Security reviews and questionnaires
Accurate, consistent answers to questionnaires, RFP security sections and buyer reviews, plus a reusable answer library.
All services
Security and compliance, from first deal to mature program.
Each service starts with the problem in front of you today and ends with something you can show a customer, an auditor or your board. Engagements can stand alone or bolt onto your existing program.
Go-to-market enablement
Turn security into a reason to buy.
Security and compliance work aimed at the deals in your pipeline.
Trust documentation
A security overview, policy summaries and trust-page content your sales team can share with confidence.
Certification roadmap
Which certifications your target buyers require, in what order, and on what timeline, tied to your pipeline.
Sales enablement
Briefings that help sales and customer teams handle security conversations and know when to bring in an expert.
Enterprise and federal market entry
What it takes to sell into regulated enterprises and the public sector, and how to get there.
Customer audit response
Evidence packages and support when enterprise customers send their own audits and assessments.
Managed ISSO / next-generation CISO
A named security officer on retainer.
Continuous compliance, customer audits, security reviews and board reporting, with me or a vetted specialist approving every decision that reaches you.
GRC Program as a Service · Managed
Your GRC program, run for you.
- Risk register and assessments
- Policies and standards
- Compliance documentation: SSPs, policies, procedures
- Control mapping and evidence collection
- Vendor and third-party risk
- Audit management and auditor liaison
- Internal audits
- Metrics and board reporting
- Regulatory change and impact tracking
Security Program as a Service · Managed
Your security program, led and kept on schedule.
- Security strategy and roadmap
- Vulnerability management oversight
- Access reviews and IAM governance
- Incident response planning and tabletops
- Security awareness
- Secure SDLC and cloud security baselines
- Business continuity and disaster recovery
Compliance modernization
From spreadsheets to compliance as code.
For established businesses: move off spreadsheets, screenshots and manual evidence to policy as code, automated control checks, continuous evidence and audit-ready pipelines in your own cloud and CI tools. Fewer manual hours, continuous assurance, faster audits.
Assess and audit
Find the gaps before anyone else does.
Readiness gap assessment
Requirement-by-requirement gap report, evidence map and a remediation plan ranked by risk.
Internal audit and control testing
Design and operating-effectiveness testing, evidence review and findings tracked to closure.
Audit readiness and audit support
Evidence packages, auditor selection support and fieldwork coordination through the report.
Impact assessments
Know what changes before you ship or sign.
Products and features
Whether a new product, feature or capability changes your obligations, what controls and evidence to add, and whether a significant-change filing is needed.
New technology
The security and compliance impact of adopting new infrastructure, vendors, AI capabilities or architectures.
Regulations and new markets
An obligations register and gap analysis when a new regulation applies or you enter a new market. I work alongside your counsel; this is not legal advice.
Programs and systems of record
Build it once, so it scales.
Compliance program build
A common control framework mapped across your obligations, with an audit calendar, runbook and metrics.
Security program build
Policies, standards, risk management and governance sized to your company, from day one or on top of what exists.
System of record
One place, owned by you, for controls, risks, policies, evidence and audits, in the tool of your choice.
Risk and policy program
Enterprise risk process, risk register, policy library, risk acceptance and board reporting.
AI governance
Governance, risk and control practices for AI systems, aligned to ISO/IEC 42001 and the NIST AI Risk Management Framework.
Privacy program
Privacy controls, data inventories and processes that support your privacy obligations, alongside your counsel.
Fractional leadership
Senior leadership, sized to your stage.
Fractional CISO
Security strategy, roadmap and budget, board reporting and customer trust conversations, without a full-time hire. Offered through the managed retainer.
Fractional ISSO
Information system security officer support, including continuous monitoring, POA&M management and significant-change requests for FedRAMP, GovRAMP and NIST 800-53 systems.
Identity assurance
A specialty in digital identity.
NIST SP 800-63 Rev 4 and Kantara readiness
Criteria-by-criteria readiness at your target IAL, AAL and FAL, a remediation plan and dry runs before your assessment.
Account recovery threat assessment
Review of recovery and reset flows, impersonation tabletops and prioritized fixes for support teams.
Non-human and AI agent identity
Inventory of machine and agent identities, least-privilege review and a governance model for who approved what.
Frameworks
Framework-agnostic by design.
One control map and one evidence set, reused across every framework you hold or add.
- SOC 2
- ISO/IEC 27001
- ISO/IEC 42001
- FedRAMP
- GovRAMP
- NIST 800-53
- NIST CSF
- NIST 800-171
- NIST 800-63
- Kantara
- HIPAA
- PCI DSS
- Privacy
- AI governance
I provide readiness, gap assessment, internal audit and audit support. I do not issue SOC 2 reports, ISO certificates, FedRAMP authorizations or Kantara certifications.
Not sure where to start?
Tell me the deal, audit or deadline in front of you, and I'll suggest the smallest engagement that solves it.