A Fractional CISO can deliver the value of a full-time CISO but without the same level of investment, especially for smaller organizations or for those security organizations in transition. Jim has extensive experience in strategic planning and development of security organizations, performing comprehensive risk assessments and prioritizing programs and investments accordingly. Jim has also been responsible for network engineering, security engineering, security operations, detection and response, end user computing, as well as security governance, risk management, compliance, and privacy 

Risk assessment is just the first step to effective risk management. Unfortunately, many companies stop at the risk assessment stage. Jim has extensive experience building comprehensive Cyber and Enterprise risk management systems that actually drive strategic planning and investment while tracking impact on risk reduction and increases in cyber security maturity. 

One of the challenges in answering questions such as “Are we secure enough?” and “How much more secure do we need to be?” is the need for a standardized scale against which to measure relative security maturity. The NIST Cyber Security Framework is such a scale but there is no program manual to help companies actually implement the NIST CSF in a comprehensive and meaningful way. Jim has implemented the NIST CSF for multi-billion dollar SaaS companies with integration to risk management programs.