The things you'd rather not have to ask me on a call.

We've never had one done. Is that going to be a problem?

No, and it doesn't change the price or the timeline. Most first engagements start exactly there.

Don't clean anything up before I get there, either. A version of your setup arranged for a visitor tells me nothing useful about the one your staff works in every day.

Do you sign a BAA?

Yes, before work starts, any time the engagement goes near protected health information. Use your own form if you'd rather. I don't have a problem with yours.

Will this satisfy our funder, or our cyber insurance carrier?

Usually. Send me the actual request before you sign anything, though.

Funders and carriers word these badly and inconsistently. Every so often what's being asked for is a penetration test or a SOC 2 report, which is a different engagement at a different price. Better you hear that from me on a free call than after an invoice.

Can we pay for it out of grant funds?

Often, yes. Compliance and internal-control costs are generally allowable under 2 CFR 200, and I itemize invoices so they attach cleanly to a drawdown.

Clear it with your grants or program officer first. Allowability comes down to your specific award terms, and they're the ones who actually know them.

What happens if you find something serious?

It goes in the report, ranked, with what it takes to close.

I'm not a regulator and I report findings to nobody. The assessment is yours and the confidentiality terms in your engagement letter say so.

If something is actively dangerous you hear about it the day I find it. I'm not going to sit on a live problem for three weeks so it can land dramatically in a PDF.

Are you going to sell us software afterward?

No. I resell nothing, take no vendor referral fees, and have no managed services arm. That's the entire reason my findings are worth anything to you.

When a gap does need a product, I'll tell you what the product has to do and leave the shopping to you and your IT provider.

Our staff uses AI tools. Does that change the assessment?

It should, and in most assessments it doesn't. Ambient scribes, chart summarizers, and whatever someone is quietly pasting into a chatbot all touch data that's in scope.

I inventory where AI actually reaches your data, check vendor terms against the agreements you signed, and write the governance policy your board adopts. Standalone, or folded into a Security Risk Analysis.

Do you work outside Oklahoma?

Routinely. HIPAA, 42 CFR Part 2, 2 CFR 200, and the FTC Safeguards Rule are all federal, and most of an engagement runs on secure document review and video.

Tulsa is home base, so that's where on-site work is easiest to schedule. State lines don't constrain the rest of it.

How much of our team's time does this take?

Four to six hours total, spread across three weeks. Interviews, a document request list, a few control walkthroughs.

Nobody needs to clear a calendar for me. If your team is losing whole days to an assessment, something has gone wrong with it.

Can we see one before we commit?

Yes. I send a redacted sample report on request. No form to fill in, no drip sequence afterward. Ask me for it and it turns up in your inbox.

What is the fractional CIO thing, exactly?

Standing availability instead of a document once a year. Email, phone, and text answered inside a defined window. Vendor contracts read before you sign them. Board and funder questions answered, in writing or in the room. Somebody who already knows your environment picking up on the first call of an incident rather than the fourth.

$2,799 a month at the founding-client rate, up to ten hours, three-month minimum and then month to month. Honestly, most organizations need this far more than they need another report.

Why can't we just start with the retainer?

Because advising an organization I haven't assessed is guessing, and you'd be paying me every month for guesses.

Every fractional engagement starts with an assessment. It isn't an upsell — your assessment fee comes off your first month. After that I know your environment and everything moves quickly.