Support that doesn't disappear once the contract's signed.

For a small, cloud-native environment, yes — that's readiness, meaning controls implemented, evidence flowing, and your auditor engaged. Type I can be examined right after. For Type II the observation window runs after that, typically three to twelve months depending on what your customers will accept. If your environment is genuinely too complex for 90 days, I'll tell you on the first call rather than after you've signed.

Because ISO's audit structure has floors nobody can compress. Certification runs through two separate audits: Stage 1, where the certification body reviews whether your ISMS exists on paper — scope, risk assessment, Statement of Applicability, mandatory Clause 4–10 records. Then a required gap, because Stage 2 needs the ISMS to have actually been operating, typically at least three months. Then Stage 2, where the auditor samples evidence and interviews your people to test whether it works in practice. Internal audit and management review must both be complete before Stage 2, and neither is skippable. Published industry ranges run 6 to 12 months; 5 to 6 is what focused execution with an engaged sponsor produces.

Because they're measuring platform setup, not audit readiness. Fourteen days gets you integrations connected, policy templates generated, and a dashboard showing green. That's real and it's useful. It is not the same as having made your scoping decisions, implemented controls that didn't exist, run an internal audit, and had a human auditor agree. A dashboard at 100% means your integrations report compliant settings — it says nothing about whether your Statement of Applicability defends its exclusions. I use those platforms on every engagement. I just won't quote you their marketing timeline.

More than people expect, and not mainly because of training. Certification body audit duration is calculated from your effective headcount under ISO/IEC 27006 — more people mechanically means more auditor days. Larger organizations also carry more process areas, wider evidence sampling, and, most significantly, slower decisions: risk acceptance needs a signature, and a 15-person company decides in a meeting while a 300-person company routes it through a committee. Typical published ranges: 1–20 employees around three months, 21–200 five to eight months, 200+ eight months and up.

If we agree a scope and I don't have you audit-ready within 90 days, I keep working at no additional charge until you are. It covers the work I control. It doesn't cover delays caused by your team not providing access or decisions, or by scope changes you request mid-engagement — both of which are spelled out in the agreement so there's no argument later.

Yes, and that report is usually a symptom rather than the problem. Huge unvalidated finding counts almost always mean the scans ran uncredentialed — the scanner is guessing from banners instead of authenticating and checking. Fixing that requires an asset inventory and standardized credentialed access across every asset class, including network devices. That's the foundation phase, and it comes before managed scanning means anything. After it, finding counts drop sharply and the ones left are real.

Not the way that's usually meant. I won't tune a scanner to hide findings, mark things false-positive without validating them, or configure systems to evade detection. Those all make the report look better while leaving you exactly as exposed, and they tend to surface later at the worst possible moment. What I will do is fix the underlying issues fast, and document defensible compensating controls where something genuinely can't be patched — which is common with medical devices, OT equipment, and vendor-locked appliances. That passes scrutiny and is also true.

No, and that's deliberate. I manage logging, alerting, and vulnerability triage, and make sure the right people know when something needs attention. Your team or an MSSP you already use keeps ownership of active incident response. If you genuinely need a 24/7 SOC, I'll tell you and point you at someone good.

SOC 2 (Type I and II), ISO 27001:2022, ISO 20000-1, CMMC, NIST 800-171, and NIST 800-53 / RMF. I've worked on both sides — as a DoD Inspector General auditor and as the person building programs and sitting across from certification bodies. I've also run 27001 and 20000-1 as an integrated management system, which very few consultants in this market have done.

AWS and Azure, both hands-on and in production. I don't claim depth in GCP that I don't have — if that's your primary platform, say so on the first call and we'll be honest about fit.

The opposite. Most of my work is with teams between 10 and 200 people who need the outcome but can't justify a full-time security hire.

Implement. That's the main thing separating me from most of this market. I deploy the SSO, build the logging pipeline, write the Terraform and Ansible, harden the repositories, and automate the access reviews. Advisory-only engagements — where I write the documentation and your team does the work — are usually a bad fit, because the companies that need this most have one overloaded IT person and nobody free to work a findings list.

It ends on purpose. Every embedded engagement defines its exit up front: the work gets automated to the point where there's nothing recurring left, or it transfers to a security engineer you hire (I'll help write the req and screen candidates), or it transfers to your existing team with runbooks and training. You get a handover package either way — documentation, architecture diagrams, automation source, and credential transfer. My goal is to make myself unnecessary, not indispensable.

The incentive problem is real and I'd rather name it than pretend it doesn't exist. My answer is a fixed term with written exit criteria, and a handover package that ships whether you renew or not. If the work is genuinely done, I'd rather you refer me to someone else than keep paying me to maintain something that maintains itself.

I do. JF Analytics is one senior engineer — hands on the keyboard, not coordinating from a slide deck. The person on the sales call is the person in your environment. No bench, no handoff to someone junior.

Book a 30-minute call, or fill out the intake form with detail about your environment. Either works — the form just means the call starts further along.