Consulting Readiness Playbook

Owner: M~ (CEO) + Zeus (MD) Started: 2026-08-23 Purpose: Build KNQX's consulting delivery capability from scratch — accurate, rigorous, practical — so that when LinkedIn marketing generates inbound interest, we can convert it professionally. Status tracking: This file is the single source of truth. Each chapter has its own file. Update statuses here.

THE ONE-LINE GOAL

"When a company emails us after a LinkedIn post, we have everything ready to run a professional first meeting, scope their needs, and deliver PDPA/AI-governance services with rigor — without improvising a single document."

WHY THIS EXISTS (the readiness gap)

Marketing is spinning up (3 posts/week, 30 video episodes scripted). Impressions → inquiries → first meetings → engagements. But today KNQX has: - ❌ No service catalogue (what we sell, what we don't) - ❌ No first-meeting SOP or deck - ❌ No methodology documents (how we actually do a PDPA gap assessment) - ❌ No tools (checklists, Excel forms, policy templates, RAGs) - ❌ No website - ❌ No pricing model - ❌ No subcontractor/partner network defined - ❌ No training materials (client-facing)

The risk: an inquiry arrives and we improvise. For a compliance brand, one sloppy engagement destroys credibility. This playbook closes that gap BEFORE the first inquiry.

STRUCTURE — 6 PARTS, 18 CHAPTERS

PART A — STRATEGY & POSITIONING (decide who we are)

PART B — KNOWLEDGE FOUNDATIONS (the RAG layer)

PART C — METHODOLOGY & FRAMEWORKS (how we work)

PART D — TOOLS & ASSETS (what we hand to clients)

PART E — GO-TO-MARKET (how clients find and trust us)

PART F — EXECUTION GOVERNANCE (staying on course)

BUILD ORDER (priority logic — not alphabetical)

Phase 1 (this weekend): Ch 01, 04, 10 — who we are, how knowledge is structured, what we must build. These unlock everything else. Phase 2 (week 1): Ch 05, 06, 07, 16 — RAG detail, methodology, roadmap. Phase 3 (week 2-3): Ch 02, 03, 11, 12 — SOPs, pricing, tool specs. Phase 4 (week 3-4): Ch 13, 14, 15 — training, website, network. Continuous: Ch 08, 09, 17, 18 — governance layers, updated as we go.

MILESTONE REVIEW GATES (M~ checkpoints)

ACCURACY RULES (non-negotiable — this is a compliance brand)

1. Every PDPA claim maps to a section of the Act or a PDPC guide. No paraphrasing from memory — cite: PDPA s.XX / PDPC [Guide name], [year], para X.
2. Primary sources only: PDPC website (pdpc.gov.sg), the Act itself (Singapore Statutes Online), IMDA/Baker McKenzie/Dentons for interpretation — and interpretation is always LABELLED as interpretation.
3. RAG content = verbatim extracts + metadata, never AI-paraphrased law. Paraphrase happens at output layer, always with citation.
4. Every client-facing template gets a version number + review date + "not legal advice" disclaimer until M~ (the certified AIGP/PDPA professional) signs off.
5. Build nothing speculative. Every tool in Ch 10 must trace to a service in Ch 01.

GBrain ANCHORING (sync strategy)

Master pages (create as chapters complete): - knqx-readiness-playbook — index page, links to all chapters, status - knqx-rag-pdpa-map — obligation → RAG → documents mapping (from Ch 05) - knqx-rag-aigov-map — same for AI governance (from Ch 06) - knqx-services-catalogue — the rated catalogue (from Ch 01) - knqx-tools-registry — every tool + build status (from Ch 10)

Tags: knqx, knqx-readiness, pdpa, ai-governance, rag, client-delivery

CONTINUITY MECHANISM

• Master plan (this file) = always current. Chapter files = append-only drafts until G-gate approval.
• A cron continuation job resumes the build after token reset (5h).
• Every work session ends with: update statuses in this file + one GBrain sync + a progress note to z_LinkedIN.

Last updated: 2026-08-23 03:40 — Zeus, session 1 COMPLETE. 18/18 chapters drafted. All parts A-F done. Next: M~ G1 review (9 questions, Ch 18), then Phase 2 build per Ch 16 roadmap.

Part A — Strategy & Positioning · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G1

1. KNQX Identity (locked decisions from prior sessions)

• What we are: Data protection & AI governance consultancy for SMEs/NGOs in Singapore — practical compliance, not paperwork theatre.
• Credentials: M~ is PDPA-certified (May 2026) + AIGP-certified (IAPP, Aug 2026). Both current.
• Brand promise: Effortless, practical compliance. We translate law into habits, checklists, and tools a business can actually run.
• Positioning: Not a law firm (we don't give legal opinions). Not a big-4 (we don't sell 200-page reports nobody reads). We are the practitioner layer: assess → fix → train → maintain.
• Consultants are partners, not competitors — our tools (data inventory, flow mapping) are built so other consultants can use them with their clients.

2. Service Catalogue — rated Effort / Impact / Fit

Scale: E = effort to build capability (1=days, 2=weeks, 3=months) · I = client impact/demand (1=nice, 2=strong, 3=urgent) · F = strategic fit with KNQX brand (1=adjacent, 2=core-adjacent, 3=core). ⭐ = flagship candidates.

Tier 1 — Core services (build first, this is the business)

Tier 2 — AI governance services (the AIGP edge)

Tier 3 — Adjacent services (partner/subcontract — we broker, don't build)

Explicitly OUT of scope (say it in the first meeting — Ch 02)

• Legal advice/opinions (we say what the law requires; counsel interprets disputes)
• Acting as a "responsible person" under any statutory scheme beyond DPO functions
• Cyber-attack response execution (we prepare, others respond)
• Anything outside Singapore PDPA + AI governance unless explicitly contracted (no GDPR-delivery claims — we can orient clients, not deliver)

3. The KNQX engagement ladder (how services chain)

LinkedIn post → inquiry → FIRST MEETING (Ch 02)
   → PDPA Readiness Assessment (svc 1)  [the door-opener, fixed fee]
       → findings report + remediation plan
           → Policy drafting (svc 3) + Data mapping (svc 2)
               → Training (svc 4) + AI Governance Check (svc 6)
                   → DPO-as-a-Service retainer (svc 5)  [the recurring layer]

Every engagement starts with svc 1 or 6 — both are scoped, fixed-price, 2-3 weeks. No open-ended consulting.

4. What "practical" means in delivery (the brand test)

Every deliverable must pass: (a) a non-lawyer client can read it in one sitting; (b) it names the obligation it satisfies (PDPA s.XX); (c) it produces an action, not awareness alone; (d) a 10-person NGO could implement it without hiring.

5. Open questions for M~ (Gate G1)

1. Confirm Tier 1 flagship order (proposal: svc 1 → 2 → 3 → 4 → 5).
2. Confirm referral-fee model for Tier 3 (flat fee or % or free goodwill?).
3. DPO-as-a-Service: single client capacity = how many hours/month? (affects svc 5 pricing in Ch 03).
4. Do we serve micro-SMEs (<10 staff) with a productised mini-audit, or minimum client size?
5. M~ capacity: solo + Zeus, first concurrent engagements cap? (proposed: 2)

Draft v0.1 by Zeus 2026-08-23 — awaiting G1 review.

Part A · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G3

1. The meeting's single objective

Not to sell. To diagnose. The first meeting (45-60 min, video or in-person) determines whether the client has a problem we can fix, at what scale, and whether they trust us. The output is a scoping summary + proposal — never a quote on the spot.

