Security you can defend.

Helping organizations design and build cybersecurity programs that they can defend to their board, their customers, and buyers in diligence.

Start a conversation The approach

The problem

You have been “compliant” for years, but you don’t know if you are “secure enough.”

Sound familiar?

  • You know you need to continue to invest in security, but since you are “compliant,” you don’t know what more to actually do, how to allocate spend, or if you are falling behind your peers.
  • The board asks whether you’re secure enough, and the best answer anyone has is the audit report.
  • Your general counsel, COO or head of compliance can’t get a straight answer about where things stand.
  • A raise or a sale is coming, and you don’t know what diligence will find.

It happens when passing the audit becomes the goal. The auditor ends up deciding how much security is enough, and for a SaaS company past about $50 million in revenue, that’s the wrong bar.

How I solve it

Your executive team decides how much security is enough for this business. I help you write it down as your own standard, then get there and stay there.

Read the essay: your security program is built for a company you no longer are

Why CXD

CXD brings business acumen and technical expertise to the table.

I’ve worked extensively with organizations from midsize B2B SaaS to Fortune 50 B2C companies, and everything in between. Today, CXD focuses on B2B SaaS companies past $50 million in revenue.

Why companies bring CXD in

  • I bring perspective from enterprise security programs in Big 4 consulting and from getting cybersecurity programs off the ground at a boutique firm.
  • I have the technical expertise and hands-on experience doing the things I advise on, and the strategic vision to address your executive team’s key concerns and objectives.
  • I have no stake in the answer. Sometimes enough turns out to be less than you’re doing now.
  • I check your systems, not just your policies, and you hear about problems the day they’re found.
  • Findings describe systems and controls, never people. If privilege matters to you, the work can run under the direction of your counsel.

What they get

  • One written standard for how much security is enough, agreed by your executive team.
  • An honest read of where you stand against it, checked in your systems.
  • A roadmap for the next 12 to 24 months, and benchmarks for spend and headcount.
  • A readout to your executive leadership team on where you stand, what it will take and what they need to decide.
  • Hands-on help carrying out the roadmap with your team, not just a plan handed over.

The approach

To figure out where to go, first we figure out where you are.

  1. Where you are

    Which of the three stages your security program is really in today.

  2. Where you should be

    The stage your business has reached, and what enough security means at that stage.

  3. Closing the gap

    First, major gaps in the capabilities your stage calls for. Then your most material risks and how well you’re protected against them. Then the rest.

Three stages

Every security program moves through three stages, and the stage decides what enough means. A compliance-driven program is right for a young company. It becomes wrong when the business outgrows it, and most companies outgrow it years before they notice.

1 COMPLIANCE-DRIVEN What do auditors and customers require? 2 RISK-DRIVEN What would hurt the business most? 3 STEADY STATE How does it stay covered? ACHIEVE COMPLIANCE FIX THE WORST RISKS FIX THE REST EACH ACQUISITION, NEW MARKET OR PRODUCT SOC 2 · ISO 27001 · HITRUST THEN MAINTAIN it never goes away as exposure grows THE USUAL SIGNS past $50 million in revenue or an outage would cost real money you pass audits reliably or a breach would reach the board ONCE WHAT MATTERS IS COVERED and stays covered between reviews
Conceptual model. Relative emphasis, not measured values.
1 COMPLIANCE-DRIVEN 2 RISK-DRIVEN 3 STEADY STATE ACHIEVE COMPLIANCE FIX THE WORST RISKS FIX THE REST EACH ACQUISITION, NEW MARKET OR PRODUCT as exposure grows it never goes away Conceptual model. Relative emphasis, not measured values.

Three pillars

Every program carries three kinds of requirements at every stage, and none is ever empty. What changes from stage to stage is the bar in each.

Compliance and regulatory
What auditors, regulators and customers require.
Material risk mitigation
Controls over and above the baseline, for the specific risks that would hurt this business.
Hygiene
The baseline every system meets, everywhere in the company.
Chris Donaldson

Let’s connect.

I’d love to hear where your organization is today and where it wants to go, and share any perspective I can. Let’s find out if working together makes sense.

If you’re under $50 million in revenue, you probably don’t need me yet. Get the basics right, add managed detection and response, and spend the rest on growth.