Governance · Risk · Compliance
Governance, risk and compliance without the chaos.
Know your risks, prove your controls, and walk into every audit prepared — including for the AI tools your staff are already using.
- Based in Oklahoma
- Serving clients nationwide
- Free 30-minute discovery call
The challenge
Compliance requests are not slowing down
Customers send security questionnaires before they sign. Auditors ask for evidence. Cyber insurers want proof of specific controls before they renew. Regulators expect documented policies and risk assessments.
Without a governance program, every request becomes a fire drill. Staff scramble for screenshots, policies are outdated or missing, and real risks stay hidden until something breaks.
Warning signs
- An audit, assessment or certification deadline is approaching
- Security questionnaires are slowing down sales
- Your cyber insurance application asked questions you could not answer
- Staff are using AI tools and nobody has written a policy
- Policies exist but nobody follows or updates them
- You do not have a current risk assessment
- Vendors have access to your data with little oversight
What we deliver
A complete, right-sized GRC program
We build what your organization actually needs, then help you run it.
| Service | What it includes | What you walk away with |
|---|---|---|
| IT governance framework | Decision rights, steering committee, roles and responsibilities, IT policy library | Clear ownership of technology decisions |
| Risk assessment & register | Asset and threat identification, likelihood and impact scoring, treatment plans | A living, prioritized risk register |
| Policies & procedures | Information security, acceptable use, access control, change management, data retention | Right-sized policies people follow |
| Gap analysis & control mapping | Current controls compared with your chosen frameworks | A gap report and remediation roadmap |
| Audit readiness & support | Evidence collection, pre-audit reviews, auditor coordination | Organized evidence and fewer findings |
| Vendor risk management | Vendor inventory, tiering, security reviews, contract requirements | Third-party risk under control |
| Security questionnaire support | A standard answer library and response support | Faster sales cycles |
| AI governance | AI inventory, acceptable use policy, data-handling rules, vendor review, human oversight and NIST AI RMF or ISO/IEC 42001 alignment | AI your staff can use without creating new risk |
| Privacy program & data mapping | Data inventory, privacy notice review, consumer request handling, data protection assessments | A clear answer on which privacy laws apply to you |
| Incident response & continuity | Incident response, business continuity and disaster recovery plans, tabletop exercises | Tested plans for bad days |
| Security awareness | Training program design and phishing simulation oversight | Staff who spot and report threats |
Frameworks
Frameworks we work with
| Framework | Who typically needs it | What we help with |
|---|---|---|
| NIST Cybersecurity Framework (CSF) 2.0 | Any organization wanting a structured security program | Maturity assessment, target profile, roadmap |
| PCI DSS v4.0.1 | Organizations that store, process or transmit card data | Scoping, self-assessment support, and the requirements that became mandatory on March 31, 2025 |
| SOC 2 (AICPA 2017 Trust Services Criteria, 2022 points of focus) | Service and software providers selling to businesses | Readiness, policy set, evidence preparation |
| HIPAA Security Rule | Healthcare providers and business associates | Risk analysis, safeguards, policies, and readiness for the proposed HHS Security Rule update |
| CIS Critical Security Controls v8.1 | Organizations wanting a practical baseline | Implementation group assessment and plan |
| COBIT 2019 | Organizations aligning IT governance with audit | Governance design and control objectives |
| ISO/IEC 27001:2022 (with Amendment 1:2024) | Organizations pursuing formal certification | ISMS design and certification readiness, including the 2024 climate-change amendment |
| NIST AI Risk Management Framework 1.0 | Any organization whose staff or products use AI | AI inventory, risk mapping, acceptable use policy, oversight controls |
| ISO/IEC 42001:2023 | Organizations whose customers or contracts require certified AI governance | AI management system design and certification readiness |
| Oklahoma Consumer Data Privacy Act (SB 546) | Businesses over the 100,000-consumer threshold, effective January 1, 2027 | Applicability scoping, data mapping, consumer request process, assessments |
AI governance
Your staff are already using AI. The policy is the part that is missing.
Governing AI is not a new discipline. It is the governance you already need, applied to a tool that moves faster than your policy library.
How it got in
In most organizations AI arrived without a decision. Someone turned on Copilot. Someone else pasted a customer contract into a chatbot to summarize it. A vendor added an AI feature to software you already licensed, and nobody reviewed what it does with your data.
None of that is reckless on its own. It becomes a problem when a customer asks how you govern AI, when your insurer adds an AI question to the renewal, or when sensitive data turns out to have left the building months ago with no record of it.
The fix is unglamorous and fast. Find out what is actually in use, decide what data may touch it, write that down in language people will follow, and put a human in the loop where the stakes justify one.
