Senior guidance for high-stakes compliance.

We help you set a governance, risk, and compliance direction that fits your business, your regulators, and your customers. That means deciding which frameworks matter, who owns what, and how risk decisions get made and recorded.

For financial-services and publicly listed organizations, this often includes aligning IT general controls with SOX, or with J-SOX for operations under Japanese requirements. The goal is a governance model your leadership can explain and your teams can operate.

We run structured risk assessments based on recognized methods such as NIST SP 800-30 and ISO/IEC 27005. The output is a prioritized view of risk with clear owners and treatment options that leadership can act on.

We can also help set up an ongoing risk management process, including a risk register, review cadence, and reporting, so the assessment stays current after the engagement ends. Where the NIST Risk Management Framework (SP 800-37) applies, we help structure the work around it. For financial-services and listed organizations, this work can include IT control reviews under SOX and J-SOX, and operational-risk questions raised by DORA and NIS2.

We design and build compliance programs that meet several requirements from one set of controls. Policies, procedures, control ownership, and evidence collection are mapped once and reused across frameworks.

Typical programs cover combinations of ISO/IEC 27001, NIST CSF 2.0, NIST SP 800-53, SOC 2, PCI DSS, HIPAA, and SOX IT controls. For life sciences and regulated manufacturing, we can support electronic records and signatures controls under FDA 21 C.F.R. Part 11. EU obligations such as NIS2 and DORA can be included where they apply.

We help you prepare for external audits and assessments. We find gaps, organize evidence, coach control owners, and help manage the process with your auditor or assessor.

You arrive at the audit organized and confident. We work alongside the auditor, assessor, or certification body you choose, so their fieldwork runs smoothly.

We help you build privacy programs that match your actual data flows. Where they apply, this covers GDPR, CCPA/CPRA, and China's PIPL.

Work can include data inventories and mapping, records of processing, privacy impact assessments, cross-border transfer analysis, data subject request processes, and privacy notices for legal review. For organizations handling sensitive U.S. personal data or government-related data, we also support readiness under the U.S. DOJ Data Security Rule (28 C.F.R. Part 202).

We help leaders set security strategy, build a realistic roadmap, and report progress in terms the business understands. The work is grounded in NIST CSF 2.0 and adapted to your size and risk profile.

Deliverables can include a current-state assessment, target-state profile, multi-year roadmap, governance structure, and board or executive reporting. For EU-regulated entities, we align governance and reporting duties with NIS2 and, in financial services, DORA.

We write and update the security policies, standards, and procedures your program depends on, and the incident response (IR) plan your teams follow when something goes wrong. Each document is written for the people who use it, with clear owners and a review cycle.

IR plans are tested through tabletop exercises with the people who would carry them out, and each exercise ends with a short, prioritized list of improvements. Business continuity and disaster recovery planning is covered under Business Continuity & Resilience.

We provide senior security leadership on a monthly retainer. You get an experienced security lead to run governance, guide priorities, support audits and customer reviews, and report to leadership, at a fraction of the commitment of a full-time hire.

A fractional engagement can also provide continuity while you recruit a permanent security leader, or support an existing leader who needs added capacity. Scope and hours are agreed up front and reviewed regularly.

We help you plan how your organization communicates its security and compliance posture to customers and prospects. This includes what to publish, what to share under NDA, who owns each item, and how it stays current.

We design the program, its content, and its governance, and it runs on whatever channel you choose. The result is a posture story your sales team can share with confidence.

We run practical training for security, compliance, and leadership teams. This includes framework walkthroughs, audit-readiness workshops, control owner training, and executive briefings, built around the standards your program actually uses.

For individuals building GRC careers and skills, our academy offers practitioner-led GRC education. Visit Field-Tested GRC (opens in a new tab)

We advise existing CISOs and security leaders on program direction, priorities, and how to work with executives and the board. It gives the person already in the role a trusted, experienced sounding board.

We advise CEOs, boards, and other executives on cyber risk decisions. The work focuses on tradeoffs, accountability, and what leadership needs to know in order to act.

We provide a part-time CISO who owns the security program and reports to leadership or the board. This is an accountable operating role, with agreed authority over priorities, governance, and how the program is run day to day.

We provide part-time technology leadership focused on governance, architecture decisions, IT risk, and vendor or technology choices. The focus is sound technology decisions that support the business and its risk posture.

We advise technology and business leaders on IT governance, architecture decisions, IT risk, and vendor or technology choices. The aim is clear recommendations that fit your existing environment.

We support ongoing compliance operations after a program is in place. That includes control monitoring, evidence collection and upkeep, and tracking regulatory changes so the program stays current.