AI for technology consultants
Ultramarine Work sits in the engagement folder with the discovery notes, the RFP, client table exports and the control evidence, and hands back the business case, migration mapping or SteerCo deck with each figure’s source file named.
Customer-master-mapping.xlsxExample| Source (Oracle EBS) | Target (Corvus ERP) | Rule | Valid from | Reconciliation |
|---|---|---|---|---|
| RA_CUSTOMERS.CUST_ACCOUNT_ID | bp_master.bp_number | Carry as text, keep leading zeros, no renumbering | 2026-03-02 | 86,214 of 86,214 rows tie to extract v9 |
| HZ_PARTIES.PARTY_NAME | bp_master.name1 | Title case, strip the legacy branch code in parentheses | 2026-03-02 | 12,406 trimmed, 86,214 non-blank |
| HZ_ORGANIZATION_PROFILES.TAX_REFERENCE | bp_master.tax_num_enc | Encrypt at load, display shows last 4 only | 2026-03-02 | 85,972 populated, 242 blank and deferred |
| RA_CUSTOMERS.PAYMENT_TERM_ID | bp_fin.pay_terms | Map by TERM_XREF v4, unknown codes default to NET30 | 2026-01-01 | 42 unknown codes confirmed by AR owner Feb 13 |
| Match key: TAX_REFERENCE, PARTY_NAME | bp_master.merge_group | Merge accounts sharing the key, oldest account leads | 2026-03-02 | 32 groups detected, 29 resolved, 3 open |
NoteThe 3 open groups are Southfork Freight Group accounts sharing one tax ID, so the client picks the lead account before rehearsal 3.
Ask it for
“Build the business case for retiring the client’s 15-year-old claims platform, with 3-year TCO, NPV at 10% and build-versus-buy against the two vendor quotes.”
Business-case-claims-platform.xlsx“Map the legacy Oracle customer master into the new ERP, with transformation rules, effective dating and reconciliation, and the rows that still need a decision.”
Customer-master-mapping.xlsx“Rate the threats to the patient portal from the pentest report and network diagram under NIST SP 800-30, and flag the ones with no control mapped to them.”
Patient-portal-risk-register.xlsx“Shred the county transit RFP into a compliance matrix: every shall in Section C, each Section L page limit and Section M factor, plus the forms Section J lists.”
RFP-compliance-matrix.xlsx“Draft the buy-side memo from data room exports, cloud invoices and CTO interview notes, and class every finding remediable or thesis-breaking, priced to fix.”
Tech-diligence-findings.docx“Turn the November migration status, budget burn and open risks into the December 4 SteerCo deck, with a full-sentence action title on every slide.”
SteerCo-2026-12.pptx
Inside the Technology Consulting mode
Executive storyline and decks
Turns draft findings into a SteerCo or committee deck built on a single governing message, with the point of every slide in its action title.
Proposals and RFP responses
Shreds the solicitation into a compliance matrix of every shall, Section L rule and Section M factor, then drafts the volume against it and flags the gaps.
Statement of work
The SOW, PWS or SOO sets out deliverables, acceptance criteria, exclusions and change control, with a QASP the buyer can measure against.
Project budget and cost forecast
Budget, commitments, actuals, a bottom-up estimate at completion and fee burn all sit in the monthly cost report, so the overrun surfaces in the numbers.
Tie-out and page-turn review
Tickmarks each figure in a draft report or banker book back to its support and lists every item that will not tie before the document is issued.
Business case and capital allocation
Builds the TCO, NPV and build-versus-buy comparison behind a capital request, with assumptions set out where the CFO can attack them.
Data migration and interface mapping
Produces source-to-target rows with transformation rules, effective dating and reconciliation, and a cutover plan that flags the point of no return.
Cyber risk assessment
Scores threat scenarios to an asset by likelihood and impact, ties each rating to evidence in the folder and produces the register the annual review needs.