2. Pre-meeting checklist (Zeus runs this, M~ approves)

3. Meeting agenda (45-60 min)

Segment 1 — Listen (20 min) — the discovery questions

Ask in this order; do NOT pitch yet:

1. "Walk me through what your business does — who are your customers?" (context, data subjects)
2. "What made you reach out now?" (trigger: near-miss? LinkedIn post? customer question? tender requirement?)
3. "Where does your business keep customer information today?" (systems, spreadsheets, cloud tools)
4. "Does your team use AI tools — ChatGPT, Copilot, anything else?" (shadow AI probe — always asked, never leading)
5. "If a customer asked you today: 'where is my data and who can see it?' — could you answer?" (the visceral gap question)
6. "Who handles data protection responsibilities today?" (DPO status — often nobody)
7. "What would a data breach cost you — in fines, in customer trust, in sleep?" (consequence framing)
8. "Have you had any close calls — emails sent to wrong people, lost devices, suspicious invoices?" (breach history probe)

Rule: M~ takes notes on the Discovery Question Guide (A2); Zeus (if present) runs the survey-gap prompts. Client talks 70% of the first 20 minutes.

Segment 2 — Reflect (10 min) — the mirror

M~ plays back what we heard, structured: - "Here's what we understand about your data situation…" - "Here's what PDPA requires of a business your size… (plain language, 3-4 bullets max)" - "Here's where we see gaps between the two… (from the hypothesis + what we just heard)" - Name ONE concrete risk with a real enforcement example from our case library — the mirror moment.

Segment 3 — Frame (10 min) — the KNQX way

• The 5-stage method (Ch 07) on ONE slide: Map → Score → Prioritise → Fix → Verify
• "We don't sell reports. We make compliance a habit."
• What we DO (Tier 1-2 services, 1 line each) · What we DON'T do (legal opinions, cyber response — say it explicitly; honesty is the differentiator)
• One relevant mini-case: "A company like yours…" (from verified case library)

Segment 4 — Scope + next steps (5-10 min)

• "Based on today, the right starting point is: [PDPA Readiness Assessment / AI Governance Check] — a fixed-scope, fixed-fee engagement, 2-3 weeks."
• Send proposal within 48h (Zeus drafts, M~ reviews)
• If NOT a fit: say so honestly, refer to Tier 3 partner if appropriate. A clean no protects the brand.

4. Services Deck (A1) — 15-slide outline

5. The proposal (follows within 48h)

1-page structure: situation summary (their words) → recommended engagement → scope (what's in/out) → timeline → fixed fee → terms (from A4 engagement letter) → validity (14 days).

6. Discovery Question Guide (A2) — format spec

Printable PDF, 2 pages: page 1 = the 8 questions with note space; page 2 = survey-gap prompts (only if Data Inventory Survey was completed) + red-flag triggers (sector = healthcare/finance → protection emphasis; AI tool usage disclosed → AI Governance Check upsell path).

7. What we say when asked "how much?" (bridge to Ch 03)

Never quote cold. Standard line: "It depends on your size and data complexity — most businesses like yours start with the Readiness Assessment. You'll have exact numbers in the proposal within 48 hours." (Price anchoring happens on paper, not in conversation.)

Draft v0.1 by Zeus 2026-08-23 — awaiting G3 review + M~ dry-run at Gate G5.

Part A · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G3 — M~ DECIDES, Zeus documents

1. Pricing principles (the KNQX brand applied to money)

1. Fixed-fee first engagement. SMEs fear open-ended consulting. The Readiness Assessment is a product: fixed scope, fixed fee, fixed timeline.
2. Value-based tiers, cost-based floors. Price against the fine avoided and the tender won, not just our hours. But never below cost+margin floor.
3. The ladder monetises depth. Entry product is priced accessible; recurring value (retainer) carries the business.
4. Never discount scope — discount price only with reason (NGO rate, founding-client rate) and always labelled.
5. Publish ranges, quote exact. Website shows "from S$X" — proposals carry exact figures. (Transparency without price-shopping.)

2. Baseline economics (from Ch 07 time estimates)

Assessment (stages 1-3) = 12-17h Zeus+M~. At a blended internal cost assumption of S$150/h → S$1,800-2,550 cost. Target gross margin ≥60% on productised work.

3. Proposed price architecture (M~ to approve/adjust)

Tier 1 — PDPA services

Tier 2 — AI governance

Bundles (the ladder, priced)

Tier 3 — referral/partner revenue

Referral fee model: flat finder's fee (S$500-1,000) or 5-10% of first-year contract value for pen-test/legal/IR partners. M~ to confirm per partner (Ch 15).

4. Founding-client strategy (first 3 engagements)

• Labelled "Founding Client Rate": 30% off any Tier 1/2 service, in exchange for: named case study (or anonymised), testimonial, and permission to reference the engagement.
• Never free — free signals hobby, discount signals launch.

5. Payment terms

• 50% on signature, 50% on delivery (fixed-fee work)
• Retainers: monthly in advance, 3-month minimum, 12-month for bundle rate
• Late payment: pause work at 14 days (SOP, not punishment)

6. What M~ must decide at G3

1. Approve/adjust every indicative range above (they set positioning)
2. Mini-assessment variant: yes/no (recommendation: yes — it feeds the funnel)
3. Founding-client discount depth (30% proposed)
4. Retainer tiers (4/8/16h per month — right granularity?)
5. Referral fee model (flat vs %)

7. Pricing review cadence

• Revisit after engagements 1-3 (actual hours vs estimate → recalibrate)
• Annual review, or when PDPA amendments change scope materially

Draft v0.1 by Zeus 2026-08-23 — indicative figures are placeholders pending M~'s decision at G3. Do NOT quote to clients yet.

Part B — Knowledge Foundations · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G1/G2

1. The core idea (M~'s insight, made concrete)

One RAG per PDPA obligation cluster (and per AI-governance domain). Each RAG contains the primary-source law and guidance for exactly that obligation — so when we draft a policy, run an assessment, or answer a client question, retrieval pulls ONLY relevant legal text. No generic "PDPA chatbot" that mixes obligations.

Why this matters for rigor: - Retrieval precision → citations are always the right section of the right document - Chunking by obligation → a "retention" question never returns "transfer limitation" text - Smaller corpora → cheaper, faster, testable per-domain (Ch 09 quality gates) - Client-facing outputs cite like a professional: (PDPC Guide to Data Protection Practices, 2022, para 12.3) — not "the PDPA generally requires…"

2. RAG stack decision (practical, not exotic)

Build note: this is a content and structure project first, an engineering project second. 80% of the value is in Ch 05/06 (curating the right documents, chunking them well). No code until corpora are complete.

3. The 8 PDPA RAGs (cluster map — detail in Ch 05)

(11 obligations → 8 RAGs: closely-coupled obligations share a RAG where they're always assessed together. Consent+Notification is the strongest coupling.)

4. The AI-Governance RAGs (6 — detail in Ch 06)

5. Corpus rules (the rigor layer)

1. Verbatim only. Chunks are exact text from: PDPA (Singapore Statutes Online), PDPC advisory guidelines/guides, IMDA frameworks, named standards (NIST/ISO summaries with license check), enforcement decisions (summaries + citations).
2. Metadata per chunk: source_doc, source_url, section_id, obligation_tags[], version, date_accessed, license_note. Every retrieved answer inherits this.
3. No secondary-source contamination. Law firm newsletters (Baker McKenzie, Dentons…) live in a SEPARATE commentary/ folder per RAG, tagged type: commentary — retrievable on demand, never mixed into legal-text answers without the tag surfacing.
4. Enforcement decision library (shared, cross-RAG): every PDPC decision we've verified (S3/S2 series research) becomes a chunk tagged with the obligations it enforced — retrieval can pull "what did PDPC actually fine for this."
5. Version control: corpus updates are git commits; a change log notes what changed (e.g., "GenAI guidelines finalised 20 Jul 2026"). Clients may ask "as of when" — we answer precisely.
6. Refresh cadence (cron): monthly check of PDPC enforcement page + legislation amendments (Source Watch cron already exists — extend it, Ch 16).

