Browse categories
Explore
Fiverr Pro
English
$
USD
I will build your security program from scratch
CMMC, HIPAA and NIST compliance advisor, CISM, CMMC RPA
I'm Sam Durso, founder of The Cyber Friend LLC. I help small and medium businesses get ready for CMMC, meet the HIPAA Security Rule, assess risk against NIST CSF 2.0, and write the policies and plans ...
Vetted by Fiverr Pro
Sam was selected by the Fiverr Pro team for their expertise.
Vetted for
Cybersecurity
About this Gig
Vetted Pro
Most companies buy security tools before they have a program in place. The firewall gets bought, the training gets assigned, the policies get downloaded, and nobody can say who owns any of it or what happens when something goes wrong.
A security program is the thing underneath all of that. The risk framework, the policy library, who is responsible for what, and how it gets reported upward. Without one, every compliance push starts over from nothing. With one, CMMC, HIPAA, cyber insurance, and client security questionnaires all draw from the same foundation.
I build it, and you own it permanently.
What you receive:
- A risk management framework built for your size and your industry
- A policy library written for how you operate, up to fifteen policies
- Roles and responsibilities in writing, so ownership is not a guess
- An incident response plan your team can actually execute
- A benchmark against five peer organizations
- A vendor management framework and board reporting template
- Compliance mapping to NIST CSF, HIPAA, or CMMC
No licenses, no subscription, no platform to keep paying for. Every document is editable and yours. When the engagement ends, the program does not.
Expertise:
Awareness
•
Configuration management
•
Risk assessment
Technology:
Cloud - IaaS
•
Mail services
•
Networking
•
Physical
•
Saas
Regulation:
Other
Other Cybersecurity Services I Offer
FAQ
Why do I need a program if I already have security tools?
Because tools without a program are just spending. A program specifies who owns each tool, what it protects, what happens when it alerts, and how that information gets reported to leadership. Without that, you cannot answer a client questionnaire or an insurer, and neither can your tools.
What is the difference between this and your policy development gig?
Policy development writes documents. This builds the system the documents belong to: risk framework, ownership, incident response, vendor controls, and reporting. Policies are one piece of it. If you only need the documents, that gig is cheaper and faster.
Do I own what you build?
Completely. Every document is delivered as an editable file and belongs to you. There is no license, no subscription, and no platform to keep paying for. If we never speak again, your program still works, and you can change any part of it.
What does benchmarked against five peers mean?
I compare your program against five organizations of similar size and industry so you know whether you are ahead or behind, and by how much. It stops the program from being built in a vacuum and gives leadership something to judge it against.
How long does this take?
60 days for Foundation, 75 for Standard, 90 for Enterprise. Most of that is my writing time. What I need from you is a kickoff conversation, written answers to questions, and one review cycle before final delivery.
Will this get us CMMC or HIPAA compliant?
It gets you most of the way, and it makes the rest far cheaper. Enterprise maps your program to NIST CSF, HIPAA, or CMMC so you can see what carries over. It is not an assessment or a certification. Those are separate engagements.
We are twelve people. Is this overkill?
The framework scales down. A twelve-person company needs the same questions answered as a two-hundred-person one, just with fewer moving parts. What it should not have is a program copied from an enterprise, which is what most small companies end up with.
What happens after delivery?
The program is yours to run. Most clients move on to a vCISO retainer so that someone credentialed keeps it current, reviews it annually, and keeps it on record for auditors and insurers. That is optional and quoted separately.
Do you implement the technical controls?
No. I design the program, write the documentation, and define who does what. Your team or your provider configures the systems. If you need hands-on implementation, say so at the start, and I will scope it separately.
Can you work with the policies we already have?
Yes, and it usually saves money. Send what exists at kickoff. Anything current and accurate gets folded in, anything contradicting how you actually operate gets rewritten. You are not paying me to redo work that already holds up.
