Browse categories
Explore
Fiverr Pro
English
$
USD
I will be your vciso on a monthly retainer
CMMC, HIPAA and NIST compliance advisor, CISM, CMMC RPA
I'm Sam Durso, founder of The Cyber Friend LLC. I help small and medium businesses get ready for CMMC, meet the HIPAA Security Rule, assess risk against NIST CSF 2.0, and write the policies and plans ...
Vetted by Fiverr Pro
Sam was selected by the Fiverr Pro team for their expertise.
Vetted for
Cybersecurity
About this Gig
Vetted Pro
Your client, your auditor, or your insurer asked who your CISO is. You do not have one, and a full-time hire is not happening.
That is what this retainer is for. You get a named, credentialed security executive on record and actively engaged in your posture, not an hourly consultant you call after something breaks.
Every tier includes:
- Quarterly security review
- Policy review and guidance
- Compliance monitoring across CMMC, HIPAA, and NIST
- Incident response guidance
- Board-ready reporting
Tiers differ by who gets access, how fast I respond, and how many board briefings and projects are included.
This retainer covers strategic leadership and advisory. Assessments, policy writing, and implementation are scoped separately.
CISM. CMMC RPA. Master's in Cybersecurity. Six years in security, including vCSO work across a managed provider's client base.
Message me with what triggered this, and I will tell you which tier fits.
Expertise:
Awareness
•
Gap Analysis
•
Risk Assesment
Technology:
Cloud - IaaS
•
Monitoring
•
Networking
•
Physical
•
Saas
Regulation:
Other
Other Cybersecurity Services I Offer
FAQ
What does a vCISO actually do?
I own your security direction. Strategy, policy, compliance posture, vendor decisions, and the reporting your board or clients ask for. You get a credentialed name on record, actively engaged, not on call.
Which tier do we need?
Security Advisor if it is you making decisions and you need a sounding board. Security Partner if leadership is involved and you have quarterly work. Embedded CISO if you are answering to a board or prime contractor regularly. Message me, and I will tell you straight.
Is this hourly?
No. You are buying access and ownership, not a block of hours. That is why response time and who can reach me differ by tier rather than an hour count.
Does this include assessments and policy writing?
The retainer covers strategic leadership and advisory. Assessments, written policies, and implementation are scoped separately. Standard and Premium include quarterly project allowances that can cover some of it.
Can we tell auditors and clients you are our CISO?
Yes. Being a named security professional your auditors, insurers, and clients can point to is a core reason this exists.
What if we have an incident?
I provide incident response guidance at every tier and priority, and same-day, at Embedded CISO. I advise and direct. Hands-on remediation is handled by your IT team or provider.
