I build security and compliance programs that hold up to auditors, assessors, and customer security reviews.
I build security and compliance programs for regulated organizations and carry them to the point where an auditor, an assessor, or a customer's security review will accept them. SOC 2 readiness, a CMMC Level 2 program, a HIPAA risk assessment, ISO 27001 preparation, or a second opinion on a roadmap: that is the work I do every week.
I serve as a virtual CISO for organizations across defense manufacturing, healthcare, financial services, higher education, aviation, and federal contracting. Recent work includes a complete CMMC Level 2 program for a five-site defense manufacturer, a 217-control NIST SP 800-53 assessment for a federal contractor, and a two-year engagement that took a public manufacturer from program maturity 1.7 to 3.0.
My foundation is network and infrastructure engineering and the United States Army, where I led technology organizations through eight accreditations.
Book a session with your framework and deadline, and I will tell you plainly what it takes.
A working hour on your security or compliance program. Bring the framework you face (SOC 2, CMMC, HIPAA, ISO 27001, NIST CSF or PCI DSS), your deadline, and whatever you have today. You leave with a plain assessment of where you stand, the order to do things in, and what it will realistically take. Useful before you buy a GRC tool, hire a consultant, or answer a customer questionnaire.
Send one security or compliance question in writing, such as a control requirement, an auditor finding, a questionnaire answer, or a policy decision. I reply by video within three days with a direct answer and the reasoning behind it.