Security leadership for healthcare practices and growing businesses that can't justify a full-time CISO.
I'm a fractional CISO. Most of my clients hold patient data. The rest hold something just as sensitive: customer records, payment flows, a deal on the line. None of them have someone whose job is security.
Every client on this page is below the size where a full-time CISO at $200,000 or more in base salary makes financial sense.
Start with the situation that sounds like yours.
Small healthcare practices
Your MSP keeps the systems running. No one is keeping the HIPAA risk analysis current.
Physician, dental, behavioral health and home health practices usually call me after a payer, a vendor breach or an OCR letter makes them look at security for the first time in years. I run the risk analysis, give you a short list of fixes your staff can handle, and stay on as your security lead if you need one.
HIPAA security for small practicesSmall and mid-size businesses
Real customers, real risk, and no one whose job is security.
I ran a company for nine years before I moved into security, so I talk about risk the way owners do: what it costs, what it could stop, and what to fix first. You get an assessment, a plan in plain English, and an experienced security leader to guide the work without adding a full-time executive.
Fractional CISO for small businessHealthcare & Healthtech Startups
A health system sent a security questionnaire, and the deal is waiting on it.
I sort out whether HIPAA applies to your product and whether you need SOC 2, HITRUST or both. Then I manage the questionnaire so your engineers keep shipping.
HIPAA, SOC 2 and HITRUST readinessManaged service providers
Your clients want risk assessments and policies you don't sell.
I handle the advisory work alongside your team. You keep the infrastructure and the client relationship. I don't sell managed services, so I'm never competing with you.
How I partner with MSPsCyber insurance readiness for SMBs and their brokers
The application asks about MFA, backups and incident response. The answers have to be true.
Businesses: I check the controls underwriters ask about and help you answer accurately before renewal. Brokers: send me the client who can't finish the application. I get them ready, and you keep the placement.
Cyber insurance readinessPrivate equity firms
The cyber risk you miss in diligence becomes your problem after close.
Pre-close diligence, a 100-day plan after close, and exit readiness before you sell. Reported the way your deal team works: exposure, cost to fix and timeline.
Cyber due diligence for PEof practices responding to an AMA survey lost revenue from unpaid claims after the 2024 Change Healthcare attack.
small and midsize businesses don't believe they're investing enough in cybersecurity.
of cyber insurance claims came from business email compromise and funds transfer fraud.
of private equity firms surveyed had absorbed cyber-related losses.
Your MSP runs your technology. Your leadership owns the risk.
Risk decisions belong to the business: the owner, the CEO, the board. Your MSP keeps the technology running. A fractional CISO gives leadership the information and plan to make those decisions well.
Every engagement starts with an assessment.
Thirty minutes, free. You tell me what's going on. I tell you what I'd look at first and whether I'm the right fit.
A risk analysis against your actual systems and data flows. You get a prioritized roadmap, not a 200-page PDF.
I can lead the fixes, or hand your team the plan. Both work. It depends on who you have.
Ongoing security leadership: policy, vendor oversight, board reporting and incident response planning. Retainers start at $5,000 per month.
Frequently asked questions
Do you only work with healthcare organizations?
No. Healthcare is where most of my work is and where my deepest knowledge sits. I also work with small and mid-size businesses, MSPs, insurance brokers and private equity firms across industries.
What is a fractional CISO?
A chief information security officer who works for your organization part time, on retainer, instead of as a full-time employee. You get executive-level security guidance, support with your board and auditors, and someone to lead the program, without a $200,000-plus salary line. Risk decisions stay with your leadership.
How much does it cost?
Retainers start at $5,000 per month. Project work, like a HIPAA risk assessment or SOC 2 readiness, is scoped and priced as a fixed engagement.
We already have an MSP. Why would we need you?
It's a different job. See Exhibit B. I work alongside MSPs regularly, and the good ones welcome it.
I'm an insurance broker. How do we work together?
You refer a client who needs help with a cyber application or renewal. I assess their controls, document the gaps and help them answer accurately. You keep the placement.