For buyers
Fractional CISO (fCISO)
Learn more
C2C
GRC engineering / C2C
Specialist GRC work under your contract, turning the framework into controls your client’s engineers can build.
Who it’s for
Consulting firms, MSPs, and primes that hold the contract and need GRC engineering on the task. You keep the client. We do the specialist work under your paper.
We work corp-to-corp under a task order that names the deliverable up front. Usually that’s NIST SP 800-171 work, though a task order can also cover a PCI DSS or HIPAA Security Rule gap assessment.
Depending on the order, that means gap support, writing the SSP and POA&M, or engineering: control baselines your client’s pipelines can enforce, and evidence someone else can check. Nicholas has spent more than a decade turning PCI DSS, HIPAA, ISO/IEC 27001, and NIST requirements into technical controls on AWS, Azure, and GCP.
Deliverables
- A task order that names the deliverable, the framework, and the boundary.
- Gap support, SSP or POA&M work, or a control-as-code baseline, as the order says.
- Evidence notes your client-facing team can stand behind.
- A direct line to Nicholas, who does the work. Vetted specialists join only when the engagement needs them.
Timeline
Set by the task order. If the contract deadline isn’t realistic, we’ll tell you before we sign.
Related
Next step
Start with a 30-minute call.
Tell us what you’re working on and when it’s due, and we’ll tell you the first two steps.
30-minute intro call on Google Meet