What we do
Your customers are asking hard questions about security. We help you answer them.
InfoSec Guidance works with growing companies to build real security programs: documented, defensible, and ready for outside scrutiny.
The situation
As companies grow, security stops being something you can manage informally. A customer sends a questionnaire. A prospect asks for a SOC 2 report. An investor wants to understand your controls. The questions are reasonable. But if your security program exists mostly in people's heads, answering them credibly is hard.
We help you build the program that makes those conversations straightforward. Not by adding complexity, but by organizing what you already do and filling the gaps that matter most.
Our services
Advisory work at every stage of security maturity.
Security Program Development
For companies starting from close to nothing, or those with good practices that have never been formally documented. We build a structured, written security program aligned to your business: policies, controls, and evidence that hold up to scrutiny.
Learn more→SOC 2 Readiness
SOC 2 is a significant undertaking, and arriving at an audit unprepared is expensive. We assess your current state against the Trust Services Criteria, close the gaps, and prepare your team for the audit process so the report reflects the program you actually have.
Learn more→Virtual CISO
An experienced security executive on retainer. We answer customer security questionnaires, join prospect and vendor calls, advise your leadership team, and provide the senior security voice your company needs, without the cost of a full-time hire.
Learn more→About the practice
Advice from a practitioner, not a vendor.
CISM
Certified Information Security Manager
CISA
Certified Information Systems Auditor
InfoSec Guidance is led by a practicing CISO holding CISM and CISA certifications, the two most recognized credentials in information security management. The work is hands-on and direct: no junior staff, no offshore delivery, no upselling.
We work with a small number of clients at a time, which means the person you speak with is the person doing the work. That matters when the questions are hard and the stakes are real.
Not sure where your security program stands?
A free consultation is a straightforward conversation about where you are, where you need to be, and what it takes to get there.