Founder of FA Consulting | Fractional COO | Developing high performing teams | Startup Advisor | Board Member

At Almeshaan Consulting, we drive organizational effectiveness for high-growth companies by aligning organizational goals, setting up structured performance management systems, and providing leadership development and management training.  

Services:
- 𝐅𝐮𝐥𝐥 𝐓𝐞𝐚𝐦 𝐀𝐥𝐢𝐠𝐧𝐦𝐞𝐧𝐭: Set clear, measurable objectives and key results to guide every team member’s efforts and ensure everyone understands their role in achieving company goals.

- 𝐋𝐞𝐚𝐝𝐞𝐫𝐬𝐡𝐢𝐩 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐦𝐞𝐧𝐭 & 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠: Equip your leaders and managers with the skills to lead effectively, from decision-making to people management.

- 𝐎𝐩𝐭𝐢𝐦𝐢𝐳𝐞 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 𝐰𝐢𝐭𝐡 𝐂𝐮𝐭𝐭𝐢𝐧𝐠-𝐄𝐝𝐠𝐞 𝐒𝐲𝐬𝐭𝐞𝐦𝐬 𝐚𝐧𝐝 𝐀𝐈: Develop systems to meticulously monitor and track critical metrics, ensuring your targets are met efficiently.

Curious how you can drive your team's performance? Reach out at faye@almeshaan.co

Faye Almeshaan

We help startups and SMBs strengthen their cybersecurity and compliance. Our 'One Scalable Plan' is designed for companies that are looking for flexibility. It can quickly be adjusted to keep up with requirements as they evolve. The plan includes strategy, assessments, and enhancements so clients can close deals while avoiding fines, penalties, and lawsuits. 

For CMMC, FedRAMP, or SOC 2 prep, we handle most of the work so your team can focus on other priorities. I also co-host The GRC Room, a monthly LinkedIn Live series featuring leading voices in cyber GRC. If you're a startup or SMB leader looking to strengthen your cybersecurity and compliance, feel free to send a connect request or DM anytime.

Mike Andrewes

“Should we do a risk assessment or start SOC 2 prep now?”

This question came up during a call a while back.

It’s a good question.

The person asking realized it was important to think about the actual cyber risks to their business.

They wanted SOC 2 because potential customers kept asking.

The risk assessment should happen first, even if SOC 2 is the goal.

Under the SOC 2 Trust Services Criteria, CC3 is titled “Risk Assessment.”

If we tell an auditor that our risk assessment was “preparing for SOC 2” itself, that’s less than ideal.

SOC 2 isn’t a risk assessment methodology.

It’s an independent assurance framework that evaluates whether a company’s controls meet the AICPA Trust Services Criteria. 

Once the risk assessment is done, it’s time for the SOC 2 gap analysis.

Then, we know what needs to be done to earn a clean SOC 2 report.

Why does the order matter?

Not all cyber risks are compliance gaps.

Non-compliance is a form of cyber risk.

All cyber risks are business risks.

There are fewer blind spots when we work in the right sequence.

✅ If you need to see where things stand when it comes to cyber risks and compliance, send me a message.

Cybersecurity Advisor | Scalable cybersecurity for startups and SMBs

Does it feel like states keep adding new privacy laws?

20 states now have privacy laws that are active or will be soon.

Other states are thinking of joining the party as well.

This is challenging for businesses to keep up with.

Getting this wrong can mean fines, legal action, and reputation harm.

Jodi Daniels knows this topic well and she's joining - Karina Klever - and me in The GRC Room on March 18th.

Jodi is the Founder & CEO of Red Clover Advisors and hosts the 'She Said Privacy / He Said Security' podcast.

👉 Next steps: RSVP today or share with your network!

Edyta Kosnik, Sahar Dahan and 713 other attendees

We have two types of cybersecurity advisory clients:

- Ones that had an assessment within the past ~12 months.

- Ones that are about to have an assessment.

This is the best way to see where things stand with cyber risk and compliance.

Then, we can take informed action.

However, some companies may prefer to skip the assessment and treat symptoms or go off of "best practices".

"We don't have much in place anyway".

This might work for a while, but here's a couple of reasons not to skip the assessment altogether:

- Every business is different, so one-size-fits-all plans rarely work.

- The things that get missed often turn into deeper issues.

The hidden upside to an assessment is that we often find cybersecurity spending that doesn't need to happen anymore.

There are opportunities for one new solution to solve five problems.

