Security Consulting
Security leadership and compliance readiness, scoped and capped.
Fractional CISO, readiness for SOC 2, CMMC, HIPAA, CCPA, and cyber insurance, tenant hardening, and incident response planning. Delivered by the same engineers who run managed security, under written scopes with a cap.
Bayport Networks provides security consulting from San Francisco with a 100% U.S.-based team, delivered remotely and on site. Services cover fractional security leadership, risk assessment, compliance readiness for SOC 2, CMMC and NIST SP 800-171, HIPAA, CCPA and CPRA, and cyber insurance, Microsoft 365 and identity hardening, third-party risk review, policy development, security awareness training, incident response readiness, penetration test coordination, and due diligence support. Bayport has operated as a managed security provider since 1997.
Audits, insurers, and customers all ask the same question. Most companies cannot answer it in writing.
Who owns security, what controls are in place, and where is the evidence. A SOC 2 auditor, a cyber insurer, a defense prime, and an enterprise customer's vendor questionnaire all want the same documentation. Companies without a security leader answer each one from scratch, under deadline, with whoever is available. Consulting fixes the answer once and keeps it current.
What we do
Security leadership
vCISO
Fractional security leadership on a monthly retainer: a risk register that is reviewed, policies that have an owner, vendor reviews that happen, and reporting your board, auditor, and insurer can read. The retainer is capped and the lead is named.
Security risk assessment
A point-in-time review against NIST CSF or CIS Controls, scored, with a remediation roadmap in priority order. The usual first step before a vCISO retainer or a compliance program.
Security policy development
Policy sets drafted for your counsel and leadership to adopt: information security, acceptable use, access control, incident response, vendor management, data handling. We provide the drafts and technical input. You own the policy.
Compliance readiness
SOC 2 readiness
Scope definition, control mapping, evidence collection design, and auditor selection support, so the first audit is a confirmation rather than a discovery.
CMMC and NIST SP 800-171 readiness
Gap assessment against the 110 controls, System Security Plan and Plan of Action drafting, SPRS score preparation, and remediation support for contractors and subcontractors in the defense supply chain. Readiness and remediation only. Certification assessments are performed by accredited third parties.
HIPAA security rule readiness
Risk analysis, administrative, physical, and technical safeguards review, business associate inventory, and the documentation insurers and auditors ask for. For clinics, dental practices, and the vendors that serve them.
CCPA and CPRA cybersecurity readiness
Preparation for California's cybersecurity audit and risk assessment requirements as they phase in. Scope determination, control gap review, and the written record the regulations call for.
Cyber insurance readiness
Application review before you sign it, evidence for the controls insurers now require, and remediation of the gaps that cause denied claims. Pairs with the readiness quiz on the compliance page.
Technical hardening
Microsoft 365 security hardening
Tenant baseline: conditional access, Defender configuration, Purview labeling and DLP, sharing and guest controls, audit logging, and the admin role cleanup most tenants never had. The same work that prepares a tenant for AI.
Identity and access review
Identity provider migration and cleanup, MFA enforcement, privileged access review, service account inventory, and offboarding controls tied to HR so access actually ends when employment does.
Penetration test coordination
Scoping, vendor selection, test oversight, and remediation tracking. Bayport manages the test and closes the findings. The test itself is performed by an independent firm.
Risk and resilience
Third-party and vendor risk review
Data processing agreement and subprocessor review, SOC 2 report review, data region and transfer checks, and a vendor register your compliance function can maintain.
Security awareness training
Recorded or live training with completion tracking, including role-specific modules and training that gates access to sensitive systems or AI tools.
Incident response readiness and tabletop
Incident response plan, escalation procedure and call list, managed security provider coordination, and a tabletop exercise with leadership so the first real incident is not the first rehearsal.
Due diligence support
Security documentation and questionnaire response for venture financing, M&A, and enterprise customer security reviews. Written once, maintained, reused.
How a security engagement runs
Every engagement starts with a written scope, a dollar cap, a named lead, and acceptance criteria. Assessments and readiness projects are delivered in gated phases with written deliverables. vCISO runs as a monthly retainer with a cap and an hours report. Weekly written status on every project. We stop before the cap is reached and consult before continuing.
Findings that need to be operated, not just documented, move to managed security. See Net.Protect.
Who this is for
- Companies with no security leader and a customer, auditor, or insurer asking who owns it
- Software and biotech companies facing a first SOC 2 or a financing due diligence
- Contractors and subcontractors in the defense supply chain preparing for CMMC
- Healthcare practices and their vendors with HIPAA obligations
- California businesses preparing for CCPA cybersecurity audit requirements
- Any company whose cyber insurance renewal arrived with a new control checklist
What we do not do
Bayport does not perform SOC 2 audits, CMMC certification assessments, or penetration tests. We prepare you for them, coordinate them, and close the findings. We do not provide legal or regulatory determinations. Policy and compliance decisions stay with you and your counsel.
Where we have done this
Life sciences, public company
Microsoft 365 tenant hardening and data governance across priority repositories, third-party data processing review, policy drafting for counsel, and security awareness training with completion tracking that gated access to a new AI platform.
Healthcare practice
HIPAA safeguards documentation prepared for a cyber insurance renewal, with the control evidence the insurer required. Documentation accepted and the policy renewed.
Construction
Incident escalation procedure and call list written for a general contractor under managed security, with the managed detection provider's response path documented for leadership.
Aerospace and advanced engineering
Export-controlled data identified and access boundaries set before platform engineering access was granted, with security monitoring handled under managed security.
Frequently Asked Questions
A virtual or fractional chief information security officer is a senior security leader engaged on a part-time retainer to own the security program: risk register, policies, vendor reviews, and reporting to leadership, auditors, and insurers. Bayport delivers it with a named lead, a monthly cap, and an hours report.