Most compliance consultants tell you what to fix. I fix it.
Ten years of security engineering, and a certification record to go with it. I don't hand you a findings list — I deploy the SSO, build the logging, write the Terraform, harden the pipeline, and then carry the audit. SOC 2 audit-ready in 90 days or I keep working free. ISO 27001 on an honest five-to-six month track.
Last ISMS I took through certification: zero nonconformities.
You can pass an audit without being secure. I'd rather you didn't.
Nobody wants SOC 2. What you want is the enterprise contract that went quiet after their security team asked for a report you don't have — and the three more behind it that will ask the same question.
The usual options are bad. A Big 4 firm quotes six figures and staffs it with consultants two years out of school. A compliance platform sells you software and leaves you to figure out what a control actually is. Meanwhile the deal ages out.
I do the work myself, at a fixed price, on a fixed calendar. You get one engineer who has taken an ISMS through certification and built a SOC 2 Type II program from nothing — not a bench of juniors and a project manager.
Advice is cheap. Implementation is the hard part.
There are dozens of good compliance consultants. Almost none of them can build what the framework requires.
The typical engagement
- Gap assessment delivered as a 40-item findings list
- Policy templates adapted to your company name
- Weekly calls to ask whether your team finished the remediation
- “You'll need to implement SSO” — and that's where it stops
- Your one overloaded IT person does the actual work
- Ex-auditors and ex-compliance managers, billing advisory hours
What I actually do
- Gap assessment, then I close the gaps myself
- Entra ID or Okta SSO deployed, OIDC and SAML, MFA and conditional access enforced
- Logging pipeline built, alerts tuned, retention set to satisfy the control
- Terraform and Ansible written, gold images hardened, configuration drift eliminated
- Access reviews, onboarding and offboarding automated so evidence generates itself
- Then I sit across from the auditor and defend it
Most small companies have one IT generalist and no security function. A findings list doesn't help them — there's nobody free to work it. That's the gap I was hired into at both of my last two clients.
Two tracks. Fixed price. Honest calendar.
SOC 2 and ISO 27001 do not take the same amount of time, and anyone telling you otherwise is selling something. Here's the real shape of each.
SOC 2 readiness
90 days to audit-ready
Type I can be examined immediately after readiness. Type II then runs an observation window — typically three to twelve months, depending on what your customers will accept.
From $30,000ISO 27001 certification
5–6 months to certification
The standard has structural floors nobody can compress: a Stage 1 documentation review, then a gap for operating evidence, then a Stage 2 implementation audit. Plus certification body scheduling.
From $45,000Both, run together
6–7 months
Roughly 60% of the control work overlaps. Building both at once costs far less than two separate engagements and adds about a month to the ISO timeline.
From $55,000Three phases, whichever track you're on.
Assess & scope
Full gap assessment against your target framework. System boundary defined and agreed. Every gap logged with an owner and a milestone date — no vague findings list.
Build & implement
Policy set written for how your team actually works. Controls implemented, not just documented. Compliance platform deployed and integrated. SSO, MFA, access reviews, onboarding and offboarding standardized.
Evidence & handoff
Evidence collection running on its own. Internal dry run against the real criteria. Auditor selected, engaged, and briefed. Your team knows how to answer what they'll be asked.
Audit-ready on the agreed date, or I keep working at no charge for up to 30 more days.
What "audit-ready" means: every control on the Readiness Criteria we sign at the end of Phase 1 is implemented, and its evidence is collected and available to your auditor. That document is a checklist with your name on it, agreed before any build work starts — so on the delivery date we are both reading the same list rather than arguing about a word.
The cap: 30 additional days for SOC 2, 45 for ISO 27001, at no charge. Past that we sit down and re-scope, and any further work is billed hourly at my standard rate. An open-ended promise would be one I couldn't keep, and you should be suspicious of anyone who makes one.
