Virtual CISO and Cyber Governance
Many organizations need executive-level security leadership but are not ready for a full-time chief information security officer. These services provide senior guidance, sets direction, establish accountability, and provide management and the board a clear view of cyber risk.
2
Cybersecurity Strategy and Roadmap
Connects security priorities to business goals and risk tolerance. Leadership sees the current position, the target state, and the steps to get there over the next one to three years.
3
Governance, Policies, and Risk Ownership
Defines who owns cyber risks, how security decisions are made, and which policies and standards apply. This creates a clear foundation for oversight and accountability.
1
vCISO Advisory
Provides ongoing senior cybersecurity leadership to guide strategy, oversee the security program, support key decisions, and communicate risk to management, auditors, insurers, and the board.
4
Executive and Board Reporting
Translates security status into concise business updates. Leaders and directors see current risks, progress against the plan, and decisions that need their attention.
AI Governance and Readiness
AI tools and features can easily spread across an organization, often without consistent oversight or guardrails. These services help leaders set practical rules, assign responsibility, and evaluate risk as AI adoption rapidly grows.
2
Governance Roles and Approval Process
Defines who reviews and approves new AI uses, who monitors them, and how decisions are documented. The process supports adoption with clear accountability.
3
Risk Reviews for AI Use and Tools
Reviews specific AI tools, vendors, and use cases before deployment or expansion. Each review considers data exposure, security, privacy, and contract terms, and ends with a clear recommendation.
1
AI Policies and Acceptable-Use Guidance
Sets practical rules for approved tools, data handling, human review, and uses that require additional approval.
4
Readiness Assessment and Implementation Roadmap
Assesses whether governance, data practices, and access controls are ready for broader AI adoption, then sets out prioritized steps to address gaps.
Cyber Risk and Assessments
Improving security starts with an independent view of where the organization stands. Our services identify gaps that pose the greatest risk to your business, explains their implications, and lays out what to address first.
2
Vendor and Supply-Chain Risk Assessment
Evaluates outside providers and partners, including those with access to systems or data. The assessment identifies higher risk dependencies and ways to manage them through contracts, controls, and oversight.
3
Targeted Reviews of Critical Vendors or Business Units
Takes a closer look at a high-priority vendor, site, or business unit when a specific concern, acquisition, or limited-scope review calls for more detail.
1
Enterprise Cybersecurity Assessment
Reviews organization-wide security controls, practices, and risks against recognized guidance, such as the NIST Cybersecurity Framework. Leadership receives a prioritized view of significant gaps and a practical path forward.
4
Prioritized Remediation Plans
For organizations with known findings, turns gaps into a sequenced action plan with proposed owners, timing, and progress measures.
Cyber Resilience & Crisis Management
Cyber incidents can disrupt more than technology. We prepare leadership and response teams to make decisions under pressure, communicate clearly, and support the recovery of critical operations.
2
Incident Response Plan Development
Creates or updates procedures for roles, escalation paths, decision points, and likely scenarios, such as ransomware, data breaches, and business email compromise. The plan is written for use during an incident and can be tested in an exercise.
3
Crisis Management Team Preparation
Defines who serves on the Crisis Management Team, what each member owns, and how the team convenes and makes decisions during a cyber event.
1
Tabletop Exercises
Uses facilitated, realistic scenarios to test how leaders and response teams communicate, escalate, and make decisions. Exercises reveal gaps in plans and coordination before a real incident.
4
Recovery and Business Continuity Coordination
Aligns cyber response with business continuity and disaster recovery plans. Critical operations are prioritized for restoration based on business impact.
Connected Building and OT Security
Modern buildings rely on connected systems that can affect safety, tenants, and operations. Sandy Jacolow’s experience protecting the Empire State Building and the World Trade Center frames a practical view of how building systems, networks, service providers, and operational responsibilities fit together.
2
Network Connections and Remote-Access Review
Map how building and OT systems connect to corporate networks, the internet, cloud platforms, and outside parties. The review identifies weak segmentation, unnecessary connections, and remote-access paths that may create risk.
3
Vendor Access and Maintenance Practices
Reviews how service providers and integrators access and maintain building systems, including credentials, remote tools, and oversight.
1
Connected Building and OT Security Assessment
Reviews systems that run buildings and operations, how they connect, and where they may be exposed. We identify key operational systems and documents who owns, operates, and maintains each one. The inventory provides a foundation for managing risk.
4
Operational Impact Review and Prioritized Recommendations
Assesses how a system compromise could affect safety, tenants, operations, and reputation. Recommendations are ranked by real-world impact so building and operations leaders can act.
Virtual CIO and Technology Advisory
Strategic technology leadership to align investments with business priorities, improve operations, and support growth. Services include technology strategy and roadmaps, budgeting, modernization, vendor management, data and analytics, and guidance on emerging technologies.
2
Governance Roles and Approval Process
Defines who reviews and approves new AI uses, who monitors them, and how decisions are documented. The process supports adoption with clear accountability.
3
Risk Reviews for AI Use and Tools
1
AI Policies and Acceptable-Use Guidance
Sets practical rules for approved tools, data handling, human review, and uses that require additional approval.
4
Readiness Assessment and Implementation Roadmap
Assesses whether governance, data practices, and access controls are ready for broader AI adoption, then sets out prioritized steps to address gaps.
Reviews specific AI tools, vendors, and use cases before deployment or expansion. Each review considers data exposure, security, privacy, and contract terms, and ends with a clear recommendation.