Skip to content

Information Security Consultancy Agreement — CyberSquad (Andrea Cardinali)

Purpose. Puts the existing consultancy engagement in writing so that the internal audit, the drafting work and the repository access Andrea already has are covered by a signed agreement with confidentiality, data-protection and independence terms. Until this is signed, GetAgency checklist row 4 (contractor agreements) and the independence claim in ISMS-DOC-09-2 rest on practice rather than paper.

Status: drafted 2026-09-01 for signature. Andrea to sign as soon as possible; Olaf countersigns for Soon.

1. Parties
Client Soon Technologies B.V. ("Soon"), represented by Olaf Jacobson, Information Security Manager
Consultant Andrea Cardinali, trading as CyberSquad ("the Consultant")
Related party The Consultant is the brother of Soon's founders. This is disclosed here and in ISMS-DOC-05-2 §1.7, and the independence controls in §4 exist because of it.

2. Scope of services

The Consultant provides information-security advisory services to Soon, specifically:

  1. Drafting and facilitation of ISMS documentation (policies, procedures, forms) for ISO/IEC 27001:2022 and SOC 2 Type 1, working from Soon's actual practices and never inventing facts about Soon.
  2. Internal audit of the ISMS under ISMS-DOC-09-2, including planning, fieldwork, the audit report and follow-up.
  3. Advice on control design, remediation and audit preparation, including sourcing candidate ISO 27001 certification bodies.

Not in scope: operating any Soon control, holding production credentials, or accessing customer personal data. The Consultant advises; Soon's staff operate.

3. Confidentiality

The Consultant is bound by Soon's Non-Disclosure Agreement (ISMS-DOC-A06-6-2), which is incorporated into this agreement and signed alongside it. In particular:

  • Everything in the SoonHQ/isms repository, on isms.soon.works, in the evidence store and in Soon's meetings is Confidential unless marked otherwise.
  • Nothing is copied to personal or third-party systems beyond what the work requires; working copies are deleted at the end of the engagement.
  • Confidentiality survives the engagement for two years, matching the Founder Undertaking (ISMS-DOC-A06-6-3).

4. Independence of the internal audit

Because the Consultant drafts much of the ISMS and audits it, and is a related party:

  1. Second review. Every document the Consultant drafts is reviewed and approved by the ISM before it takes effect. The Consultant never approves a document.
  2. No self-audit of operation. The internal audit tests whether controls operate, from evidence produced by Soon's staff; it does not re-assess the adequacy of the Consultant's own drafting, which the ISM's approval covers.
  3. Disclosure. The related-party relationship is stated in the audit report.
  4. Escalation. The Consultant may raise any concern about pressure on audit conclusions directly to top management (the three operating founders) under ISMS-DOC-05-2.

5. Data protection

The Consultant does not process customer personal data on Soon's behalf and is not a sub-processor. Incidental exposure to personal data (e.g. names in evidence screenshots) is treated under §3 and GDPR: use only for the engagement, no retention, report any suspected breach to the ISM the same day per ISMS-DOC-A05-26-1.

6. Access and security obligations

Access Scope Granted by Reviewed
GitHub outside collaborator CybearSquad Read on SoonHQ/isms only; no other SoonHQ repository; no organisation membership ISM At each internal-audit close-out and at quarterly access review
isms.soon.works Cloudflare Access, read; evidence upload not required ISM As above

The Consultant works from a device meeting Soon's Device Security Standard (disk encryption, screen lock, current OS, MFA on the GitHub account) and confirms this in the quarterly attestation like any staff member. Access is revoked on the last day of the engagement per ISMS-FORM-A06-5-1.

7. Intellectual property

All documents, templates and other work product created for Soon under this agreement are Soon's property on creation. The Consultant may reuse general know-how and generic structures that contain nothing specific to Soon.

8. Term, fees and termination

  • Term: from the start of the engagement (Q2 2026) through the ISO/IEC 27001 certification audit, targeted Q1 2027; extended by written agreement.
  • Fees: Pro bono. No fee is charged for the engagement. This does not reduce the confidentiality, security and independence obligations in §3, §5 and §7, which apply in full.
  • Termination: either party on 30 days' written notice; §3, §5 and §7 survive.

9. Signatures

For Soon Technologies B.V. Consultant
Name: Olaf Jacobson Name: Andrea Cardinali (CyberSquad)
Title: Information Security Manager
Date: Date:
Signature: Signature:

A countersigned PDF is filed in Google Drive → Legal; this file records the agreed text.

Change log

Version Date Author Change
0.1 2026-09-01 Olaf Jacobson First draft, written to put the existing engagement on paper before the SOC 2 Type 1 audit.
0.2 2026-09-10 Olaf Jacobson §6: corrected the consultant's GitHub access from Write to Read on SoonHQ/isms, to match the access granted at the 2026-09-09 access review. Text otherwise unchanged; issued for signature.
0.3 2026-10-13 Olaf Jacobson §8: engagement start pinned to Q2 2026, matching the text issued for signature.