6. What each RAG powers (the whole point)

One obligation cluster → one RAG → one checklist section + one policy family + one training module. This 1:1:1:1 mapping IS the KNQX methodology — it guarantees assessments, policies and training never drift from the law.

7. Build sequence (ties to Ch 16 roadmap)

1. RAG skeleton + corpus templates (this chapter + repo init) — Week 1
2. pdpa-breach + pdpa-retention first (smallest corpora, highest client urgency, we already have verified enforcement decisions from the video series research) — Week 1-2
3. pdpa-consent, pdpa-protection, pdpa-dpo-openness — Week 2-3
4. pdpa-transfer, pdpa-access-correction, pdpa-purpose — Week 3-4
5. aigov-pdpc-genai + aigov-sg-frameworks (differentiators — we have the sources from the LinkedIn research) — Week 4-5
6. Remaining aigov RAGs — Week 5-6
7. Golden Q&A eval sets per RAG — continuous, gate at each

8. Open questions for M~ (G1/G2)

1. Corpus licensing: NIST AI RMF is public domain; ISO 42001 is paywalled — use summary + clause-reference only (no verbatim ISO text). Confirm acceptable.
2. Start BM25-only (zero infra) vs embeddings from day 1? (Recommendation: BM25 hybrid first.)
3. Should enforcement-decision summaries be client-visible (cited in reports) or internal? (Recommendation: visible — it's our differentiator.)
4. Language: English only at launch? (Recommendation: yes; SME segment is English-first.)

Draft v0.1 by Zeus 2026-08-23 — awaiting G1/G2 review.

Part B · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G2

1. PDPA's 11 main obligations (the architecture source)

The PDPA is structured around data-protection obligations (Part III–IVA) and data-breach notification (Part VIA). The 11 main obligations are:

1. Consent Obligation (s 14)
2. Notification Obligation (s 13, 17)
3. Purpose Limitation Obligation (s 18)
4. Data Minimisation (implied — s 18 + 20)
5. Accuracy Obligation (s 19)
6. Protection Obligation (s 23–24)
7. Retention Limitation Obligation (s 25)
8. Transfer Limitation Obligation (s 26)
9. Access Obligation (s 21)
10. Correction Obligation (s 22)
11. Accountability: DPO + Openness + DPMP (ss 11, 12)

• Data Breach Notification (Part VIA, ss 26A–26D) — technically a distinct obligation cluster; treated as RAG 8.

2. Source documents per RAG (the corpus)

All documents sourced from pdpc.gov.sg (official) + Singapore Statutes Online (sso.agc.gov.sg). Each document has a stable URL and version.

RAG: pdpa-consent (Consent + Notification)

RAG: pdpa-purpose (Purpose Limitation + Minimisation)

RAG: pdpa-accuracy-protection (Accuracy + Protection)

RAG: pdpa-retention (Retention Limitation)

RAG: pdpa-transfer (Transfer Limitation)

RAG: pdpa-access-correction (Access + Correction)

RAG: pdpa-breach (Data Breach Notification)

RAG: pdpa-dpo-openness (Accountability: DPO, Openness, DPMP)

Estimated total: ~620 chunks across 8 RAGs. Manageable for BM25 hybrid retrieval; embeddings upgrade at ~1000 chunks.

3. Chunking rules (per chunk)

1. Split at section/paragraph boundaries — never mid-subsection
2. Each chunk = the smallest self-contained legal unit (a subsection + its notes)
3. Metadata header per chunk:

---
rag_id: pdpa-breach
source_doc: Data Breach Notification Guide
source_url: https://pdpc.gov.sg/...
section: 4.2
obligations: [breach-notification]
version: 2021-edition
date_accessed: 2026-08-23
license: public (PDPC)
type: primary-law
---
[verbatim text]

4. Commentary chunks (law-firm summaries) get type: commentary — retrievable separately
5. Enforcement-decision chunks get type: enforcement + the fine amount + obligations breached

4. Build order (ties to Ch 04 §7)

1. pdpa-breach (smallest, most urgent for clients, we have the enforcement library) — Week 1-2
2. pdpa-retention (small, high client value — our video EP covered it) — Week 2
3. pdpa-consent (largest after protection, foundational) — Week 2-3
4. pdpa-accuracy-protection (largest corpus, highest enforcement volume) — Week 3-4
5. pdpa-dpo-openness (DPMP is our assessment backbone) — Week 3-4
6. pdpa-transfer, pdpa-access-correction, pdpa-purpose — Week 4-5

5. Golden Q&A eval set (per RAG)

20+ questions per RAG with expected-citation sections. Example for pdpa-breach: - Q: "What is the maximum time to notify PDPC of a notifiable breach?" → A must cite PDPA s 26B(4) + DBN Guide para 4.3 - Q: "What makes a breach notifiable?" → A must cite PDPA s 26A(1) thresholds + DBN Guide ch 3

No RAG is used client-facing until its golden set passes ≥ 90% citation accuracy (Ch 09 quality gate).

Draft v0.1 by Zeus 2026-08-23 — awaiting G2 review.

Part B · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G2

1. The 6 AI-Governance RAGs

RAG: aigov-sg-frameworks (Singapore AI governance frameworks)

RAG: aigov-pdpc-genai (PDPC GenAI guidelines — the data-protection bridge)

RAG: aigov-risk-mgmt (AI risk management frameworks)

RAG: aigov-lifecycle (AI lifecycle governance)

RAG: aigov-incidents (AI incident handling)

RAG: aigov-training-data (Training data, provenance, poisoning, retention)

Estimated total: ~680 chunks across 6 AI-governance RAGs. Combined with PDPA RAGs: ~1300 chunks total — embeddings upgrade warranted at this scale.

2. The bridge: how PDPA RAGs connect to AI-Gov RAGs

The PDPC GenAI guidelines are the bridge document — they live in BOTH aigov-pdpc-genai AND have cross-tags to PDPA obligations (consent, purpose, retention, protection, access-correction). When a client asks "does using ChatGPT with customer data breach PDPA?" the retrieval pulls from BOTH aigov-pdpc-genai and the relevant pdpa-* RAGs — cross-RAG queries are allowed via the obligation_tags[] metadata field.

Client question: "Can our staff put customer data into ChatGPT?"
→ RAGs queried: aigov-pdpc-genai + pdpa-consent + pdpa-purpose + pdpa-protection
→ Returns: GenAI guidelines (AI-specific notification, publicly-available exception) + PDPA obligations (consent, purpose limitation, protection)
→ Answer cites both with the bridge explained

3. Build order (ties to Ch 16 roadmap)

1. aigov-pdpc-genai (we have the sources from LinkedIn research, highest differentiator) — Week 4-5
2. aigov-sg-frameworks (IMDA frameworks — differentiator for SG market) — Week 4-5
3. aigov-risk-mgmt (NIST AI RMF is public domain, easy corpus) — Week 5-6
4. aigov-incidents (we have all the verified cases) — Week 9-10
5. aigov-lifecycle + aigov-training-data — Week 9-10

4. Licensing notes

• NIST AI RMF: public domain — verbatim chunks OK ✅
• ISO/IEC 42001: paywalled — clause references + summaries only, no verbatim text ⚠️
• EU AI Act: official EU publication — verbatim summaries OK, cite EUR-Lex ✅
• PDPC/IMDA: public — verbatim OK ✅
• Academic papers (Nature, etc.): paywalled — cite + summarize key findings, no verbatim ⚠️
• Law firm commentaries: public articles — summarize with citation, not verbatim (copyright) ⚠️

Draft v0.1 by Zeus 2026-08-23 — awaiting G2 review.

