# Security and Infrastructure If you have not had a real security assessment in the last twelve months, you are guessing. --- ## What this is This is the credibility floor underneath everything else I do. Before I help you adopt AI or build software, I need to know what you are actually standing on: your networks, your identity and access, your cloud, your endpoints, your backups. A breach is not an IT problem. For a victim services organization it can put someone in danger. For a business holding client data it means lost trust, lost clients, and leadership explaining to a board what happened and why nobody caught it. I assess where your exposure actually sits, build defensible policy around it, and put technical controls in place that match how your organization really operates. Not a two-hundred-page report that sits on a shelf. A prioritized plan with real timelines and real numbers. --- ## What I assess - Network architecture and how traffic actually moves - Identity and access, who can reach what and whether they should Entra ID, Conditional Access, least-privilege review - Endpoint security and device management - Email security and threat defense Exchange Online, Safe Links and Safe Attachments - Backup and recovery, tested rather than assumed - Cloud configuration and where it drifts from best practice Microsoft 365 and Azure - What your AI tools can reach, which most assessments miss entirely --- ## How I work ### Assess against your reality The assessment is grounded in recognized security frameworks, then adapted to the size and operational reality of your organization. A ten-person nonprofit and a hundred-person brand do not get the same plan. In practice that grounding is the NIST Cybersecurity Framework and CIS Controls. ### Deliver a plan you can act on You get a prioritized remediation plan: what to fix now, what to address over the next ninety days, and what ongoing practices to establish. I can implement it directly or support your team through it. ### Keep it current Security changes as your organization changes. A point-in-time assessment is a start, not a strategy. For teams that need continuous oversight, I provide ongoing monitoring, policy maintenance, and regular posture reviews. --- ## Data integrity is a security problem too I was once hired to recover a database everyone else had written off. The corruption was as bad as anything I had seen in twenty-five years, and two major vendors had already told the organization the data was unrecoverable. I did not accept that. I extracted every record, verified completeness against the source rather than trusting the count, and proved that nothing had been left behind before anyone built anything on top of it. Security is not only keeping intruders out. It is making sure the data you depend on is intact, complete, and provably so. If you cannot prove your data is whole, you do not actually know that it is. --- ## Advo360 The clearest proof of this standard is Advo360, my production case management platform for victim services organizations. It runs single-tenant in each client's own cloud account, enforces multi-factor authentication for every user, and holds the most sensitive information a person can hand an organization. It was built by the same hands that recovered that failed database, to a standard that assumes the worst day and holds up anyway. If it works for survivors' most dangerous information, applying it to your infrastructure is the floor. --- ## FAQ ### How long does a security assessment take? Typically two to four weeks depending on the complexity of your environment. You get a prioritized plan at the end, not a vague list of concerns. ### Do you help with compliance requirements for grant-funded organizations? Yes. Assessments and remediation plans are structured to be referenceable in grant applications and compliance reporting. ### What happens after the assessment? You receive a prioritized plan with real timelines. I can implement it, or you can run it with your own team. You own the plan either way. ### Our setup was configured by someone who is no longer here. Can you fix it? Yes. That is one of the most common places this work starts. Environments that were set up quickly and never properly secured are exactly what an assessment is built to surface. --- ## The cost of an assessment is predictable. The cost of not doing one is not. [Start the conversation](/contact)