Consulting Services

A framework is a list of promises you make to a customer, a regulator or an auditor. We turn the list into controls that actually run, collect the evidence, and get you through the assessment the first time.

• CMMC. Gap assessment against NIST SP 800-171, your System Security Plan and POA&M, remediation, and the monitoring and documentation that keep you certified. The assessment itself is performed by a C3PAO; we make sure you pass it. See CMMC for manufacturers.
• SOC 2. Scope the Trust Services Criteria that matter to your customers, close the gaps, design controls your team will actually follow, and collect evidence so your CPA firm’s audit is uneventful. Type 1 first, Type 2 once the controls have run.
• ISO 27001. Build the information security management system: risk assessment, Statement of Applicability, policies, internal audit and management review, ready for the certification body.
• NEVI. Federally funded EV charging projects must meet the physical and cybersecurity requirements in 23 CFR 680. We write the security plan, segment and monitor the charging network, and document it for the state DOT.

We do not certify you ourselves, and we do not sell you a binder. We give you a program that survives the next audit too.