The Virtual C‑Suite Book a 30-minute call
Solutions · Compliance readiness

Someone has to own it. Usually that is the owner, at night.

The Virtual C-Suite gives a company of 10 to 150 people an executive who owns its compliance program: a CIO who runs the gap assessment and the remediation plan, a general counsel who owns the policies, contracts and attestations, and a chief security officer who owns the physical and personnel controls. We prepare you for the assessor or auditor; we are not the assessor.

Book a 30-minute callSee pricing

Who this is for

Maryland, DC and Northern Virginia government contractors facing CMMC. Healthcare practices and the companies that serve them under HIPAA. Financial advisors, dealers and others under the FTC Safeguards Rule. Any company whose customers now send a security questionnaire before they sign.

What usually goes wrong

  1. The MSP says the company is compliant; the MSP means the computers are patched. Nobody owns the policies, the training, the vendor contracts, the risk assessment or the evidence
  2. The security questionnaire gets answered optimistically, and the answers become a contract term
  3. The cyber insurance application was answered the same way, and the policy will not pay
  4. The policies were downloaded, never adapted, never read, and the assessor asks the receptionist what the policy says
  5. The deadline is a contract date, not a compliance date, and the company starts six months too late

What we do in the first 90 days

  1. Days 1 to 14Duane runs the gap assessment against the framework you are facing (CMMC Level 1 or 2, the HIPAA Security Rule, the Safeguards Rule, or the questionnaire itself); David reads the contracts, the attestations you have already signed and the policies you have; Daniel assesses the physical and personnel controls the frameworks require.
  2. Day 15A scored gap list and a remediation budget, with the items that are cheap and fast separated from the ones that need money.
  3. Days 15 to 90The remediation plan runs, with your MSP doing the technical work under Duane's direction, David rewriting the policies and contract terms, Daniel standing up the physical and personnel controls and the training.
  4. Day 90The evidence binder exists, the written review says what is left, and you decide the standing retainer.

Which seats

CIO on every engagement; general counsel for policies, contracts and attestations; chief security officer where the framework reaches facilities, personnel or incident response, which for CMMC and HIPAA it does.

Who it is not for

Organizations that need a C3PAO, a HIPAA auditor or a SOC 2 auditor; we get you ready for them and we do not grade our own work. Companies that need a managed service provider to do the technical remediation; EDG.tech can be that provider, and when it is, the engagement letter says so and prices it separately.

Why us for this

Duane has run security programs for regulated small businesses through EDG.tech since 2016 and owns the technical side of CMMC and HIPAA readiness for clients today. David writes the policies and reads the contracts as the lawyer who will be answering the customer's counsel. Daniel has stood up physical security and incident programs for organizations with far more at stake than a questionnaire.

The three seats

David Moore
David MooreVirtual General CounselRegistered patent attorney. Founded, built and sold a technology company before law school.Fractional general counsel →
Duane Epperly
Duane EpperlyVirtual CIO30 years in IT. Founder of EDG.tech and co-owner of two franchise businesses.Fractional CIO →
Daniel Ramos
Daniel RamosVirtual Chief Security Officer25 years in the FBI, retired as Assistant Special Agent in Charge.Fractional CSO →

Questions owners ask

Can you certify us?

No. Certification and audits are done by independent assessors. We make sure you pass.

How long does CMMC readiness take for a small contractor?

It depends on the level and where you start; the day-15 gap list gives you the real answer. Companies that start a year before the contract date are comfortable; companies that start three months before are not.

Our MSP says we are already compliant. Why do we need this?

Ask the MSP for the risk assessment, the policies, the training records and the vendor agreements. If they can produce them, you may not need us. Most cannot, because those are not an MSP's job.

What does this cost?

The retainer ranges are on the pricing page. Remediation costs (software, hardware, an assessor) are yours and are itemized in the day-15 budget.

Tell us the decision you are stuck on.
Book a 30-minute callSee pricing