IT, cybersecurity and AI
advisory for business.
We help small and mid-sized businesses decide what to fix first, what it costs, and what their insurer, auditor or customers will accept. Based in Port St. Lucie, we work on site across the Treasure Coast and remotely throughout Florida and the US.
Where we focus.
We lead with healthcare, manufacturing and marine defense suppliers, and financial and professional services. Each carries its own rules, contract terms and insurance questions. We start from the requirements that already apply to you, not from a generic checklist.
Healthcare and life sciences
Medical and dental practices, home health, behavioral health, labs and the business associates that serve them. HIPAA Security Rule risk analysis, safeguards and vendor agreements.
Manufacturing and marine defense suppliers
Boatbuilders, composites, machine shops, electronics and aviation suppliers, including those selling into defense primes. DFARS 252.204-7012 and CMMC flow-down, NIST SP 800-171, plant-floor systems and recovery planning.
Financial and professional services
Tax and accounting firms, mortgage and lending, insurance agencies, investment advisers and law firms. FTC Safeguards Rule programs, SEC Regulation S-P incident response, and AI use policies for client data.
Also serving
Construction, engineering and real estate
Contractors, design firms, brokerages, title and property managers. Payment and wire-fraud controls, email security, project-data protection and contract security clauses.
Logistics and distribution
Warehousing, distribution and transport operators. Vendor and remote-access risk, network segmentation, and recovery plans for systems that cannot stop.
Retail, hospitality and e-commerce
Businesses that take card payments in store or online. PCI DSS v4.0.1 scoping, payment-page script controls and self-assessment questionnaire preparation.
Defined scope, written deliverables.
Each engagement starts with a written scope and ends with documents you can hand to your board, insurer, auditor or largest customer. See every division on the services page.
Cyber Insurance Readiness Review
We walk your carrier's security questions control by control: MFA, endpoint detection and response, backups and restore tests, incident response, email security and patching. You get an evidence pack and a gap list ranked by what matters to underwriting.
Regulated-Data Compliance Readiness
Gap assessment, policies and a risk register for the rule that applies to you: HIPAA Security Rule, FTC Safeguards Rule, PCI DSS v4.0.1 or SEC Regulation S-P.
Supplier Security Readiness
For commercial suppliers whose customers flow down DFARS 252.204-7012 or CMMC: NIST SP 800-171 gap assessment, system security plan, POA&M and self-assessment preparation.
Fractional CISO
Retained security leadership: program plan, policies, quarterly board reporting, customer and insurer questionnaires, and support for the Qualified Individual you designate under the FTC Safeguards Rule.
Independent IT Provider Review
An outside look at your managed service provider or IT vendor against its contract, your insurer's control list and recognized frameworks, with clear improvement or transition steps.
AI Use Policy and Guardrails
An acceptable-use policy, approved-tool list and review of what data goes where, plus two or three AI use cases worth funding, aligned to the NIST AI RMF.
Also available: the Rapid Cyber Assessment, incident response plans and tabletop exercises (advisory only; we do not provide investigative or forensic services), resilience and disaster recovery planning, and fractional CTO and technology due diligence.
What applies to you.
Requirements that commonly apply to private-sector organizations. Status as of October 2026.
| Requirement | Who it applies to | What it asks for |
|---|---|---|
| FTC Safeguards Rule 16 CFR Part 314 | Non-bank financial institutions, such as mortgage brokers and lenders, tax preparation firms, finance companies, collection agencies and investment advisers not registered with the SEC | A written information security program, a designated Qualified Individual, MFA, encryption, a written incident response plan, and notice to the FTC within 30 days of an event involving 500 or more consumers |
| HIPAA Security Rule 45 CFR Part 164, Subpart C | Health plans, clearinghouses, most health care providers, and their business associates | A risk analysis and administrative, physical and technical safeguards for electronic health information. An update proposed in January 2025 is not yet final. |
| PCI DSS v4.0.1 | Businesses that accept, process or store payment cards | The only active version of the standard. Its future-dated requirements, including payment-page script controls, have applied since March 31, 2025. |
| SEC Regulation S-P 17 CFR 248.30 | SEC-registered investment advisers, broker-dealers, investment companies, funding portals and transfer agents | A written incident response program, contracts requiring service providers to report breaches within 72 hours, and customer notice within 30 days. Smaller entities had to comply by June 3, 2026. |
| SEC cybersecurity disclosure | Public companies | Annual disclosure of cybersecurity risk management and governance, and a Form 8-K within four business days of determining an incident is material |
| Florida Information Protection Act s. 501.171, F.S. | Businesses holding Floridians' personal information, and the vendors that hold it for them | Reasonable security measures, notice to affected individuals within 30 days, and notice to the Florida Attorney General for breaches affecting 500 or more Floridians |
| DFARS 252.204-7012 and CMMC | Suppliers and subcontractors at any tier that handle covered defense information or controlled unclassified information, including suppliers of commercial products | NIST SP 800-171 controls, 72-hour incident reporting and, under DFARS 252.204-7019, a self-assessment score in SPRS. CMMC Phase 2 third-party assessments have been suspended since July 13, 2026; self-assessments still apply. |
| Cyber insurance applications | Any business buying or renewing cyber cover | Not a law, but carriers commonly ask about MFA, endpoint detection and response, backups and restore testing, and a tested incident response plan |
Florida has no cybersecurity liability safe-harbor law: the 2024 bill was vetoed, and the 2025 and 2026 bills did not pass. "Reasonable measures" remains the state standard, which is why we align programs to the NIST Cybersecurity Framework 2.0. This table is a summary, not legal advice; we confirm the current text when we scope your engagement.
Commercial company, government requirements.
Many Treasure Coast manufacturers and marine businesses sell to defense primes without ever holding a federal contract. Their purchase orders still carry DFARS 252.204-7012 and CMMC flow-down clauses. We apply the same NIST SP 800-171 methods we use for government contractors, sized for a commercial supplier.
Independent by design.
- Vendor-independent recommendations: you buy hardware, licences and managed services directly, so our advice isn't tied to resale margins
- No referral fees or commissions from IT providers, managed service providers or vendors, so our review of your provider stays independent
- We work alongside your IT provider: they run operations, we set direction and verify
- Senior-led from scoping to final briefing
- Findings mapped to named frameworks such as NIST CSF 2.0, CIS Controls v8 and the NIST AI RMF
- Board-ready reporting; see board cybersecurity metrics that mean something
Scoped, measurable, accountable.
No open-ended discovery phases. You know the scope, the deliverables and who does the work before we start.
Assess
Interviews, document review and technical evidence against the rule or framework that applies to you.
Prioritize
Findings ranked by risk, cost and effort, so owners and boards can decide what to fund first.
Deliver
Policies, plans, roadmaps and evidence built with your team and your IT provider, documented for handover.
Sustain
Optional retainer for fractional CISO or CTO leadership, quarterly reviews and renewal support.
Start with a scoped assessment.
Tell us what decision you need to make or what renewal, audit or customer review is coming. We'll reply with a short scope and a timeline — or tell you plainly if we're not the right fit.