Industries
Three kinds of organizations, three different pressures.
The frameworks differ by industry. The goal does not: a security program you can explain, defend, and keep running.
Professional services firms
Tax preparers, accountants, bookkeepers, law firms, and others entrusted with sensitive client data.
What you're facing
- The FTC Safeguards Rule for tax and financial services firms
- IRS Publication 4557 expectations for tax professionals
- Breach notification duties under state law
- Cyber insurance applications asking about MFA, backups, and training
How we help
- Written Information Security Program (WISP) and risk assessment
- Qualified Individual support and annual reporting
- Incident response plan, vendor register, and retention schedule
- Microsoft 365 security and staff training
Growing businesses
Companies selling to larger customers who now expect proof of security.
What you're facing
- Customer security questionnaires and vendor reviews
- Customers asking which security framework you follow
- Cyber insurance renewals with stricter requirements
- No one internally who owns security
How we help
- A gap assessment and roadmap to get documented fast
- A program aligned to the NIST Cybersecurity Framework
- Fractional security leadership to own the program
- Answers to questionnaires drawn from real evidence
Contractors with CMMC requirements
Small businesses in the defense supply chain with CMMC requirements in their contracts.
What you're facing
- CMMC requirements appearing in new contracts and flow-downs
- FAR 52.204-21 and DFARS 252.204-7012 security clauses
- Primes asking for SPRS scores and evidence on short notice
- Deciding whether Microsoft GCC or GCC High is needed
How we help
- Scope your boundary to the data you actually handle
- Gap assessment and action plan for Level 1 or Level 2
- Policies, System Security Plan, and evidence organized for assessment
- Microsoft 365 configured and documented for CMMC
Know where you stand.
Book a no-pressure consultation. You leave with a clear picture of your risks and a sensible first step, whether or not we work together.