Compliance Baseline
Establish a defensible starting point with a risk assessment, core policies, incident response planning, and vendor review.
Security Leadership
A security leader who owns the next step.
Fractional CISO leadership, risk assessment, and program development for organizations that need clear decisions and evidence they can show.
Send us a messageFractional CISO engagements
A named advisor works with your leadership team to set priorities, establish accountability, and turn security gaps into a manageable plan.
Ongoing Advisory
Maintain program direction with leadership updates, vendor oversight, risk tracking, and a recurring review cadence.
Strategic Program
Build and guide a broader security program aligned to organizational priorities, obligations, and measurable work.
HIPAA Security Risk Assessments
Document where electronic protected health information lives, evaluate safeguards, prioritize gaps, and create an actionable remediation record. Assessments can support a new program, a partner review, or a scheduled refresh.
Program development & compliance
Program work can include written policies, risk registers, vendor oversight, incident response, workforce awareness, and executive reporting. Support spans security frameworks, assurance standards, and privacy and safeguard requirements:
NIST CSFNIST 800-171 / DFARSCIS ControlsISO 27001SOC 2PCI DSSSOXCMMCHIPAA / HITECHGDPRCCPAVirginia CDPAFTC Safeguards Rule / GLBAIRS Safeguards
Insider-risk program development & leadership
Kenneth Vignali brings extensive insider-risk experience spanning 20 years across the companies he has worked for, including building and leading programs. That career-wide experience informs advisory work for organizations developing a new program or strengthening an existing one.
Address malicious, negligent, and compromised insider risk through clear governance, accessible reporting pathways, workforce awareness, appropriate access oversight, and proportionate monitoring. Program choices should account for privacy, organizational context, and a documented response process.
Privacy advisory
Build privacy-aware security practices and clear procedures for sensitive information, workforce concerns, and incident response. Support includes GDPR, CCPA, Virginia CDPA, HIPAA / HITECH, GLBA, and applicable FTC and IRS safeguard requirements.
Work can include privacy-program assessments with written findings, privacy notices and policies, consumer-rights procedures, vendor data-processing agreement and BAA reviews, breach-response preparation, written information security plans, and workforce privacy training.
For personal privacy needs, explore secure phones, safer communications, and privacy cleanup.
AI governance
Establish practical governance around AI use, security considerations, data handling, and accountable organizational decision making.
Direct, evidence-led leadership
Decisions and work products are explained in plain language. SPM Advisors can also select, configure, and oversee managed protections as an extension of the leadership relationship.
Ready to get clarity?
Bring the question, deadline, or document that prompted the referral. We will help determine the useful next step.
Send us a message