Cybersecurity Governance + Compliance
I help small and midsize organizations manage cybersecurity as a business function — bringing structure to risk, compliance, policies, controls, ownership, evidence, remediation, and leadership reporting.
Fractional leadership. Continuous compliance. Clear accountability.
The gap
Many organizations already have an IT provider, Microsoft 365, cloud systems, cyber insurance, software vendors, and security tools. What is often missing is someone looking across the entire cybersecurity program.
01What are our biggest risks?
02Which requirements apply to us?
03Who owns each control?
04What evidence proves it is happening?
05What needs to be fixed?
06What does leadership need to know?
That is where cybersecurity becomes a governance problem, not simply a technology problem.
What I help manage
Service 01
Cybersecurity direction without building a full-time security department.
I work with leadership, IT providers, vendors, and employees to create direction, establish ownership, track risk, coordinate remediation, and keep cybersecurity priorities moving.
Service 02
Turn requirements into something the organization can actually manage.
Cybersecurity compliance should not live in scattered spreadsheets, outdated policies, and a rush to collect evidence before an assessment.
From spreadsheets to a living program
Modern governance, risk, and compliance platforms can bring frameworks, controls, ownership, evidence, risks, findings, and remediation into one environment.
How it works
The goal is to create one view across cybersecurity priorities, requirements, responsibilities, evidence, gaps, and remediation.
I do not need to replace your IT provider. I help make sure the cybersecurity program around that technology is being governed and managed.
A practical structure
The NIST Cybersecurity Framework organizes cybersecurity risk into six connected functions that help leadership understand what the program must do.
Leadership, policy, responsibility, oversight, and risk strategy.
Understand systems, data, vendors, people, dependencies, and risk.
Determine whether appropriate safeguards are in place.
Understand how cybersecurity events are identified.
Establish roles, communication, escalation, and response processes.
Prepare to restore operations and improve resilience.
The fractional leadership role is not to perform every technical control. It is to make sure responsibilities are clear, requirements are understood, gaps are visible, and the right people are accountable for addressing them.
Where we start
Academic foundation
My recent University of Denver MSIT work examined how organizations can translate cybersecurity, AI-risk, and regulatory frameworks into documented controls, evidence, ownership, monitoring, and leadership accountability.
Applied thinking
Policies sitting in a folder do not create governance.
Controls without owners do not create accountability.
Requirements without evidence do not create readiness.
Dashboards without remediation do not reduce risk.
The work is connecting all of those pieces into one operating cybersecurity program.
Some cybersecurity needs require dedicated technical capabilities, including penetration testing, managed detection and response, digital forensics, advanced security engineering, and independent assessments.
My role is to help determine when those capabilities are needed, coordinate them with the broader cybersecurity program, and make sure findings turn into action.
As organizations introduce AI into business processes, questions around data, access, vendors, human oversight, policy, and accountability increasingly become part of the same governance conversation.
Governance questions
Owns cybersecurity as a business risk rather than a technical task: setting the program, mapping requirements to controls, assigning ownership, tracking evidence and remediation, coordinating IT providers and specialists, and reporting to leadership.
Often yes. An MSP manages the technology. Someone still has to decide what the organization must protect, which requirements apply, who owns each responsibility, and whether the program is actually working.
The structure around the technical work: policies, ownership, decision rights, risk acceptance, evidence, reporting, and the cadence that keeps all of it current.
Technical security configures firewalls, endpoints, identity, and monitoring. Governance decides what needs protecting, to what standard, who is accountable, and how leadership verifies it. Both are necessary; they are not the same job.
By keeping one current view: each control has an owner, a requirement it satisfies, evidence that it is operating, and a tracked remediation item when it is not.
It scales down well. Govern, Identify, Protect, Detect, Respond, and Recover give a small organization a common vocabulary and a way to prioritize without adopting an enterprise program it cannot sustain.
A practical first step
If cybersecurity responsibilities, compliance requirements, control ownership, or remediation are scattered across different people and vendors, start by creating one view of the program.