What we build
- An inventory of the AI tools and AI-enabled features actually in use, including the ones nobody approved
- An acceptable use policy that is specific about data: what may be entered, what may never be, and who decides
- Data-handling rules covering customer data, employee data, source code and anything under contract or regulation
- Vendor review for AI features in software you already own, including training-data and retention terms
- Human oversight and review requirements for decisions that affect people — hiring, credit, pricing, eligibility
- Alignment to NIST AI RMF or ISO/IEC 42001 when a customer, insurer or auditor expects a named framework
- Staff guidance people actually read, plus a route for proposing new tools
Data privacy
Oklahoma has a privacy law now. It probably does not apply to you.
The Oklahoma Consumer Data Privacy Act (Senate Bill 546) was signed on March 20, 2026 and takes effect January 1, 2027. It has been covered widely enough that a lot of Oklahoma owners assume they are on the hook.
Most are not. The law reaches businesses that, in a calendar year, control or process the personal data of at least 100,000 Oklahoma consumers, or at least 25,000 consumers while earning more than half of gross revenue from selling personal data. That is a high bar, and the majority of small and mid-sized Oklahoma businesses sit well under it.
We would rather tell you that for free than sell you a program you do not need. What we do find, repeatedly, is that the organizations under the threshold still cannot answer a simpler question: what personal data do we hold, where is it, and who can reach it? That question comes from customers and insurers regardless of any statute.
If the law does reach you
- Consumer rights to access, correct, delete and port data, and to opt out of targeted advertising, sale and certain profiling
- A 45-day response window, extendable once by another 45 days with notice
- Documented data protection assessments for targeted advertising, data sales, higher-risk profiling and sensitive data
- Attorney General enforcement only, with no private right of action
- A 30-day cure period that does not sunset, and civil penalties up to $7,500 per violation
Assessments you have already done for another privacy law may satisfy the Oklahoma requirement where the scope and effect are reasonably comparable.
How it works
A clear path from first call to lasting results
- Week 1
Scope
Confirm the frameworks, systems, deadlines and stakeholders that matter.
- Weeks 2–5
Assess
Interviews, documentation review, control testing and risk assessment.
- Weeks 5–16
Remediate
Policies, control implementation and prioritized fixes with your team.
- Before the audit
Prove
Evidence library, readiness review and auditor coordination.
- Ongoing
Sustain
Control monitoring, annual policy and risk reviews, board reporting.
Outcomes
From reactive to ready
- Audits that go smoothly, with fewer findings
- Faster answers to customer security questionnaires
- Better preparation for cyber insurance applications and renewals
- AI tools your staff can use without creating undocumented risk
- A straight answer on which privacy laws actually apply to you
- Leadership that understands its top risks
- Policies and evidence that stay current year-round
Is this right for you?
A good fit if…
- You have an audit, certification or regulatory deadline
- Customers or partners demand proof of security controls
- You handle payment card, health or sensitive customer data
- Your board wants visibility into technology risk
- You want compliance to be routine, not a yearly scramble
FAQ
Common questions
Do you perform the audit?
No. We prepare you and support you through it. The formal audit or certification is performed by an independent firm.
How long does it take to become audit-ready?
It depends on your starting point and framework. A gap assessment usually takes a few weeks; remediation can take a few months.
Can you help with more than one framework?
Yes. We map controls once and reuse them across frameworks to avoid duplicate work.
Do you keep up with regulatory changes?
Yes. We monitor updates to the frameworks and rules that affect you, such as the pending HIPAA Security Rule changes and new state privacy laws, and adjust your program before deadlines arrive.
Will our policies be generic templates?
No. We tailor every policy to how your organization actually operates.
Do we need an AI policy if we only use Microsoft Copilot?
Yes, and it is a short one. The question is not which tool you use but what data may go into it, who decides, and what happens to output nobody checks. That fits on a page or two, and having it answers most of what customers and insurers now ask.
Should we get ISO 42001 certified for AI?
Usually not. The NIST AI Risk Management Framework is voluntary and free, and mapping to it generally satisfies a customer questionnaire. ISO/IEC 42001 is worth the cost when a contract or buyer specifically requires certification. We will tell you which applies before you spend anything.
Does the new Oklahoma privacy law apply to my business?
Probably not. It reaches businesses handling at least 100,000 Oklahoma consumers in a year, or 25,000 while making more than half their revenue selling personal data. Most small and mid-sized Oklahoma businesses are under that. We will scope it with you and say so plainly if you are exempt.
What happens if we are found in violation of SB 546?
The Attorney General enforces it, and there is no private right of action. You get written notice and 30 days to cure, and that cure period does not expire. Penalties after that can reach $7,500 per violation.
Next step
Turn compliance from a burden into a business advantage.
Tell us what you need to prove and by when. We will map out the fastest responsible path to get there.
Book a GRC readiness call