Norman L.

Most organizations believe their governance, risk, and compliance programs are solid until a regulator, auditor, or breach reveals otherwise. After 20+ years in cybersecurity governance and 13+ years leading GRC programs at Fortune 500 companies, I've seen that gap firsthand. My work aims to bridge it. I'm Norman Levine, CISA, CDPSE, founder of Cyber Risk Partners LLC. I help organizations develop GRC programs that go beyond checkbox compliance: programs that protect operations, satisfy regulators, and generate measurable business value. I've managed over $24 billion in vendor portfolios, conducted more than 1,000 vendor risk assessments, and achieved GRC outcomes across healthcare, financial services, manufacturing, media, and PE-backed portfolios. ━━━━━━━━━━━━━━━━━━━━━━━━ WHAT I DELIVER ━━━━━━━━━━━━━━━━━━━━━━━━ GRC Program Design & Transformation: Comprehensive governance, risk, and compliance framework aligned with ISO 31000, NIST CSF, COBIT, and CIS Controls. Implemented RSA Archer and ServiceNow GRC/VRM, automated control evidence collection, developed KRI/KPI dashboards, and delivered executive risk reports. One project resulted in a 40% boost in audit performance after reorganizing the control evidence repository from scratch. Regulatory Compliance: Extensive hands-on experience across a wide compliance landscape, including GDPR, NIS2, DORA, HIPAA, CCPA, CPRA, SOX 404, PCI DSS, and emerging AI regulations. I led GDPR readiness at Stanley Black & Decker more than 18 months before enforcement, aligning $14B in global vendor contracts before competitors even started. I brief C-suite executives and federal regulators on residual risk posture and translate compliance obligations into business-oriented recommendations. Third-Party Risk Management (TPRM): Designed and led comprehensive vendor risk programs, including tiering methodology, inherent and residual risk scoring, SIG questionnaire optimization, continuous monitoring, and remediation governance, achieving 30% faster assessment cycles, 98% attestation completion, and 35% quicker remediation closure on large-scale projects. Audit Readiness: Support for SOC 1, SOC 2 Type I/II, and ISO 27001 certifications. I rebuild evidence repositories, close control gaps, and establish accountability frameworks that withstand external review. Also experienced in ISO 42001 (AI Management Systems) as organizations begin formalizing AI governance. Data Privacy Strategy: Implemented privacy-by-design, managed DPIA/PIA workflows, deployed OneTrust, and integrated cross-functional programs across Legal, Procurement, and Compliance. Reduced vendor onboarding timelines by 25–40% by removing duplicate privacy reviews. AI Governance & Shadow AI Risks: Enterprises experience an average of 223 shadow AI incidents per month, most of which go unnoticed. I assist boards and CISOs in developing ISO 42001-aligned AI governance frameworks that address the gap between AI adoption and oversight before regulators or attackers step in. M&A Due Diligence & Cyber Insurance: Conducting integration risk analysis, supporting contract negotiations, planning post-merger remediation, and developing cyber insurance readiness programs that have achieved 15–30% premium reductions. ━━━━━━━━━━━━━━━━━━━━━━━━ FRAMEWORKS & TOOLS ━━━━━━━━━━━━━━━━━━━━━━━━ GDPR · NIS2 · DORA · HIPAA · CCPA · CPRA · SOX 404 · PCI DSS ISO 27001 · ISO 31000 · ISO 42001 · SOC 1 · SOC 2 · NIST CSF · COBIT · CIS Controls RSA Archer · ServiceNow GRC/VRM · OneTrust · SIG Questionnaires Certifications: CISA (Certified Information Systems Auditor) · CDPSE (Certified Data Privacy Solutions Engineer) ━━━━━━━━━━━━━━━━━━━━━━━━ THOUGHT LEADERSHIP ━━━━━━━━━━━━━━━━━━━━━━━━ Author of The Future of Third-Party Risk Management & Data Privacy (Taylor & Francis, 2026). Contributor to HAKIN9 magazine and the GRC Report. Speaker at the Global Resilience Federation Conference. Cybersecurity Advisory Board Member at Pace University and Seton Hall University. vCISO for Money for Madagascar. ━━━━━━━━━━━━━━━━━━━━━━━━ LET'S WORK TOGETHER ━━━━━━━━━━━━━━━━━━━━━━━━ Available for remote contract work. Whether you need a GRC program built from scratch, regulatory compliance support for GDPR, DORA, or NIS2, audit readiness for SOC 2 or ISO 27001, or executive-level risk advisory, I have the frameworks, credentials, and communication skills to deliver results that stand up to scrutiny. If your organization is ready to go beyond checkbox compliance, let's have a conversation.