 weeks and a PCI Readiness Sprint 6 weeks. The First 90 Days Foundation Program is currently waitlisted. Fractional Leadership is a rolling monthly commitment with a clear off-ramp built into the SOW. Every timeline is fixed at the start; we'd rather scope tighter than slip.
Do you replace our existing IT person or team?
No. We work alongside the people you already have — usually an office manager or ops generalist who has been keeping IT alive. The goal is to give them the systems, documentation, and runbooks to run it confidently after we leave, not to take their job.
What size company is Bantam best suited for?
Growing companies of roughly 20–300 employees without a full-time IT leader — past the founder-runs-Google-Workspace stage, not yet ready to hire a Director of IT. If you're feeling the seams strain, that's usually the right moment.
How do you handle security incidents during an engagement?
Bantam does not offer on-call or same-day incident response. During a fixed-scope engagement, if something urgent comes up, we help you contain and document within the hours already agreed in the SOW — or we pause and schedule a written change order. For companies that need a tested plan, we offer a fixed-fee Incident Response Tabletop Exercise ($4,000): one custom scenario, a facilitated session, and an after-action report with owners. The playbook and report stay with you.
What do I receive at the end of an engagement?
Deliverables and the documentation your team owns — a risk-scored gap list and 90-day plan, control and policy documentation for readiness work, plus runbooks, decision logs, and an inventory of every license and contract. The deliverable is a team that doesn't need to call us.
Get in touch

Ready to stop duct-taping IT?

Send a short note about what you're working on. We reply within two business days to see whether the IT Gap Scorecard is the right fit — or to schedule a 20-minute discovery call in an early-morning, lunch, or after-5 pm ET window.

reply  within two business days