Security usually lands on the leadership team's desk all at once. A questionnaire arrives, a compliance deadline appears, or something in the news makes everyone wonder, "Wait, are we okay?"
It tends to look something like this:
- A funder, customer, insurer, or auditor sent a security questionnaire, and nobody is sure how to answer it honestly.
- A compliance requirement is coming (NIST 800-171, HIPAA, FDA expectations) and you need to know what getting ready actually involves.
- Your work makes you a target, and security keeps leadership up at night without a clear sense of what to do first.
- Your security policies are templates with your organization's name pasted in, and nobody has read them.
- Staff are using AI tools, and AI features keep appearing inside the tools you already pay for. Where is your data going?
- A major vulnerability makes the news, and nobody can tell you whether it affects you.
- You have an IT provider, but nobody owns security decisions.
If a few of those sound familiar, we can help. A fractional CISO gives you senior security leadership for as much time as the work needs: someone who understands the risks, sets priorities, and helps everyone else make good decisions.
What we actually do
We focus on real risks and on the improvements that will make the biggest difference, while making sure people can still do their jobs. That usually means some mix of:
- Figuring out where you really stand. Reviews of Microsoft 365 or Google Workspace, accounts and access, devices, and vendors, with plain-language recommendations ranked by impact.
- Getting ready for compliance. Readiness and preparation for NIST 800-171, HIPAA, CIS Controls, FDA requirements, and SOC 2, so that when an auditor arrives, you're prepared.
- Writing policies that fit your organization. Acceptable use, data privacy, access, incident response: written for how you actually work, then explained to staff so they know what's expected and why.
- Reviewing vendors and how they use your data. Including the AI built into everyday tools, which is where a lot of data quietly goes now. This matters most when your data or intellectual property is the business.
- Rolling out the basics well. Password managers, multi-factor authentication, sensible access controls, with enough change management that people actually use them.
- Answering the hard questions quickly. When a vulnerability hits the news, we can tell you whether it affects you and what to do about it.
- Coordinating with your IT provider and security vendors so the plan actually gets carried out.
What we don't do: we aren't auditors and don't certify compliance. We don't run 24/7 monitoring or incident response, and we don't sell security tools. We also don't do penetration testing. Most organizations that come to us need the groundwork that should happen before a pentest. When you're ready for one, an independent firm should do it, and we'll help you scope it.
When security is really a bigger question
Security questions often turn out to be broader technology questions. Who owns which systems? Why are there four file-sharing tools? What's the IT provider actually responsible for?
Answering questionnaires from insurers, auditors, funders, or due diligence reviews honestly also requires knowing what's really in place across the whole organization. That's why, for many organizations, our fractional CIO work is the better fit: security is part of a wider role, not a separate silo. We'll help you figure out which makes sense.
Who you'd be working with
Every engagement includes two senior advisors who work closely together.
Matt Clobridge leads the technical security side: Microsoft 365 and Google Workspace configuration, access and identity, devices, and figuring out what's really exposed.
Abby Clobridge leads the compliance and governance side: frameworks, policies, vendor and data reviews, privacy, and turning requirements into a plan people can follow.
We're a small team with backgrounds in library and information science, which means we care a lot about where information lives and who can get to it. That turns out to be most of security. The people on your first call are the people who do the work.
What this has looked like
Most of our work is covered by NDAs, so no names, but here are a few examples:
A nonprofit preparing for NIST 800-171 needed to protect sensitive federal information. Over the past year, we've guided its readiness work: assessing gaps, writing policies, prioritizing technical controls, and working alongside its IT provider to put them in place.
Organizations doing targeted work in human rights, reproductive and women's rights, and environmental advocacy have come to us when security was keeping leadership up at night and nobody knew where to start. We focused on the risks they actually faced and the changes that would make the biggest difference, and helped them make major improvements without making it harder for staff to do their work.
A biotech startup whose intellectual property is its business needed to know exactly how vendors were handling its data. We do deep-dive vendor reviews for them, increasingly focused on AI features built into tools they already use, so leadership knows where their data goes and can make informed decisions.
A startup we support as fractional CIO relies on us every year to answer the IT and security questionnaires for its annual financial audit. Its finance team regularly tells us how thorough and detailed the responses are, which is what happens when the people answering actually know the environment.
"When the time came to scale our security program, the groundwork had already been done." — Leadership, human rights advocacy organization
How it usually starts
- You tell us what's going on. A few sentences in the form below is plenty: a deadline, a questionnaire, a worry.
- We talk. Usually about 45 minutes. We'll ask a lot of questions and tell you honestly whether this is security work, broader technology work, or something we're not the right fit for.
- We start by understanding what's in place. Before recommending anything, we look at what you have, what you're required to do, and what risks are realistic for an organization like yours.
Fair warning: we'll tell you what we actually think. Sometimes the biggest risk isn't the one on the questionnaire. Sometimes a free setting matters more than an expensive tool. And sometimes the answer is "you're in better shape than you think."
Questions people usually ask first
Can you certify us or do our audit?
No. We aren't auditors. We help you prepare: understanding the requirements, closing gaps, and getting the documentation in order, so the audit or assessment goes smoothly.
Do we need a penetration test?
Eventually, maybe. Most organizations get far more value from the basics first. When you're ready for one, we'll help you find an independent firm and scope it.
Will more security make it harder for staff to work?
It shouldn't. We're always balancing protection with people's ability to do their jobs, and policies are only useful if people understand and follow them.
For more of our thinking, read Why Every Organization Needs a Security-Savvy Voice on the Team and Shadow AI: The Hidden Risks.
Tell us what's going on
A few sentences about your situation is plenty. We read every message ourselves and reply within one to two business days. If there's a deadline involved, let us know.
Email us at: [email protected] or fill out our contact form.
