Sam D.

I help small and midsize organizations across the U.S. meet security and compliance requirements, win and keep contracts, and adopt AI safely, without the cost of a full-time security team. Most clients come to me for one of three reasons. A prime contractor is asking about CMMC. A customer sent a security questionnaire nobody can answer. Or a scan came back with hundreds of findings and no one knows what to fix first. WHAT I DO: CMMC and DFARS readiness. I take defense contractors through Level 1 self-assessment and Level 2 preparation, from gap analysis to System Security Plan and POA&M development to the evidence an assessor will actually ask for. Level 1 covers the 15 requirements at 48 CFR 52.204-21. Level 2 covers the 110 controls in NIST SP 800-171. vCISO and retained advisory. Executive-level security direction on a monthly basis, for organizations that need someone accountable for the program but cannot justify a full-time hire. Risk assessments. I assess against NIST SP 800-53, NIST SP 800-171, or the HIPAA Security Rule, depending on what applies to you, and then turn the findings into a remediation plan ordered by risk and effort, not by scanner severity. HIPAA Security Risk Analysis. The analysis required at 45 CFR 164.308(a)(1)(ii)(A), documented the way OCR expects to see it. Vendor and third party risk. Assessment of your suppliers, plus completion of SIG, CAIQ, and custom security questionnaires when your own customers send them to you. Vulnerability management. Nessus and Qualys report review, false positive triage, prioritization, and a program that moves you from scanning to verified remediation. Policies and procedures. Written policy sets mapped to the framework you are held to, in language your staff will follow. Incident response. Tabletop exercises and response plan development aligned to NIST SP 800-61. Security awareness training. On-site or remote, built around what your people actually click on. Written Information Security Programs for tax preparers and CPA firms. The written program required by the FTC Safeguards Rule at 16 CFR 314.4, covering all nine required elements, in the form the IRS expects to see attached to a PTIN renewal. Website and email threat analysis. External security review of your public-facing site, and forensic analysis of suspicious messages your staff has flagged. AI adoption. Practical training on secure AI use and custom tools built for your workflows, with attention to where your data goes. WHO I WORK WITH: Defense contractors and subcontractors handling FCI or CUI. Healthcare covered entities and business associates. Banks, credit unions, and other financial institutions. CPA firms, enrolled agents, and tax preparers. Manufacturers, professional services firms, and any small business being asked security questions by a larger customer. FRAMEWORKS I WORK IN: NIST SP 800-53, NIST SP 800-171, CMMC, HIPAA, ISO 27001, SOC 2, FISMA, SOX, PCI-DSS, GDPR, and the FTC Safeguards Rule. HOW I WORK: You work with me directly. There is no junior consultant running the assessment and no account manager between us. I do not use scare tactics. If something is low risk, I will tell you it is low risk. Every engagement has a defined scope and a fixed price. No long-term contracts unless a retainer is what you want. I write deliverables you can hand to an assessor, an auditor, a prime, or your insurance carrier without translation. CREDENTIALS: CISM. CMMC Registered Practitioner Advanced. Master's in Cybersecurity. Send me a message with where you stand and what is being asked of you. I will tell you what the work involves before you commit to anything.