Cybersecurity Consultants near you

For most private businesses the default reference is the NIST Cybersecurity Framework 2.0, published in 2024. NIST describes it as a taxonomy of high-level cybersecurity outcomes usable by any organization regardless of size, sector or maturity, and stresses that it does not prescribe how the outcomes are achieved. It has six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was new in 2.0 and covers how cybersecurity decisions get made, which is where most small-company programs are weakest.

If you hold controlled unclassified information for a federal agency, the reference is NIST SP 800-171. Revision 3 was finalised in May 2024 and organises requirements into seventeen families, from access control and audit to supply chain risk management. It is written for nonfederal systems, which is exactly the position a contractor is in.

Defence work adds the Cybersecurity Maturity Model Certification. As of the Department's July 2026 announcement, Phase II requirements were suspended and a reform task force established, while Phase I self-assessment requirements remain in place; during the pause the Department enforces compliance with NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments. Level 1 covers fifteen requirements from FAR clause 52.204-21 with an annual self-assessment; Level 2 covers the 110 requirements of SP 800-171 Revision 2 required by DFARS clause 252.204-7012, with results entered into the Supplier Performance Risk System. A consultant working in this space should be able to state the current position without hedging.

A real assessment starts with a scope document naming the systems, locations, cloud tenants and business units included, and just as importantly the ones excluded. Vague scope is how two firms produce wildly different quotes for what looks like the same job.

The fieldwork is interviews plus evidence. A consultant asks how accounts are provisioned, then asks to see the last ten accounts created. They ask about backups, then ask for the last restore test record. Anything accepted on assertion alone is an opinion, not a finding, and a good report distinguishes the two.

The deliverable should be a findings register you can work from: each gap tied to a control reference, a severity, a recommended fix, an estimate of effort and a named owner. A plan of action with milestones is the form federal work expects and it is a sensible shape for anyone. Be wary of a report that is mostly scanner output with a cover page, and of one whose every recommendation happens to be a product the consultant resells.

A vulnerability scan is automated. It compares software versions and configurations against a database of known issues and returns everything it matches. It is cheap, repeatable and noisy, and its output needs a human to separate the real exposure from the theoretical.

A penetration test is manual work on top of that. A tester chains weaknesses together to show what an attacker could actually reach, and documents the path with evidence. The value is in the chain, not the individual findings. Ask how many days of hands-on testing are included, because a one-day test that produces a fifty-page report was mostly a scan.

A red team exercise measures your detection and response rather than your patching. The team works toward a defined objective over a longer period and tries to stay unnoticed, and the interesting result is whether anyone spotted them. It only makes sense once monitoring exists, which is why buying one first is usually money spent proving a gap you already knew about.

Testing involves deliberately attempting unauthorised access, so it needs authorisation in writing from someone with authority to give it. The scope should list the exact addresses, domains and applications in play, the testing window, the techniques excluded and an emergency contact on both sides.

If the systems are hosted, the hosting provider's own terms may govern what testing is permitted and how it must be notified. That is a question to settle before the test starts, not after a provider's abuse team notices traffic.

Social engineering and phishing simulations raise employment questions as well as technical ones, because they involve testing your staff. Decide in advance who is told, what is recorded, and whether individual results are reported to managers. Those decisions belong in the engagement letter, and your own employment counsel is the right person to review them.

CISA maintains the Known Exploited Vulnerabilities catalog, an authoritative list of vulnerabilities it has confirmed are being exploited in the wild, and recommends organizations build it into how they prioritise remediation. It is a short, evidence-based list rather than the whole universe of published vulnerabilities, which makes it genuinely useful for deciding what to fix this week.

The associated binding operational directive applies to Federal Civilian Executive Branch agencies, not to private companies. BOD 26-04 requires those agencies to remediate on a risk-based schedule, with the shortest timeline reserved for publicly exposed assets carrying automatable exploits that grant total control and appearing in the catalog. Private firms are not bound by it, but the logic of the model, exposure plus confirmed exploitation plus impact, is worth borrowing.

A consultant who hands you every scanner finding sorted by a generic severity score has not done the prioritisation you were paying for. Ask for the internet-facing, actively exploited items first, then everything else.

Reporting obligations in the United States stack rather than replace each other. CISA is working on the final rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which sets a 72-hour window for covered cyber incidents and 24 hours for ransom payments by covered entities; until that rule is in effect CISA says reporting remains voluntary and encourages it. Confirm the current status rather than assuming.

Public companies have a separate duty. Under the SEC's rules, a registrant discloses a material cybersecurity incident on Form 8-K Item 1.05, generally within four business days of determining the incident is material, and describes its cybersecurity risk management, strategy and governance annually under Regulation S-K Item 106.

Then there is the state layer, which reaches almost everybody: the FTC notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have breach notification legislation covering personal information. A retainer that includes counsel and forensics is worth more than one that includes only technical cleanup, because the notification decisions are where the cost and the exposure sit.