// Security Assessments

Understand Your Risks.
Know What to Do Next.

A security assessment should do more than identify gaps. It should show you where you stand, whether your controls are working, and what deserves your attention.

I bring firsthand experience leading security programs since 2006 to help turn the findings into practical decisions.

Schedule a ConversationSee the Five Phases
// The Process

Five Phases. Start to Finish.

Every assessment follows a structured approach to answer three important questions. The work is tailored to your organization, but the discipline behind it stays consistent.

What do you have in place?Does it work?What should you do next?
01

Frame

We agree on the objectives, scope, assessment criteria, and people I need to talk to. I send a focused evidence request so your team knows what to gather.

02

Discover

I interview the people responsible for your controls and review the evidence. I want to understand how things work in practice, not just what the policy says.

03

Reconcile

I compare what people tell me with what the evidence shows. Where they differ, I work through it with your team before deciding whether it is a finding.

04

Synthesize

I organize findings, evaluate their significance to your business, and identify underlying issues rather than presenting a long list of symptoms.

05

Deliver

You receive a written report, prioritized recommendations, and a leadership briefing. I explain the results and help clarify where to start.

Illustrative security assessment report with supporting analysis pages; sample artwork, not client data
// What You Get

Findings You Can Understand.
Recommendations You Can Act On.

A Written Report

An evidence-based assessment of your current security posture, including strengths, gaps, and risks that need attention.

A Prioritized Roadmap

Practical recommendations organized around business impact, urgency, and the realities of your environment.

An Executive Briefing

A walkthrough of the findings and decisions ahead, with time to discuss questions and next steps.

// Scope & Pricing

Clear Scope. Fixed Fee.

We agree on the scope, deliverables, and fee before work begins. If something outside that scope comes up, I document it and discuss any additional work and cost with you before proceeding.

// Assessment Options

Which Assessment Fits Your Needs?

Not every organization needs the same type of assessment. The right approach depends on what you need to understand and the decisions you need to make.

Baseline Assessment

Understand where you stand.

A current-state review using NIST CSF 2.0 to identify strengths, gaps, and priorities for improving your security program.

Framework Gap Assessment

Understand how you measure against requirements.

I evaluate your controls against agreed criteria, such as PCI DSS, NIST SP 800-171, or requirements associated with SOC 2, HIPAA, or GLBA. This is readiness and gap-assessment work, not a formal audit, certification, or attestation.

M&A Cybersecurity Due Diligence

Understand the risks behind a transaction.

A focused assessment of security risks in the context of the transaction, available evidence, and the decisions that need to be made on the deal timeline.

Explore M&A Due Diligence →
// Let's Talk

Let's Find Out Where You Stand.

Whether you need a security baseline, a framework gap assessment, or a focused review, let's discuss what you're trying to understand and what an effective assessment would look like.

Schedule a Conversation