Part C — Methodology & Frameworks · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G2

1. The core principle

Every KNQX assessment follows the same spine: Map → Score → Prioritise → Fix → Verify. Five stages, no improvisation. The methodology is the same whether it's a PDPA readiness assessment (svc 1) or an AI governance readiness check (svc 6) — the RAGs and checklists differ, the process doesn't.

2. The 5-stage KNQX Assessment Method

Stage 1 — MAP (understand the client's data world)

Inputs: Data Inventory Survey (B2) + client interview Outputs: Data inventory (what data, where, who accesses) + data flow map (how data moves)

Process: 1. Send Data Inventory Survey (Google Form) before the first meeting — client fills while we prepare 2. Review responses; identify gaps (missing data categories, undocumented flows, third-party processors) 3. First-meeting discovery interview (30-45 min): validate survey, probe undocumented flows, identify AI tool usage 4. Generate data flow diagram from survey responses (B3 Data Flow Map generator — or manual for v1) 5. Identify all third-party data processors + AI tools in use (feeds svc 6 AI Usage Audit)

Quality gate: data inventory must cover ALL personal data the organisation collects, uses, discloses, or retains. If a category is unknown, flag it. Never guess.

Stage 2 — SCORE (gap assessment vs obligations)

Inputs: PDPA Readiness Assessment Checklist (B1) — multi-tab Excel, one tab per RAG/obligation cluster Outputs: Maturity score per obligation + evidence log + gap list

Process: 1. Walk through each of the 8 RAG clusters (consent, purpose, accuracy-protection, retention, transfer, access-correction, breach, dpo-openness) 2. For each cluster: 5-15 questions, scored on a 4-point maturity scale: - 0 — Not in place: no policy, no practice, no awareness - 1 — Ad hoc: someone does it sometimes, not documented - 2 — Defined: written policy exists, partially implemented - 3 — Managed: policy implemented, monitored, reviewed periodically 3. Each score cites the evidence (policy document, interview response, observation) or flags "no evidence" 4. RAG-assisted: for each question, the RAG provides the legal basis (PDPA s.XX + PDPC guidance) so the client understands WHY each question matters

Quality gate: every score of 0 or 1 must have a recommended remediation action. No score without evidence. No evidence without citation.

Stage 3 — PRIORITISE (risk-weighted remediation plan)

Inputs: Gap list from Stage 2 + business context (client size, sector, data sensitivity, enforcement history) Outputs: Remediation Roadmap (B8) — prioritised actions with timeline

Prioritisation matrix: | Priority | Criteria | Timeline | |---|---|---| | P0 — Critical | Score 0 on a high-risk obligation (protection, breach notification, consent) OR active enforcement risk | 30 days | | P1 — High | Score 0-1 on medium-risk obligation (retention, access, DPO) | 60 days | | P2 — Medium | Score 1-2 on lower-risk obligation (transfer, purpose) | 90 days | | P3 — Improvement | Score 2-3, optimisation opportunity | 180 days |

Risk factors that shift priority: - Sector sensitivity (healthcare, finance → higher weight on protection/breach) - Data volume (10,000+ individuals → higher weight on retention/minimisation) - AI tool usage (ChatGPT/Copilot in use → higher weight on AI governance readiness) - Recent breach or complaint → everything moves up

Stage 4 — FIX (remediation delivery)

Inputs: Remediation Roadmap (B8) + client sign-off on priorities Outputs: Policy drafts (Ch 12), training delivery (Ch 13), tool implementation

This is where services chain: - P0 fixes → policy drafting (svc 3) + immediate training (svc 4) - AI governance fixes → AI Acceptable Use Policy (svc 7) + AI Usage Audit (svc 6) - Ongoing → DPO-as-a-Service retainer (svc 5) for monthly check-ins

Quality gate: every drafted policy maps to the obligation it satisfies (PDPA s.XX). The RAG that powered the assessment powers the policy draft — same knowledge base, same citations.

Stage 5 — VERIFY (closing the loop)

Inputs: Remediation actions completed Outputs: Verification report + updated maturity scores + recommendations for next review

Process: 1. Re-score any obligation where remediation was done (was 0, now 2?) 2. Evidence log updated with new policy documents, training records, process changes 3. Recommend next assessment cycle (typically 12 months for SMEs, 6 months for high-risk sectors) 4. If DPO-as-a-Service: monthly check-in (E1) tracks ongoing compliance + flags new obligations

3. The 4-point maturity scale (why 4, not 5)

We use 4 points, not the typical 5-point CMMI scale. Reason: a 5-point scale tempts "optimisation" (level 5) which is irrelevant for SMEs. A 4-point scale is actionable — there are exactly 4 states a business can be in, and each has a clear next step. Simplicity is the KNQX brand.

4. AI Governance Readiness Check — the adapted methodology

The same 5-stage method, adapted: - Stage 1 MAP: uses AI Usage Audit Form (B5) instead of data inventory — maps what AI tools staff use, what data goes in, what comes out - Stage 2 SCORE: uses AI Tool Risk-Tiering Matrix (B6) + aigov RAGs — scores against PDPC GenAI guidelines, IMDA MGAF, NIST AI RMF - Stage 3 PRIORITISE: AI tools tiered as High/Medium/Low risk → high-risk tools get immediate policy + training - Stage 4 FIX: AI Acceptable Use Policy (C6) + staff briefing (D2) - Stage 5 VERIFY: quarterly review of AI tool inventory (new tools added, old tools retired)

5. Assessment deliverables (what the client receives)

6. Time estimates (for pricing — Ch 03)

This sets the baseline for fixed-fee pricing in Ch 03.

7. Accuracy guarantees (Ch 09 integration)

• Every assessment question cites its legal basis (RAG-powered)
• Every finding links to evidence (document reference or interview note)
• Every recommendation cites the obligation it satisfies
• The findings report includes a "Sources & Authorities" appendix listing all PDPA sections and PDPC guides referenced
• M~ (certified AIGP/PDPA) signs off on every findings report before client delivery

Draft v0.1 by Zeus 2026-08-23 — awaiting G2 review.

Part C · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G2

1. Why SOPs (when the methodology exists)

Ch 07 defines HOW an assessment runs (the method). This chapter defines the operational routine per service — the checklist of steps, owners, handoffs and durations that make delivery repeatable at quality, even under load. Each SOP assumes the Ch 07 stages; it schedules them.

2. SOP-1: PDPA Readiness Assessment (svc 1) — the reference SOP

Standard duration: 2 weeks. Client-facing touchpoints: 3 (survey, review call, delivery call).

3. SOP-2: Data Inventory & Flow Mapping (svc 2)

Week 1: survey analysis → inventory table → process list from client. Week 2: flow mapping sessions (2×45 min per major process) → diagrams → inventory+map pack (PDF). Tools: B2→B3. Owner split: Zeus produces, M~ validates completeness ("did we miss a data category?").

4. SOP-3: Policy Suite Drafting (svc 3)

Day 1: pull assessment gaps → select policy set (C1-C9) → populate [BRACKETED] variables from client data. Days 2-5: RAG-drafted policies v0.9. Day 6: M~ legal review. Day 7: client review call (walk through each policy, plain English). Days 8-10: revisions + adoption pack (policies + briefing summary + sign-off page). Duration: 2 weeks per suite.