What it doesn't cover: certification body and auditor scheduling, the mandatory interval between ISO Stage 1 and Stage 2 audits, or scope changes you request mid-engagement. The guarantee also pauses if blocking questions go unanswered for more than three business days, or requested administrative access takes more than five — I can't hold a date I'm locked out of. Accredited auditor availability tightened in 2026; I'll book early, but I won't promise you someone else's calendar.
I don't just find vulnerabilities. I fix them.
Most vulnerability management engagements deliver a report — four thousand rows, a CVSS column, and a recommendation to “apply vendor patches.” Then the same two people who were already underwater are expected to work it.
I come with the scanner. I scan. I patch. I reconfigure the device. I write the Ansible playbook that stops it recurring, and I rescan to prove it closed. Reporting is a byproduct of the remediation, not the deliverable.
And then I stop. The managed phase exists to build the automation, not to sell you a seat forever. Once the recurring work runs itself you move onto the tool at a fraction of the monthly cost, and I step out.
Four tools you can use right now.
All of them run entirely in your browser. Nothing is uploaded, no account, no email, no analytics. Save the page to disk and it works offline — which is the point, because your scan data and control statuses have no business leaving your boundary to use a free tool.
Rev 4 → Rev 5 CCI carry-forward
The eMASS Rev 5 migration left controls at Non-Compliant because their CCIs came across unassessed. Load both exports and this matches them on CCI — stable across revisions — so the assessment work you already did carries forward.
Scan triage & POA&M aging
Drop in a CSV from any of six scanners. Get your remediation clock, real overdue counts, how many rows are actually the same finding, and the highest-leverage fixes. Add a second export and you get net change.
OSCAL POA&M validator
Check a plan of action against the model structure and the FedRAMP conventions people most often miss. Tells you what fails and why, in plain language.
Endpoint audit rollup
You asked fifteen people to run an audit script and got fifteen JSON files back. Drop them all in and get one compliance matrix, a list of exactly what failed where, and a CSV your auditor will accept.
These are a thin slice of the same engine behind the paid work. What they can't do is remember between visits or reconcile across scanners — which is most of what an engagement actually buys.
Compliance is the front door. It isn't the whole house.
These stand on their own — plenty of clients hire me for one and never touch the others.
Embedded Security Engineering
Your security engineering function on a fixed term, with an exit date agreed up front. I build it, automate it, then hand it over and leave.
From $6,500/month · 6–12 months See how it works →Cloud Engineering & Architecture
Secure AWS and Azure builds, infrastructure as code, network segmentation, backup and disaster recovery.
From $12,000 per project See how it works →Advisory Retainer
A fixed block of hours each month and a direct line, for the decisions you want a second opinion on before you are stuck with them. No project attached.
$2,400/month · 8 hours · six months See how it works →Two engagements, written up in detail.
A struggling ISMS, taken through a full 2022 transition
Inherited a 2013 ISMS with open issues. Closed surveillance with two minor nonconformities, then owned the complete transition to 27001:2022 — gap analysis, Annex A remap, Statement of Applicability, internal audit program.
Certified — 3 observations, zero nonconformities SOC 2 & cloud buildA 14-person SaaS company with no security function at all
Two Azure environments architected, seven applications consolidated onto Entra ID SSO, GitHub Enterprise hardened, and access reviews automated — then the SOC 2 program built on top of infrastructure that could actually satisfy it.
Security function built from zero in 4 months
An engineer first. Certified auditor's eye second.
I'm Frank Moore — U.S. Air Force veteran, CISSP, M.S. in Cybersecurity and Information Assurance, and ten years across federal and commercial security engineering. Terraform, Ansible, Python, AWS and Azure architecture, identity, logging, and automation that has cut real dollars and hours out of real environments.
I also spent two years auditing programs for the DoD Inspector General, which is why the compliance side isn't a stretch. But the building is the part I'm actually good at, and the part I like.
More about meWhat are you being asked to prove, and by when?
Tell me where things stand. I'll tell you plainly whether 90 days is realistic and what it would take.