There's very little downside to this.

Have you thought about doing a cybersecurity assessment at your business?

✅ If so, send me a message if you have questions.

Do you fill out cybersecurity questionnaires at your company?

It should be faster today than it was a year ago.

Two reasons:

- Automation

- Maintaining a knowledge base (KB)

Once the process works, we can automate where it makes sense.

We should still review responses before pressing send.

For manual sections, reuse strong, validated answers from a KB.

Most questionnaires ask the same core questions.

Third-party risk management (TPRM) should not be the main way you assess your own risk.

Start by looking within.

That means doing first-party risk management (FPRM).

FPRM creates the foundation for TPRM.

When you understand your actual risk posture, describing it becomes easier.

If every questionnaire feels painful, this may be why.

Have you seen a company have these issues?

If so, what was the main sticking point?

SMB cybersecurity can be tough.

Common reasons it doesn’t happen:

• "We're too small."

• "We don't have the budget."

• "We plan to get to it soon."

• "I think our IT person handles that."

• "If something happens, we will deal with it."

The reason that's discussed less often?

There are a lot of moving parts.

Strategy, policies, tools, coordination across departments.

Monitoring never really ends.

It can be a lot.

When it comes to compliance, small companies often face nearly the same requirements as larger ones.

The way to make it manageable is to be proactive.

Tackle it a little at a time.

If the strategy feels impossible, simplify it.

Focus on what actually matters to the business.

If this feels daunting and your business needs to get it right, experienced outside firms can help bring structure and clarity.

When this is done right, security aligns with the business and feels manageable.

Step one?

Figure out how important this really is to your business.

• Do customers ask about your cybersecurity?

• Do contracts or insurance policies require it?

• What would one day of downtime cost you?

• What would a data breach cost? The average cost per record is around $160.

If you answer those four questions honestly, the next step becomes clearer.

Is there anything you’d add to this?

Compliance is a hot topic on LinkedIn and at parties.

Most people can't get enough.

Okay, fine. 

That might be a stretch.

We commonly hear "cybersecurity isn't compliance".

There's some truth to this saying, but there's no reason compliance can't look and feel like cybersecurity.

It's not like SOC 2 or PCI DSS secretly tells companies to avoid thinking about real cybersecurity.

Compliance is the floor.

We can elevate it.

We can fill in the gaps.

That sparse garden of compliance can grow into real security.

It doesn't even need to happen overnight. 

It can be done as time and money allow, a little at a time.

What are your thoughts on this debate?

On Saturday, I posted about deciding between a cyber risk assessment or SOC 2 prep.

The post concluded that starting with a cyber risk assessment is smart in either case.

Multiple cybersecurity practitioners agreed.

Here's the common objection:

"If we're doing SOC 2 anyway, is this double the work?"

If done correctly, it shouldn't be.

Yes, you may evaluate more control line items.

However, you're not:

• Scoping twice

• Reviewing documentation twice

• Testing configurations twice

There's significant overlap.

I can tell you with certainty, it doesn't take our company twice as long.

A properly executed risk assessment should directly inform SOC 2 readiness rather than duplicate it.

If efforts are being duplicated, the organization is likely creating silos.

Unless you run a farm (or a few other types of businesses), silos aren't good.

A mature cybersecurity program is designed to evolve. 

Risk and compliance should operate as connected disciplines, not separate tracks.

If leadership understands the compliance posture but lacks visibility into actual risk exposure, it's time for a risk assessment.

If leadership understands risk but lacks clarity on regulatory obligations, it's time to ask questions such as:

“We're a small accounting firm in Las Vegas. What cybersecurity laws, regulations, and industry guidelines apply to us?”

Even asking your favorite LLM is better than operating in the dark.

What do you think about this?

Scoping doesn’t get enough attention during a lot of cybersecurity projects.

When the scope is unclear, it’s really hard for things to go well.

Poor scoping can affect the contract itself.

Pricing might be way too much or way too little.

When it's too little, the project can quickly become a loss for the vendor.

It also increases the need for rework.

This is why scoping shouldn't be rushed.

First, we need to build a picture of the current state:

- Network diagram

- Data classification plan

- Data flow diagram

- Hardware and software list

Then, we need to determine what's in bounds and out of bounds.

After that, it's time to review policies, configurations, and other relevant evidence.

Once the scope is clear, things move faster because everyone understands the terrain.

Have you seen project scoping gone wrong?

If so, what happened?

In cyber GRC, companies are looking to do more with less.

