An insurance application, a customer questionnaire, or a contract security exhibit landed on your desk and something is stuck until it goes back. Send it to us. $3,500 fixed fee, advisory only, nothing installed, no hands on your systems.
Pick the one that matches. It takes you to a short intake form with your situation already filled in, and we reply within one business day to confirm scope.
The carrier is asking about MFA, EDR, backups, and incident response, and someone has to sign it. We answer accurately so it holds up at claim time.
A customer or prospect sent a SIG, CAIQ, or homegrown spreadsheet, and the deal is waiting on it. We return it ready to send.
A contract, BAA, or MSA arrived with security terms nobody can interpret. We translate it into what you actually have to do.
An auditor, examiner, or assessor left findings with due dates. We turn them into a plan with an owner and a date for each item.
Buy side or sell side, security just came up. We get your answers straight and documented before the next round of questions.
A board question, a regulator letter, a new requirement from a partner. Tell us what it is and we will tell you honestly whether it fits.
The full $3,500 is credited toward a Leadership Baseline Assessment if you engage within 60 days.
You send the document. A 30-minute call confirms scope, the deadline, and who on your side or at your MSP knows the answers.
Short interviews with you and your IT provider. We draft every answer, flag anything that is not a clean yes, and note what evidence supports each one.
You get the finished document, the gap register, and the remediation plan, walked through in a 30-minute readout. It is ready to send.
Typically 10 to 500 employees, with an MSP or small IT team and no one whose job is security. Common in:
Payer and hospital vendor assessments, BAAs, HIPAA questions on insurance applications.
Examiner findings, GLBA Safeguards questions, and due diligence from partners and acquirers.
Supplier security questionnaires from OEMs and prime customers, and insurance renewals after ransomware headlines.
Client outside-counsel guidelines, security questionnaires from corporate clients, and malpractice carrier applications.
Cyber insurance renewals and wire-fraud controls that GCs and owners now ask about.
DFARS security clauses in subcontracts and prime flow-down questionnaires.
There is no upsell built into the ten days. If one document showed you there is more to fix, these are the next steps clients usually take.
One document, handled. $3,500 fixed.
A full picture of your program and a prioritized plan. Your $3,500 is credited if you start within 60 days.
A standing security leader for the next questionnaire, renewal, and board question. Monthly, cancel anytime.
Every engagement is handled by the founder, start to finish. No account managers, no junior analysts, no handoffs. 13+ years in enterprise security, ISC2 Center for Cyber Safety and Education volunteer.
Read the full story →One triggering document, answered. That is the completed questionnaire, application, or exhibit response written in your voice, a gap register naming an owner and a date for every answer that is not a clean yes, a one-page remediation plan your IT provider or MSP can execute, and a 30-minute executive readout.
Most are still a fit. We confirm scope before you pay anything. If a document is genuinely larger than ten business days of work, we tell you that on the intake call and quote it honestly rather than rushing it.
No. We work from interviews with you and your IT provider, plus whatever documentation already exists. We never touch your systems, install anything, or ask for administrative credentials.
No. Every answer has to be one you can defend if a customer, carrier, or auditor asks for evidence. Where the honest answer is not yet yes, we say so, and the gap register shows how to get there.
Nothing, unless you want it to. Many clients stop here. If you want a full picture of your program, the entire $3,500 is credited toward a Leadership Baseline Assessment when you engage within 60 days.
No. CyberCascadia is advisory-only and never competes with your MSP. The remediation plan is written for them to execute, and most MSPs are glad to have a clear list instead of a vague request.
Send it to us. One questionnaire, insurance application, or contract exhibit, answered in ten business days for a fixed $3,500.