5. SOP-4: Staff Awareness Training (svc 4)

T-7: audience survey (roles, data they touch, AI tools they use — feeds examples). T-3: deck tailored (sector + their gaps, from assessment findings). T-0: 90-min session (M~ presents; format: 30 min law-in-plain-English → 30 min their-real-scenarios → 30 min quiz + discussion). T+2: attendance + quiz results logged (evidence for Accountability obligation). T+30: pulse check (3 questions to client DPO contact).

6. SOP-6: AI Governance Readiness Check (svc 6)

Week 1: AI Usage Audit (B5) + aggregation; tool inventory risk-tiered (B6). Week 2: high-risk tool deep-dives (B4 per vendor) + findings report (B7-AI variant) + remediation (AUP C6 first). Same M~ sign-off gate. Duration: 2 weeks.

7. SOP-5: DPO-as-a-Service (svc 5 — the retainer rhythm)

Monthly cycle: (1) check-in call 60 min (open items, incidents, new tools/vendors); (2) compliance check vs E1 template; (3) month report (1 pg: status, actions, horizon scan — new PDPC guidance, enforcement trends from RAG refresh). Quarterly: mini re-assessment (E4) + management update. Annual: full re-assessment (B1) + policy review. Incident hotline: acknowledge <2h during business hours, triage same day, breach clock assessment immediate (C3 flowchart).

8. Cross-SOP rules

• Every SOP's client-facing output passes M~ sign-off (Ch 09 Gate B) — no exceptions
• Every SOP consumes its RAG (same knowledge base across services — the 1:1:1:1 chain)
• Engagement tracker (F2) updated at every step — any team member can see status
• Handoffs happen through files + tracker, never memory
• Post-engagement retro (Ch 09 §6) within 5 days of close

Draft v0.1 by Zeus 2026-08-23 — awaiting G2 review.

Part C · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G2

1. The proposition

Clients pay for accuracy they can't produce themselves. One wrong legal claim in a findings report = credibility death for a compliance brand. This chapter defines the gates that make KNQX output trustworthy by construction, not by hope.

2. The accuracy gates (in order of delivery)

Gate A — RAG citation accuracy (every client-facing answer)

• Every RAG answer carries mandatory citations: source doc + section + version
• Golden Q&A eval per RAG: 20+ questions with expected citations; run before first client use and quarterly after
• Pass mark: ≥90% citation accuracy. Below = RAG blocked from client use until fixed
• Log: F1 RAG Query Accuracy Log — every client-facing query + citations + pass/fail

Gate B — M~ professional sign-off (every client deliverable)

• Findings reports, policy suites, training content: M~ reviews and signs (name + credential + date on the document)
• M~ is the certified professional (PDPA + AIGP) — this is the accountability layer
• No deliverable leaves the building unsigned. Zero exceptions.

Gate C — Version control (every template)

• F3 Template Version Register: file, version, changelog, review date, approver
• Client deliverables always generated from current registered version — never a stale local copy
• Annual review stamped on every template; PDPA amendment triggers immediate review cycle

Gate D — Fact verification (every external claim)

• Enforcement cases cited in decks/reports: from our verified case library (primary source + URL + date checked), never from memory
• Statistics (fine amounts, affected numbers): double-sourced where possible
• External articles used as context → labelled commentary, not law

Gate E — Dry-run before first live use (Gate G5 in Ch 16)

• Mock first-meeting (M~ presents, Zeus scores vs SOP)
• Mock full assessment on a friendly organisation (NGO pilot)
• Mock RAG queries across all 8 PDPA RAGs + 6 AI-Gov RAGs

3. Peer review & escalation

• Zeus drafts, M~ decides. On legal interpretation ambiguity: M~ rules; if genuinely uncertain → flag for counsel partner (Ch 15) rather than guess
• Challenge culture: any output where Zeus's confidence <90% is flagged [LOW CONFIDENCE — REVIEW] rather than softened and shipped
• Error protocol: mistake found in delivered work → correct fast, tell the client transparently, log the root cause, patch the template/checklist. Cover-ups kill compliance brands.

4. Independence & conflict checks

• Before engagement: conflict check (existing client in same sector/tender?), documented in F2 tracker
• DPO-as-a-Service independence: KNQX DPO function must be free from client-management interference (informed by PIPC's Coupang CPO finding — the regulator watches for this)

5. Data handling for client data (we eat our own cooking)

• Client data shared during assessments is handled per our OWN policies (C1-C3 apply to us first)
• Client data never enters consumer AI tools (our own AI AUP applies to Zeus/M~ workflows — enterprise terms + no-training configs only)
• Engagement closeout: return/delete client data per retention policy, evidenced

6. Continuous improvement loop

• Post-engagement retro: what took longer than estimated (feeds Ch 03 pricing recalibration), what the RAG got wrong (feeds corpus fixes), what the client struggled to understand (feeds plain-English rewrites)
• Quarterly: golden Q&A re-run + template review + enforcement-library refresh (cron-supported)

Draft v0.1 by Zeus 2026-08-23 — awaiting G2 review.

Part D — Tools & Assets · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G1

1. The rule (from the master plan)

Every tool traces to a service in Ch 01. If a tool isn't used in delivering a service, we don't build it. No speculative assets.

2. Tools registry (build order = priority)

Priority: P0 (must build before first client meeting) · P1 (first client engagement) · P2 (after first 1-2 engagements) · P3 (mature offering)

A. Sales & Meeting Tools

B. Assessment & Data Mapping Tools

C. Policy Templates (draftable — the deliverable)

D. Training Materials

E. DPO-as-a-Service Tools (retainer)

F. Internal / Quality Tools

3. Counts & effort estimate

P0 = 14 tools to build before first client. At ~1 day per tool (RAG-assisted drafting) ≈ 2-3 weeks. This sets the critical path for the roadmap (Ch 16).

4. The build loop (how tools actually get built)

For each tool:
  1. SPEC: define fields, output, RAG id it queries (Ch 11/12)
  2. DRAFT: RAG-assisted — pull relevant chunks, generate draft
  3. REVIEW: M~ reviews for PDPA accuracy (the certified professional sign-off)
  4. VERSION: register in F3, assign version 1.0 + review date
  5. TEST: dry-run with a mock client scenario (Ch 16 gate G5)
  6. DEPLOY: save to ~/projects/knqx-consulting-readiness/tools/<id>/

5. Open questions for M~ (G1)

1. Confirm P0 list (14 items) — is anything urgent missing?
2. Excel vs Google Forms for client-facing forms? (Recommendation: Excel for assessment, Google Form for surveys — easy client UX.)
3. Branding: do all client-facing tools carry KNQX logo + "prepared by KNQX, reviewed by [M~ name/credential]"?
4. Open-source the data-mapping tool to consultants (our "consultants are partners" positioning)? (Recommendation: yes, later, Phase P3.)

Draft v0.1 by Zeus 2026-08-23 — awaiting G1 review.

