Assessment, testing, and security leadership, sized for your business.
Every engagement follows the Brookmore Method™: discover, design, build, validate, sustain. Pricing is fixed or monthly, agreed before we start.
Gap Assessment
A clear picture of where your security program stands today, measured against the NIST Cybersecurity Framework, with every gap ranked so you know what to fix first.
Who it's for
Organizations answering a first customer security questionnaire, renewing cyber insurance, or that simply don't know where they stand.
What you get
- Review of your people, processes, and technology
- Gap register ranked by risk and effort
- 90-day roadmap in 30-day sprints
- Executive summary in plain language
- Two-hour strategy session with your leadership
Risk Analysis
Not every gap carries the same weight. We identify what your business can't afford to lose, the threats most likely to reach it, and what that would cost you, so spending follows real risk.
Who it's for
Leadership teams deciding where to invest in security, and firms that need a documented risk assessment for regulators, insurers, or customers.
What you get
- Inventory of critical assets, data, and systems
- Threat and vulnerability review for each
- Likelihood and impact scoring
- Risk register with owners
- Treatment plan: fix, transfer, accept, or avoid
NIST Frameworks
We align your security program to the NIST framework that fits your business: the NIST Cybersecurity Framework (CSF 2.0) for most organizations, and NIST SP 800-171 when you handle controlled information for customers or contracts.
Who it's for
Organizations that want a recognized structure for their program, or whose customers and contracts point to NIST.
What you get
- Current and target profile
- Control-by-control mapping to your environment
- Policies and procedures written to the framework
- Prioritized plan to close the gaps
- Documentation you can hand to a customer or assessor
CMMC Readiness
Readiness for CMMC Level 1 and Level 2: we confirm what data you handle and which level applies, measure your gaps, and help you build the policies, configurations, and evidence an assessment requires.
Who it's for
Defense contractors and subcontractors with CMMC requirements in current or upcoming contracts.
What you get
- Scoping of the people, systems, and data in your assessment
- Gap assessment against every requirement in your level
- Policies, procedures, and System Security Plan
- Prioritized action plan with owners and dates
- Evidence organized for self-assessment, C3PAO assessment, and annual affirmation
Microsoft 365 Migration & Security
Move to a Microsoft 365 tenant you fully control, whether you're leaving a reseller-managed account (such as GoDaddy), Google Workspace, or another provider, or planning a move to Microsoft GCC. Then get full value from the licenses you already pay for.
Who it's for
Small businesses on Microsoft 365 or moving to it, including companies preparing their tenant for CMMC.
What you get
- Tenant review and migration plan
- Multi-factor authentication for every account
- Conditional Access policies
- Intune device management and encryption
- Email protection (SPF, DKIM, DMARC) and audit logging
- Configuration documentation you can show an assessor
Vulnerability & Penetration Testing
Find weaknesses before someone else does. Every test is scoped in writing and performed only with signed authorization from the owner of the systems tested.
Who it's for
Organizations that need an outside view of their exposure, evidence for an audit or insurer, or a check after major changes.
What you get
- External exposure review of your internet-facing systems
- Internal vulnerability scanning and configuration benchmarking
- Penetration testing under signed rules of engagement
- Findings prioritized by known exploitation, not just severity
- Executive risk summary and remediation guidance
- Retest of fixed findings
Security Programs & Policies
The written program, plans, and training that regulations and insurers expect, sized for a small firm.
Who it's for
Tax, accounting, legal, and other professional services firms, including those covered by the FTC Safeguards Rule and IRS Publication 4557.
What you get
- Written Information Security Program (WISP)
- Risk assessment
- Incident response plan and contact tree
- Vendor risk register and records retention schedule
- Security awareness training with completion records
vCISO
Senior security leadership on a fractional basis. We own your security roadmap, write and maintain your policies, make risk decisions with you, and report progress to leadership in business terms.
Who it's for
Organizations that need a security leader but not a full-time executive, and teams whose customers, insurers, or contracts now expect a documented security program.
What you get
- Security posture baseline and risk register
- 12-month security roadmap tied to your budget
- Policies written and maintained for how you operate
- Incident response plan and a yearly tabletop exercise
- Monthly status reports and quarterly leadership briefings
- Support with customer questionnaires and cyber insurance applications
Not sure which service fits?
Tell us what prompted the search. We will point you to the smallest step that solves it.