Cybersecurity compliance for small defense suppliers.
Veteran-owned solo practice.
What I do
I offer two primary services.
CMMC Level 1 & Level 2 readiness
Working out which of your systems are actually in scope, assessing them against the 110 requirements of NIST SP 800-171, calculating and posting your Supplier Performance Risk System (SPRS) score, and writing the System Security Plan and Plan of Action and Milestones that go with it.
The assessment is good for three years, but someone at your company has to affirm every year that you still meet the requirements. I can stay on for that.
Pacific Northwest Cybersecurity is not a Certified Third-Party Assessment Organization (C3PAO) and does not issue CMMC certifications. These are readiness and advisory engagements.
Security program advisory
Fractional security leadership for companies with no one in that seat. Policy, a risk register you will actually maintain, control implementation guidance, vendor review, and incident response planning.
Who I am
A former Army Infantryman with a love of technology and thirteen years of experience building enterprise software. I spent seven of those years at a HIPAA-regulated healthcare clearinghouse which also provided clinic software, with the last five of those years as a Software Architect.
I implemented enterprise identity and access management there across new and legacy applications, with authentication enforced end to end, from the gateway through to individual APIs. I also designed controls for service account credential management and for the container registry and package repository, intended to gate known-compromised images and dependencies.
Get in touch
Send a note describing your situation and I will tell you if I am the right fit. The first conversation is free.