Common questions

Identity governance and access management. Together with your team, we discover how users (internal and external) get into your systems, check how each application handles sign-in, SSO and MFA, design the policies that decide who gets access, and close with a gap and risk report.

As an independent contractor brought in for a defined engagement. Every use case is unique, so we start with your working environment, identify the risks, then custom build an approach that satisfies compliance without disrupting operations. Your business sets the pace of implementation.

Organizations that want independent identity expertise for a defined engagement, without relying only on internal resources or a vendor's guidance. Clients have included the federal government, healthcare, non-profits, franchisors, food manufacturing, game development, startups, and companies going through mergers and acquisitions.

The work spans the major identity platforms, including Microsoft Entra ID and Active Directory, Okta, SailPoint, Saviynt, and the identity services in AWS, Azure and Google Cloud. No matter what applications your environment has or needs, we have a proven approach to set you up for success.

Yes. Audit preparation and compliance are a big part of the work. We map your access controls to frameworks such as SOX, ISO and NIST, and build on the systems of record you already have. That prepares you for the current audit and sets up a process that produces the artifacts for future compliance requests. The gap and risk report also records any risk your business accepted along the way.

I am your main point of contact on every engagement, and most engagements need no one else. When a proprietary system needs its own technical expert, that person is brought in only with your approval, and all identity work still comes through me.

Use the contact form and give a short description of what is going on. I'll reply with a calendar invite so we can get on a call and talk through your needs.

Every engagement with a previous client is private, and no proprietary or privileged information is ever shared with other clients or prospective clients. I can, however, talk about approaches that worked for similar organizations in your industry, and use those examples to show how they apply to your project.