Part D · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G3

1. B1 — PDPA Readiness Assessment Checklist (THE core tool)

Format: Excel workbook, 10 tabs · RAG-powered: each question auto-cites its legal basis

Tab structure

Question row schema (every question, same columns)

ID | Question (plain English) | Legal basis (PDPA s.XX + PDPC guide) | 
Score (0-3 dropdown) | Evidence type (policy/interview/observation) | 
Evidence reference | Gap? (auto) | Remediation action (auto-suggest from RAG)

Sample questions (draft — final set RAG-verified at build time)

• C-01: "Do you obtain consent before collecting personal data, or rely on deemed consent/exceptions?" (PDPA ss 13-16; AG Key Concepts ch 14-17)
• P-01: "Is there a documented purpose for each category of personal data collected?" (PDPA s 18)
• PR-03: "Are laptops and mobile devices holding personal data encrypted?" (PDPA s 24; Guide to Data Protection Practices) — enforcement-informed: ST Logistics, Singapore Data Hub
• R-02: "Is there a documented retention period per data category, and a deletion process?" (PDPA s 25)
• BR-04: "Does the team know the 3-day notification clock and the 500-individual threshold?" (PDPA s 26B; DBN Guide)
• AC-06: "Is there a named DPO whose details are published?" (PDPA s 11(3); Guide to DPMP)

Auto-outputs

• Summary dashboard: 8 obligation scores (0-3) → radar-style visual, overall maturity %, top-5 gaps pre-populated
• Feeds B7 (findings report) and B8 (remediation roadmap) directly — no re-entry

2. B2 — Data Inventory Survey (Google Form)

15 questions, ~10 min for client. Fields: data categories collected (checkbox list: names, NRIC, contact, financial, health, photos, CCTV, CVs…), where stored (systems list), who has access (roles), third parties shared with, retention practices, AI tools used with company data (the shadow-AI backdoor question), volume bands (<1k / 1k-10k / 10k+ individuals).

Output: structured rows feeding B1 Tab 0 + B3 mapping.

3. B3 — Data Flow Map generator

v1 = Excel-based: inventory sheet (from B2) + flows sheet (source system → process → destination, incl. countries) → generates a Mermaid/flowchart diagram per process. v2 (post-revenue) = web app (the KNQX productised tool, Ch 01 svc 2).

4. B4 — Vendor Risk Assessment Form

Per-vendor sheet: vendor name, data shared, hosting country, DP terms present (Y/N + clause ref), sub-processors disclosed, breach history, AI-training-on-our-data flag (GenAI guidelines), risk rating (auto: Low/Med/High). Output feeds transfer-limitation and AI-governance scoring.

5. B5 — AI Usage Audit Form

Staff-facing anonymous survey: which AI tools used (list + free text), what data pasted in (bands: none/general/PII), frequency, approvals aware of (Y/N), output verification habits. Aggregate output only — no individual blame (adoption depends on honesty; state this on the form).

6. B6 — AI Tool Risk-Tiering Matrix

Per tool: purpose, data in/data out, human oversight level, vendor, deployment mode (consumer API vs enterprise). Auto-tier via rules: PII in + no enterprise terms → High; PII in + enterprise DPA + no training on our data → Medium; no PII → Low. High-tier tools get immediate AUP (C6) + vendor review (B4). Rules cite PDPC GenAI guidelines + IMDA MGAF deployment sections.

7. B7 — Assessment Findings Report template

Markdown→PDF, 8-12 pages: exec summary (1 page, plain English) → maturity dashboard → findings per obligation (score + evidence + legal basis + gap) → top-5 risks → remediation summary → sources & authorities appendix. M~ sign-off field on final page (name, credential, date).

8. B8 — Remediation Roadmap (Excel)

Columns: action, obligation, priority (P0-P3 auto from Ch 07 matrix), owner (client/KNQX), effort, timeline, dependency, status. Filterable views by priority + obligation.

9. E4 — Annual PDPA review checklist

Condensed B1 (25 questions) for retainer clients — tracks drift, flags new obligations (version-stamped against PDPA amendments).

10. Build notes

• All Excel tools share one house style: KNQX header, version footer (v1.0, review date, approver), instructions tab
• Data-validation dropdowns for scores (no free-text scoring)
• No macros in v1 (client trust + cross-platform safety)
• F3 Template Version Register tracks every file's version + review date

Draft v0.1 by Zeus 2026-08-23 — full question sets to be RAG-verified during build (Ch 16, Week 3-4). Awaiting G3.

Part D · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G3

1. The policy philosophy

Every KNQX policy template is: short (2-4 pages, not 20), obligation-mapped (each section cites the PDPA section it satisfies), fill-in-the-blank (client name, roles, systems in [BRACKETS]), and implementable (each section ends with "How this looks in practice" — 2-3 bullets a non-lawyer can follow). RAG-drafted, M~ reviewed, version-stamped.

2. Template specs (the P0 four first)

C1 — Data Protection Policy (master)

C2 — Retention & Disposal Policy

Categories × retention period × disposal method × responsible role (table-driven; auto-populated from B2 inventory). Disposal log template appended. (PDPA s 25; enforcement-informed: SLA-IBM 28-year retention failure.)

C3 — Breach Response & Notification Plan

1-page flowchart (Is it a breach? → assess harm/scale → notify PDPC ≤3 days + affected individuals if required → contain → document → review) + roles card + notification decision tree (500-individual / significant-harm thresholds, s 26A-26B) + PDPC contact template. (Enforcement-informed: People Central delayed notification fine.)

C6 — AI Acceptable Use Policy

Sections: what AI tools are approved; what data may NEVER be entered (PII, confidential, client data — unless enterprise-terms tool); verification duty (human checks AI output before client delivery); disclosure rules (when to flag AI use); prohibited uses (legal/medical advice reliance, autonomous actions affecting third parties); incident reporting (AI gone wrong → escalate like a breach). (PDPC GenAI guidelines; enforcement-informed: Samsung leaks, Deloitte citations, Melbourne gym agent.)

3. Remaining templates (P1-P2) — one-line specs

• C4 Access & Correction SOP: request intake → verification → 30-day response workflow (ss 21-22 timelines) + response letter templates
• C5 Data Transfer Policy: transfer inventory table + comparable-protection assessment checklist (s 26 + Cross-Border Guide)
• C7 AI Vendor Assessment Policy: procurement gate — no AI tool without B4 review + DPA terms + no-training clause (GenAI guidelines)
• C8 DPO Role Charter: responsibilities, reporting line, escalation, protection from interference (s 11(2); informed by Coupang CPO-independence finding)
• C9 AI Incident Response Playbook: deepfake/BEC/rogue-agent scenarios + decision trees + comms templates (case library powered)

4. Drafting pipeline (per policy)

RAG pull (obligation chunks + enforcement cases) 
→ Zeus drafts v0.9 with [BRACKETED] variables
→ M~ reviews for legal accuracy (the sign-off that matters)
→ Version 1.0 registered (F3), review date stamped
→ Client engagement: variables filled from assessment data → client-ready in days, not weeks

5. The "not legal advice" layer

Every policy footer: "Prepared by KNQX. This document supports PDPA compliance and reflects [PDPC guide, version, date]. It is not legal advice; consult counsel for legal opinions." Removed only if/when counsel partners co-brand (Ch 15).

Draft v0.1 by Zeus 2026-08-23 — awaiting G3.

Part D · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G4

1. The training philosophy

KNQX training is behaviour change, not legal education. Staff don't need to know section numbers — they need to know what to do differently on Monday morning. Every module follows the same shape: 30% plain-language law → 40% their real scenarios → 30% practice (quiz + discussion). Sessions are short (60-90 min), delivered by M~ (the certified professional), and every module produces an evidence artifact for the client's Accountability obligation (attendance + quiz results — PDPA s 11/12, DPMP).

2. D1 — PDPA Essentials (90 min, the core staff session)

Evidence pack delivered after: attendance sheet, quiz results, slide PDF, habit-commitment summary — the client's proof of staff training for their DPMP.