At the same time, regulatory pressure, third party scrutiny, and customer expectations continue to increase.

Compliance theatre might close a few deals, but it's a fragile strategy.

What is growing instead is GRC engineering.

This means:

• Embedding controls directly into workflows.

• Automating monitoring and evidence collection.

• Producing defensible, real time reporting.

• Aligning security controls with business objectives.

Practitioners who understand GRC principles will thrive in this environment, even as more companies leverage AI.

This shift benefits:

• SOC 2 audit firms that want cleaner, more reliable evidence.

• Companies pursuing SOC 2 for the first time.

• Security teams tired of spreadsheet-driven compliance.

It doesn't have to be all or nothing.

We can use these principles even if we don't have someone with the title of GRC Engineer.

We can start by engineering one control, workflow, or reporting process.

Once compliance becomes systematic, we can shift the focus from collecting evidence to providing actual assurance business leaders want.

Have you thought about leveraging these principles at your business?

In cybersecurity, knowing how to properly prioritize and schedule things is underrated.

We often use High-Medium-Low, 1-10, or 1-100 as part of this.

Determining if a task is outside of our control commonly don't get enough attention though.

On internal cybersecurity schedules or project plans, we've seen:

- "Review and update all policies and playbooks (1 week)"

- "Conduct annual vendor security reviews (1 week)"

Do you see the difference? 

Don't worry about the lack of dates, since the company did have that.

What was missing was the consideration of:

"What's in our control and what isn't?"

The top task was completely within their control.

Between their team and ours, that was fairly simple. 

It took less than three days.

The second part though?

That part was destined to be tough.

What if some vendors didn't respond that week?

A lot of vendors won't. 

Some won't respond at all.

Unless the task is simply "go look at their website / trust center", one week isn't enough if you're dealing with a lengthy list of vendors.

Third-party risk management (TPRM) is far from easy.

The responsive angle is one part of this.

It's also hard because we may need to work off partial information.

If we're trying to build a schedule, we need to think about this.

This is unlikely to change anytime soon.

Have you seen a project get derailed because the timeline wasn't realistic?

If so, what happened?

Two years ago, we were helping a new-ish payment platform with PCI DSS.

This is a security standard that applies to organizations that store, process, or transmit payment card data.

We asked to see certain documents:

- Network diagram

- Data classification plan

- Data flow diagram

- Hardware list

- Software list

This way, everyone knows what the project is focused on and what it isn’t.

When they shared the documents, we reviewed them and provided feedback.

They asked “do you have templates for this?”

I told them we do.

They asked “then why didn’t you share them before?”

That was a bit surprising.

There were two reasons:

- We were there to assess the current state.

- There’s not one correct way to do this.

We shouldn’t be trying to make changes until we know whether there’s a need to make changes.

We don’t want to find more issues so we can do more work and make more money.

If we do an assessment and the only thing to report is how great everything is, that’d be fantastic.

After we spoke about why it’s important to finish the assessment before making changes, they understood and were very reasonable.

This helped the project move at a brisk pace and things turned out well.

Have you ever had a misunderstanding like this as a project was getting started?

Do your internal hardware and software requests ever end in a no?

Do your third-party risk management (TPRM) reviews ever end in a no?

I've seen more than one company that couldn't describe a time they said no in either case.

There's a difference between "finding a way to yes" and simply approving anything and everything.

If the approval rate is 100%, the diagnosis might be:

Compliance theatre. 😢 

Is it possible that judgment within the company is so good that all requests and reviews were destined for approval?

Or did the reviewer not know what to even check for?

Or were they scared of what would happen when they told someone no?

There's a way to handle this that's business-first while actually managing cyber risk and compliance:

1. Have a real cybersecurity review process. 

2. Stay open-minded as to whether it'll be a yes or no.

3. Move fast so people are less likely to go around the process.

4. If it's a yes, make sure the configuration accounts for cybersecurity and monitoring is happening.

5. If it's a no, justification and alternatives should be provided.

We regularly do this for clients and it works.

It’s rare to see hardware or software that's one of a kind.

If there's an obvious flaw, it's okay to look elsewhere.

Have you seen a cybersecurity process that never said no?

If so, what was the reason?

taplio

The Battle

Faye Almeshaan

Mike Andrewes

Followers

Posts

Engagements

Likes

Performance ScoreMike Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Faye Almeshaan

Mike Andrewes

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Mike Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreMike Andrewes's LinkedIn Performance