GRC and audit readiness
CMMC, SOC 2, ISO 27001, NIST 800-53 and 800-171, from someone who has written the packages and answered the assessors. Start with a free 15-minute call. Project work is scoped on that call and quoted in writing.
Start here
Three ways to book me
Over Google Meet. Paid sessions take a card when you book, through Stripe. Anything larger than a session is quoted in writing after the first call.
Quick chat
Tell me what you are being assessed on and when. I tell you what it will take. No agenda required.
Cyber or GRC consult
One problem, thirty minutes: a control you cannot map, an SSP section, an auditor request you do not understand, a scope question before you sign a contract.
IT support or working session
Hands-on help with a system, a network, or a laptop that stopped cooperating, or an hour of working time on a security or compliance project.
The niche
Audit and GRC readiness
CMMC Level 1 · Self-assessment package
Scoping, control mapping, SPRS submission support, and the policy set for Level 1 self-attestation.
CMMC Level 2 · Gap assessment and SSP
NIST 800-171 gap analysis, System Security Plan authoring, POA&M development, and a remediation roadmap ordered by dependency.
Mock assessment · Before the C3PAO
Interview practice, evidence review, and control scoring before the real assessment team shows up.
SOC 2 · Type I and II readiness
Control design, evidence collection in Drata or Vanta, and auditor liaison from gap to attestation.
ISO 27001 readiness
Scope, risk assessment, Statement of Applicability, and an internal audit before the certification body does theirs.
Internal audit and control testing
Sample-based testing against the framework you name. Every exception comes back as a finding: condition, criteria, cause, effect, recommendation.
Policies and procedures
Policies written against the control they satisfy, with the procedure that proves it, so the document and the evidence match.
POA&M and remediation tracking
Every open item with an owner, a date, and the evidence that closes it.
Beyond the audit
Also on the menu
vCISO retainer
Executive security leadership without the executive salary: board reporting, vendor reviews, roadmap ownership.
Incident response · Playbooks and tabletops
NIST 800-61 aligned playbooks and facilitated tabletop exercises your team will remember.
AI · LLM red team assessment
Prompt injection testing, adversarial evaluation, and data leakage analysis for teams shipping LLM features.
Cyber or IT consultation
A second opinion before you buy a tool, a security question about a vendor, or a network that needs looking at. Book the consult or the working session above.
Process
How an engagement works
Free call
Fifteen minutes. What you are being assessed on, by when, and what exists today.
Scope and quote
A written scope, a price, and dates before any work starts.
Gap assessment
Control by control against the framework, with an evidence request for each one. A questionnaire is not an assessment.
Findings and roadmap
Each gap written as a finding with the evidence walked, then a roadmap ordered by dependency with an owner and a date per item.
Pre-audit check
Evidence review and interview practice before the assessor arrives, and auditor liaison during, if you want me in the room.
What steps 03 and 04 look like on paper: sample deliverables.
Why me
Cleared
Active TS/SCI and six years of federal and DoD compliance work, not a checklist consultancy.
Both sides of the audit
I have written the packages and answered the assessors. Zero-rework documentation is the standard.
Readiness, honestly
Readiness consulting only. Not an authorized C3PAO or assessor, and clients hear that upfront.
On record
Within two weeks I was on track to be GRC manager at a 300+ person cybersecurity company.
Free
Start before the call
CMMC checklist
Score 64 items Met, Partial, or Not met and get a readiness read. Your answers stay in your browser.
Map That Control
Fourteen scenarios, one NIST 800-53 base control each. A fast read on how your team thinks about controls.
Is it a finding?
Five questions in the order an assessor asks them, and a finding template in the right shape at the end.
Questions I get
Do you perform the audit?
No. SOC 2 reports come from CPA firms, CMMC Level 2 certification from a C3PAO, ISO 27001 certification from an accredited body. I get you ready, and I can sit beside you while it happens.
Remote or in person?
Remote over Google Meet by default. In person in downtown Orlando by arrangement.
What does it cost?
The three sessions at the top are priced on this page. Anything larger is quoted in writing after the free call, and nothing starts before you have the quote.
Can we talk about cleared work?
Clearance-sensitive specifics go over encrypted email, not the booking form.
Built nights and weekends in Orlando, on the same coffee budget as the rest of this site