3. D2 — AI at Work (60 min, the fast-growing session)

4. D3 — Breach Response Tabletop Drill (2h, for management + DPO)

Scenario-card format: inject timeline (T+0 anomaly email → T+2h "is this a breach?" → T+1d media call → T+3d PDPC deadline). Teams work the C3 flowchart under time pressure; Zeus scores decisions vs the notification thresholds (s 26A/26B); debrief maps their choices to the 18-day SLA-IBM disclosure failure. Output: drill report with response-time metrics — evidence of breach-preparedness.

5. D4 — Bite-size online modules (the scalability layer)

Built on the existing bite-size learning system (skill: bite-size-learning). 5-10 min interactive HTML modules — one per habit from D1 plus AI rules from D2 — deployed to shortlearnings.pages.dev per client (private links). Purpose: onboarding new staff between live sessions + annual refresher evidence. Build after the live decks are stable (P2).

6. Production pipeline

1. M~ defines learning objectives + reviews all legal content (Gate B, Ch 09)
2. Zeus drafts decks (RAG pulls the cases + plain-language obligation text)
3. M~ dry-runs each deck once before client delivery (Gate E)
4. Quiz banks: 2x questions needed, rotated per session (no quiz-sharing erosion)
5. Every client session's scenarios are tailored from their assessment findings — never a canned deck

7. What training is NOT

• Not certification prep (no "PDPA certificate" promises — staff awareness only, say so plainly)
• Not a legal seminar (zero section citations in slides; they live in the facilitator notes only)
• Not one-size — a 10-person NGO and a 200-person fintech get different scenario sets

Draft v0.1 by Zeus 2026-08-23 — awaiting G4 review.

Part E · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G4 · Dependency: domain check (M~ action)

1. The website's job

Not a brochure — a conversion + credibility machine for inbound from LinkedIn. A DPO or CEO who saw a post lands here and must think "these people are rigorous and practical" within 8 seconds. Secondary job: capture leads before we're ready to sell (waitlist) and host our tools (client portals).

2. Structure (5 pages + blog)

3. Technical approach

• Static site on Cloudflare Pages (existing infrastructure, zero marginal cost, fast, we control it) — built by WebChef per house rules
• Domain: knqx.com or knqx.com.sg — M~ to confirm ownership (open item, Ch 18)
• Client tools portal: assessment checklists + reports delivered via Cloudflare Access (email-OTP) — same pattern as linkedin-hub; per-client subdomains only if needed (P3)
• Analytics: Cloudflare Web Analytics (privacy-first — no Google trackers on a privacy consultancy's site, obviously)
• Forms: Cloudflare Workers → the mailing-list D1 database already exists (memory: mailing-list-worker) for waitlist capture

4. Content rules

• Every claim cites its source (fine amounts, case names) — same rigor as posts
• "From S$X" pricing ranges only; exact quotes happen in proposals (Ch 03 §7)
• No stock photos of people pointing at screens (brand rule) — Sam/Freddy mascot art + clean typography instead
• Accessibility matters: our own site should pass basic WCAG (a compliance brand gets audited by prospects)

5. Build sequence (Week 7-8 per Ch 16)

1. M~ confirms domain → DNS to Cloudflare
2. Content draft (Zeus — all copy reviewed by M~, Gate B)
3. WebChef builds 5 pages + blog skeleton → deploy → verify
4. Lead-capture wired (waitlist form → D1 DB; inquiry form → z_LinkedIN notification)
5. Free self-check PDF produced (lite B1) as the resources lead-magnet
6. G4 review: M~ approves every page before public launch

6. What we deliberately skip at launch

No chatbot (ironic but true — an AI chatbot on a privacy site is a governance conversation we don't need yet) · no client login portal (manual delivery first) · no payment processing (invoices, not e-commerce) · no SEO campaign (LinkedIn is the funnel; SEO is a later investment).

Draft v0.1 by Zeus 2026-08-23 — awaiting G4 + domain confirmation.

Part E · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G4 · M~ decides all partnerships

1. The make/borrow/buy principle

KNQX delivers the compliance layer in-house. Everything deeper (legal opinions, technical testing, incident response) is partnered, not faked. The network is a quality filter: we refer only to firms we'd trust with our own brand — because our name is on the introduction.

2. The four partner slots

3. Referral mechanics (M~ decides the model — Ch 18 Q3)

• Direction 1 — we refer out: client needs pen-test → we introduce partner → partner handles, we stay the compliance architect. Fee: flat S$500-1,000 or 5-10% (M~ decides). Never both directions on one job.
• Direction 2 — they refer in: law firms/IT providers with SME clients who need PDPA work → KNQX. Same fee logic mirrored. This is the growth lever — one good IT-services partner can feed assessments monthly.
• Ethics rule: we recommend the right partner for the client's need, full stop. If the best partner doesn't pay referral fees, we still recommend them. The brand outlives any single fee.

4. Partner qualification checklist (F4 tool spec)

Per prospective partner: accreditation verified · 2 reference clients checked · insurance/liability cover confirmed · data handling terms reviewed (they'll touch client data too — our Protection Obligation extends to them, PDPA s 24) · conflict-check process · response-time SLA · fee structure documented. Signed partner one-pager before the first referral. Reviewed annually.

5. The consultant-partner play (our differentiator, from Ch 01)

Independent consultants use KNQX tools (data mapping, checklists) with their own clients. Mechanics: consultant tier on the tools portal → they run assessments on our platform → we stay the methodology owner. Pricing: tool subscription or per-engagement licence (M~ decides at G4). Build after first 3 direct engagements prove the tools (P3) — don't scale a product before it's been battle-tested.

6. Sequence

1. Week 4: counsel shortlist (M~) — needed before first engagement for the escalation path (Ch 09)
2. Week 6: pen-test partner (first assessment will surface the need)
3. Week 8: IR partner + referral agreements papered
4. Month 4+: consultant tier exploration (only after tools proven)

Draft v0.1 by Zeus 2026-08-23 — awaiting G4. All partnership decisions are M~'s.

Part F · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G1 (review at end of Week 2)

The constraint

Marketing starts producing content NOW (3 posts/week from Monday). Realistic first-inquiry ETA: 4-8 weeks after posting starts. Everything P0 must be done by end of Week 6. The rest can follow.

12-week roadmap

Week 1-2 (Phase 1+2 — foundation)

Goal: Who we are + how knowledge works + what to build. | Deliverable | Owner | Chapter | |---|---|---| | Service catalogue finalised | M~ reviews Zeus draft → approve | Ch 01 | | RAG architecture approved | M~ reviews Ch 04 → approve | Ch 04 | | PDPA RAG source-map approved | M~ reviews Ch 05 → approve | Ch 05 | | Tools inventory approved | M~ reviews Ch 10 → approve | Ch 10 | | pdpa-breach RAG corpus built + golden Q&A | Zeus builds + tests | Ch 05 | | pdpa-retention RAG corpus built | Zeus builds | Ch 05 | | GATE G1 — M~ reviews direction (end of Week 2) | | |

Week 3-4 (Phase 2+3 — methodology + first tools)

Goal: How we work + the P0 assessment tools exist. | Deliverable | Owner | Chapter | |---|---|---| | Assessment methodology draft | Zeus → M~ review | Ch 07 | | pdpa-consent + pdpa-protection RAGs built | Zeus | Ch 05 | | AI Governance RAG architecture (Ch 06) | Zeus | Ch 06 | | aigov-pdpc-genai RAG built | Zeus (we have the sources) | Ch 06 | | PDPA Readiness Assessment Checklist (B1) | Zeus drafts, M~ reviews | Ch 11 | | Data Inventory Survey (B2) | Zeus drafts | Ch 11 | | Assessment Findings Report template (B7) | Zeus drafts | Ch 11 | | 4 P0 policy templates (C1, C2, C3, C6) | RAG-assisted drafting, M~ reviews | Ch 12 | | Services deck (A1) | Zeus drafts → M~ reviews | Ch 02 | | GATE G2 — M~ reviews rigor (end of Week 4) | | |

