Most security failures at established companies are not sophisticated. A former employee still has access. A laptop was never managed. A backup has never been restored. One flat network connects the front desk to the server. These are operating problems, and they are fixed by building security into the way the company runs.
I do not issue certifications, and no consultant can make you compliant with a document. What I do is prepare the company: build the controls, put them into daily practice, and leave you with the evidence an assessor, a customer or an insurer will ask to see. My first IT job came after a company caught me inside its servers and hired me to secure them.
What you get
- A gap assessment against the framework that applies to you, such as HIPAA, NIST 800-171 or CMMC.
- Identity and access control: single sign-on, multi-factor authentication, least privilege, and offboarding that removes access the same day.
- Managed, encrypted devices with security policy enforced centrally.
- A segmented network with proper firewalling between what must be kept apart.
- Backups with a tested restore, and a written recovery plan.
- An incident response plan your team has walked through before it is needed.
- Policies and documentation that match what actually happens.
How the engagement runs
- Assess. I review accounts, devices, network, data, vendors and existing policies against the requirement you face.
- Prioritize. You receive a written plan that separates what is urgent from what is merely recommended.
- Build. I implement the controls or direct your IT provider to, and verify the result.
- Document and rehearse. Policies are written to match practice, and the team walks through an incident and a restore.
- Maintain. Periodic reviews keep the controls and the evidence current.
Proof
At SottoPelle Therapy, a multi-state healthcare practice, I found ten offices on separate workgroup networks with infected PCs and nothing centrally managed. I moved every location onto one managed Windows domain behind Cisco ASA firewalls and placed the core infrastructure in a data center, leaving a secure, centrally run operation.
At Epic Golf Club, the platform has role-based access control and full audit logging, the property network is segmented into VLANs, and staff laptops are Entra-joined and managed through Intune.
Frequently asked questions
Can you make us HIPAA or CMMC compliant?
I can prepare you: close the gaps, build the controls and assemble the evidence. Compliance itself is determined by the regulator or an authorized assessor, not by a consultant.
We are a government contractor. Where do we start?
With an honest assessment against NIST 800-171 and a plan for the gaps. A Fractional CTO for Government Contractors covers the CMMC landscape and what to do now.
What is the most common weakness you find?
Accounts and information that nobody is managing. Your Employee Data Is Someone Else's Attack Plan explains how attackers use it.
Do you replace our IT provider?
Not necessarily. I often set the standard and direct the existing provider to meet it. If nobody owns IT at all, see the fractional CIO service.