I run focused security assessments, each measured against the NIST guidance written for it.
I run focused security assessments. Each one takes the area that carries your highest risk, such as AI, patching, incident response or vendors, and measures it against the NIST guidance written for it.
Every requirement is scored on what is written down, what actually happens and what you could prove tomorrow. You get a scored report, a gap register and a remediation plan in order.
I serve as a virtual CISO in defense manufacturing, healthcare, financial services, higher education, aviation and federal contracting. Recent work includes a five-site CMMC Level 2 program, a 217-control NIST SP 800-53 assessment and a two-year program that moved a public manufacturer from maturity 1.7 to 3.0. My foundation is network engineering and the U.S. Army, where I led eight accreditations.
My listed prices are for organizations of up to 100 people. Larger organizations start with the free 30-minute scoping call, and I quote a fixed scope and price from there.
A free 30-minute call for organizations of more than 100 people, or for anyone who needs a rapid or comprehensive assessment rather than a standard package. We cover the area you want assessed, the people, sites and systems in scope, and any deadline such as an audit or renewal. Afterwards you get a written scope, timeline and fixed price. Nothing is sold on the call.
A working hour on your security or compliance program. Bring the framework you face (SOC 2, CMMC, HIPAA, ISO 27001, NIST CSF or PCI DSS), your deadline, and whatever you have today. You leave with a plain assessment of where you stand, the order to do things in, and what it will realistically take. Useful before you buy a GRC tool, hire a consultant, or answer a customer questionnaire.
Remote, fixed-scope assessment against NIST SP 800-40: about 16 working hours over 10 days. Covers asset coverage, scanning, risk-based prioritization, patch windows and remediation timelines. Includes a kickoff, two interviews, a readout and a full document review. You get a report scored on policy, practice and evidence, a gap register and a remediation plan in order. Priced for organizations of up to 100 people. Larger, or need a rapid or full review? Book the free scoping call.