Week 5-6 (Phase 3 — commercial + delivery readiness)

Goal: Ready for first client. | Deliverable | Owner | Chapter | |---|---|---| | First-Meeting SOP (A2) + discovery guide | Zeus drafts → M~ dry-runs | Ch 02 | | Pricing & packaging (A3, Ch 03) | M~ decides, Zeus documents | Ch 03 | | Engagement letter template (A4) | M~ + external counsel review | Ch 03 | | pdpa-dpo-openness + pdpa-transfer RAGs | Zeus | Ch 05 | | aigov-sg-frameworks RAG | Zeus | Ch 06 | | Vendor Risk Assessment Form (B4) | Zeus | Ch 11 | | AI Usage Audit (B5) + Risk-Tiering Matrix (B6) | Zeus | Ch 11 | | Quality & rigour protocol (Ch 09) | Zeus drafts | Ch 09 | | GATE G3 — ready for first inquiry (end of Week 6) | | |

Week 7-8 (Phase 4 — go-to-market + training)

Week 9-10 (Phase 4 continued — training + partner)

Week 11-12 (Phase F — dry run + finalize)

Post-Week-12 (ongoing)

• DPO-as-a-Service tools (E1-E4) build as first retainer signs
• RAGs refreshed monthly (Source Watch cron extended)
• Golden Q&A eval sets re-run quarterly
• Policy templates version-updated annually or on PDPA amendment

Dependencies & critical path

G1 approval (Week 2) → unlocks all tool building
  → B1 Checklist (Week 3) → B7 Report (Week 4) → [first engagement possible]
G2 approval (Week 4) → unlocks website + training content
G3 approval (Week 6) → unlocks go-to-market (website live, pricing public)

Critical path: Ch 01 → Ch 04 → Ch 05 RAGs → Ch 11 B1 → Ch 07 → Ch 02. If this chain is delayed, the first inquiry catches us unprepared.

What Zeus builds autonomously vs what needs M~

Zeus builds autonomously (research, RAG corpora, tool drafts, website, training skeletons): - All RAG corpora (from verified primary sources) - Assessment checklist drafts (M~ signs off PDPA accuracy) - Policy template drafts (M~ reviews) - Website (M~ approves content) - Internal quality tools

Needs M~ (cannot proceed without): - Service catalogue approval (G1) - Pricing decisions (Ch 03) - PDPA accuracy sign-off on every client-facing template - First-meeting dry-run (M~ presents) - Subcontractor/partner selection decisions - Any external communication (website copy, client emails)

Draft v0.1 by Zeus 2026-08-23 — awaiting G1 review at end of Week 2.

Part F · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G1 (structure now live)

1. Why GBrain for this

The playbook files hold the drafts; GBrain holds the queryable knowledge state — the maps, registries and statuses that any future session (or the Telegram bot, or a subagent) needs to continue the build without re-reading 18 chapters. GBrain is the continuity layer.

2. Page architecture (live as of tonight)

Tags: knqx, knqx-readiness, pdpa, ai-governance, rag, client-delivery, services, tools.

3. Sync cadence

• Session end (always): update knqx-readiness-playbook statuses + last-updated line
• Chapter approved at a gate: update the relevant page + add timeline entry (what was approved, when)
• RAG corpus event: update the map page (status 🔲→🟡→✅, chunk count actual vs estimate)
• Tool built: update tools registry (P0→✅ version 1.0)
• Nightly dream cycle (existing cron) handles link/timeline reconciliation automatically

4. Query patterns this supports (the payoff)

• "What's the build status of the pdpa-breach RAG?" → map page
• "What are the P0 tools?" → registry page
• "How does the engagement ladder work?" → catalogue page
• "Where is the playbook?" → playbook page → file paths
• A fresh cron session continues the build from GBrain alone — no chapter re-reading needed

5. Rules

• GBrain pages are SUMMARIES + pointers, never the full chapter text (single source of truth stays in the files)
• Every page carries its source file path
• Status vocabulary fixed: 🔲 not started · 🟡 in progress · ✅ draft complete · 🟢 gate-approved
• M~-decision fields in pages always marked "M~ DECIDES" so no session treats them as settled

Draft v0.1 by Zeus 2026-08-23. Pages 1-5 created tonight; pages 6-7 on their trigger events.

Part F · Status: 🟡 Draft v0.1 (2026-08-23) · Gate: G1 (review at wakeup)

1. Open questions needing M~'s decision (consolidated from all chapters)

At G1 (now — direction): | # | Question | From | Recommendation | |---|---|---|---| | 1 | Flagship order: Assessment → Data Mapping → Policies → Training → DPOaaS? | Ch 01 | Yes — assessment feeds everything | | 2 | Mini-assessment for micro-SMEs (≤10 staff)? | Ch 01/03 | Yes — funnel-feeder at S$1.8-2.2k | | 3 | Referral fees for Tier 3 partners: flat vs %? | Ch 01/03 | Flat S$500-1k (simple, no ongoing admin) | | 4 | DPO-as-a-Service tiers: 4/8/16 h/mo? | Ch 03 | Yes — 3 clean tiers | | 5 | Max concurrent engagements while solo? | Ch 01 | 2 (Zeus does the production load) | | 6 | ISO 42001 paywalled — summaries + clause refs OK (no verbatim)? | Ch 04 | Yes — cite, don't reproduce | | 7 | Enforcement case library client-visible in reports? | Ch 04 | Yes — our differentiator | | 8 | RAG tech: BM25 hybrid first, embeddings later? | Ch 04 | Yes — corpus quality > infra | | 9 | Tools: Excel for assessment, Google Forms for surveys? | Ch 10 | Yes |

At G3 (commercial): all Ch 03 price points · founding-client 30% discount · retainer tier pricing · payment terms.

Later (G4): website domain (knqx.com.sg owned? — check) · open-sourcing the data-mapping tool to consultants (P3 decision).

2. Key risks & mitigations

3. Dependencies (external, flagged)

• Google OAuth (surveys + sheets) — operational ✅
• Cloudflare (website, tools hosting) — operational ✅
• Counsel partner (Ch 15) — NOT yet identified. Needed before first engagement for the legal-opinion escalation path. M~ action: shortlist 1-2 SME-friendly law firms by Week 4.
• CREST pen-test partner — NOT yet identified. Needed only if a client needs VA-PT (Tier 3 referral). Week 6+ acceptable.
• Domain (knqx.com / .com.sg) — verify ownership before website build (Week 7). M~ action: confirm domain status.

4. What would make me stop and escalate immediately

• Any PDPA claim I cannot verify against a primary source → blocked until verified (Gate D)
• Token/infra limits hit mid-build → continuation crons + master-plan state (already proven tonight)
• Any hint of a conflict of interest in a prospective engagement → pause, document, M~ decides

5. Definition of "ready" (the finish line)

KNQX is inquiry-ready when: services deck ✚ first-meeting SOP ✚ engagement letter ✚ B1 checklist ✚ B2 survey ✚ B7 report template ✚ 4× P0 policies ✚ pdpa-breach + pdpa-retention RAGs live with golden Q&A passed ✚ pricing approved. That's Week 6 on the current plan.

Draft v0.1 by Zeus 2026-08-23 — M~ review at G1.