Security controls and policies
Crosswalks controls across SOC 2, ISO 27001 Annex A, NIST CSF and 800-53, drafts the policies and POA&Ms, and flags every control with no evidence.
Regulatory and compliance analysis
Drafts the DPIA, breach notification memo or sanctions ownership review, cites the article or rule behind each conclusion and lists the open questions.
Technology due diligence
Assembles the buy-side findings on architecture, cloud cost trend, key-person risk and tech debt, and prices every fix or marks the item thesis-breaking.
Value creation and transformation
Sizes the cost levers, plans the integration or carve-out, drafts the 100-day plan and tracks benefit realization against the case the deal was priced on.
- Office skills
- Excel, Word, PowerPoint, PDF
- Tools
- Read, edit and write files, Search files, Run code, Search and read the web, View images
- Connectors
- SharePoint, Google Drive, Gmail, and additional custom connectors
- House style
- Your fonts, layouts and rules, on every file
How it works
- 1
Gather the engagement’s files
The folder takes the discovery notes and workshop transcripts, the RFP with its amendments, client exports of tables and field lists, and the ISMS evidence. Interview notes, the client’s templates and last month’s SteerCo deck round it out.
- 2
Ask for the deliverable
Brief it like a first-year with a hard deadline. It builds the workbook with live formulas, the memo or the deck, cites the file behind every figure and names what it could not reconcile instead of guessing.
- 3
Verify, then make the call
Read every control ID against the text of the standard, re-run the reconciliation against the extracts and attack the assumptions in the case. Nothing posts to Jira, SAP or the client’s repository, and the sign-off is yours.
Who it’s for
IT strategy, system implementation, data and AI, and cyber consultants who advise on technology and deliver it for commercial and government clients, from analyst to partner.
Questions
Will it make up control numbers or blend frameworks?
Any model can, which is why the skills make it name the file each statement came from and mark what it could not find rather than guess. The reviewer’s checks still apply, so confirm the control IDs against the standard itself, match the Annex A names to ISO 27001:2022 and keep SOC 2 separate from NIST CSF. Asked for a Statement of Applicability, one model fabricated 82 of the 87 control names. The crosswalk goes out only after a person has confirmed the rows against the framework.
Can we feed it client material covered by an NDA?
That call belongs to your firm’s compliance team, and the NDA or MSA decides it. Ultramarine Work changes files only in the project’s folder. When a request needs it, it can read files elsewhere on your computer, never passwords, keys or app data, and you can turn that off in settings. The model runs on Paper Instruments’ servers, so the content it works on is sent there to be processed. Paper Instruments is SOC 2 Type II, and our security and compliance details are on our compliance page.
Do clients make us disclose that we used AI?
Some do, and the requirement lives in the contract, not in the software. No FAR or DFARS clause forces disclosure for federal proposals, but solicitations increasingly ask for it, and the engagement letter, the client’s AI policy and the tender terms decide the rest, so read them before the work starts. The clauses separate tool bans, output bans, data bans and consent gates, each of which bites differently. The record that satisfies a client who asks names the tasks AI supported and the person who reviewed the deliverable.
Can it touch CUI on a CMMC engagement?
No, and treat that line as absolute. Ultramarine Work holds no FedRAMP authorization and no CMMC status, and our compliance page carries what we can support. Any content the model touches is processed on Paper Instruments’ servers, so whether a tool may see CUI is a question for your assessment boundary, your authorizing official and your assessor, not for the software. CUI stays inside your enclave, and the platform sees only the unclassified work, the crosswalks and the questionnaires.
Do our clients need a DPIA before we run their data through it?
Not always, because the decision on a DPIA rests with the client as controller and its DPO, not with the software. Workshop transcripts and customer exports carry personal data, and content it works on goes to Paper Instruments’ servers for processing, so their Article 30 record has to describe the tool. A DPIA becomes likely where AI counts as innovative technology combined with a high-risk criterion from the European guidelines. The DPO will want the data flow, retention and subprocessor terms on our compliance page.