Customers ask who owns security
Enterprise buyers, investors or auditors want a named security officer, and nobody on the team has the title or the time.
Managed ISSO / next-generation CISO
A named security officer on retainer.
Senior security and compliance leadership without a full-time hire. I own your program month to month, keep controls and evidence current, handle customer audits and security reviews, and report to your leadership and board.
When it fits
You need someone accountable for security, now.
You are certified and growing
The audit is done. Now come continuous monitoring, customer audits, a second framework and the next renewal.
A full-time CISO is not yet the right hire
You need senior judgment and board-ready reporting, sized to the stage you are at today.
Retainers
Two ways to engage, scoped to your stage.
Each retainer has a set number of hours each month and response times agreed in writing. Coverage is business hours; after-hours incident response can be arranged separately.
Your named security officer
For early-stage teams that need an owner for security, not weekly leadership.
- Named security officer for customers and auditors
- Monthly posture report
- Policy and risk register upkeep
- Security questionnaire and review support
- Quarterly roadmap refresh and a monthly working session
Your security and compliance program owner
For growing companies holding SOC 2 or ISO 27001 and adding frameworks or customers with their own audits.
- Everything in Essentials
- Continuous control and evidence oversight
- Customer audits and vendor risk reviews
- Biweekly sessions and a quarterly board report
- Annual incident response tabletop
Need ISSO support for FedRAMP, GovRAMP or NIST 800-53 continuous monitoring, or a more embedded cadence? Ask me and I'll scope it with you.
What makes it next-generation
Continuous, framework-agnostic and accountable.
01
Continuous compliance
Controls and evidence stay current every month, not only when the auditor is coming.
02
Framework-agnostic
One evidence set serves SOC 2, ISO, FedRAMP, NIST, Kantara and whatever you add next.
03
Board-ready reporting
Clear posture and risk reporting for leadership, without a manual reporting scramble.
04
Senior judgment where it counts
Routine work moves fast, so senior time goes to risk decisions, customers and your board.
Expert in the loop
Every decision has a qualified, named approver.
Routine monitoring, evidence collection and first drafts move quickly. I, or a vetted specialist, review and approve every finding, risk decision and deliverable before it reaches you. When an engagement calls for specific experience, I bring in vetted, qualified security professionals under the same standard.
Prepared
Monitoring, evidence and first drafts of reports, questionnaire answers and findings.
Reviewed
A qualified security professional checks the work and handles routine follow-up.
Approved
I, or a vetted specialist, sign off every risk call, finding and client-facing deliverable.
Accountable
The approver is named in the record. You always know who owns the decision.
Questions
Common questions
Do we need SOC 2 or ISO first?
No. If you are not yet certified, we can start with GRC Program as a Service to build the program and get through the audit, then move to the retainer to run it.
Does this replace our compliance platform?
No. I work with the platform you already use, or none. You keep ownership of your system of record and evidence.
Is this 24/7 coverage?
Retainers cover business hours with agreed response times. After-hours incident response can be arranged separately.
Can you work with an existing security team?
Yes. I can lead, or bolt onto your team and fill the gaps in compliance, audit and governance.