Southern Cyber Solutions
GRC readiness work for the Defense Industrial Base and commercial sector, from someone who has written the packages and answered the assessors. An independent practice launching after my December 2026 graduation. Early conversations welcome now.
Defense Industrial Base: CMMC and federal
CMMC Level 1 · Self-assessment package
Scoping, control mapping, SPRS submission support, and policy templates for Level 1 self-attestation.
CMMC Level 2 · Readiness and gap assessment
NIST 800-171 gap analysis, System Security Plan authoring, POA&M development, and a prioritized remediation roadmap.
CMMC Level 2 · Remediation and implementation
Hands-on hardening: Windows/Linux STIG implementation, MFA rollout, logging and SIEM tuning to close the gaps found.
Pre-audit · C3PAO mock assessment
Interview practice, evidence review, and control scoring before the real assessment team shows up.
Commercial: SaaS and enterprise
SOC 2 · Type I and II readiness
Gap-to-attestation: control design, continuous evidence collection via Drata or Vanta, and auditor liaison.
vCISO retainer
Executive security leadership without the executive salary: board reporting, vendor reviews, roadmap ownership.
Incident response · Playbooks and tabletops
NIST 800-61-aligned playbooks and facilitated tabletop exercises your team will actually remember.
AI · LLM red team assessment
Prompt-injection testing, adversarial fuzzing, and data-leakage analysis for teams shipping LLM features.
Why this practice
Cleared operator
Active TS/SCI and six years inside classified DoD environments, not a checklist consultancy.
Both sides of the audit
I’ve written the packages and answered the assessors. Zero-rework documentation is the standard.
Readiness, honestly
Readiness consulting only. Not an authorized C3PAO or assessor, and clients hear that upfront.
Built nights and weekends in Orlando, on the same coffee budget as the rest of this site