Senior technology and security leadership for small and midsize businesses, without the cost of a full-time executive.
For owner-led firms answering insurance and client security questions, teams outgrowing their IT setup, and defense contractors handling CUI.
vCIO Advisory, for businesses with internal IT.
Your team keeps everyday support. We bring the roadmap, the budget and vendor decisions, and help with problems that need deeper expertise.
Fractional CISO.
One accountable owner for your security program, whether you are answering insurance and client security questionnaires or working toward CMMC Level 2.
Fractional CIO.
A senior technology leader in your leadership meetings, accountable for the roadmap and reporting to the owner or board.
Fewer manual steps, same people.
We build automations for the repetitive work that eats your team's week: moving data between systems, intake and paperwork, reporting and reminders. Every build starts with a clear business case and ends with something your team understands and can run.
We agree the workflow, the data it may touch, milestones, acceptance criteria and where a person reviews the result before anything goes live.
A fixed-scope review of the systems your business runs on: accounts and access, devices and endpoint protection, backups, email and file sharing, and who owns IT and your vendors. It ends with a walkthrough and a prioritized plan you can act on with us, your own team or another provider.
Not theoretical.
Brassrook's founders led a fully remote organization through a passing CMMC audit, with no on-premises work. A fractional CISO from Brassrook owns your security program and the evidence assessors ask for, on-premises or in the cloud.
CUI stays in your own Microsoft 365 GCC High, Azure Government or AWS GovCloud tenant, or on systems you own, never on ours. Your senior official signs any affirmation or SPRS submission. Brassrook does not conduct C3PAO certification assessments or guarantee certification.
For contractors handling CUI.
Every NIST SP 800-171 requirement assessed against a defined boundary, with the documents your self-assessment or certification assessment depends on.
Build, migrate or modernize an environment, including controlled environments for CUI built inside your own tenant. The project includes agreed deliverables, documentation and an acceptance process, followed by handoff to your team or separately agreed recurring support.
Infrastructure and automation projects are available without an ongoing management agreement.
We review your needs and current environment, check delivery capacity, and agree the responsibilities, scope and commercial terms.
We define milestones and acceptance criteria, carry out the scoped work and document the resulting environment.
We complete the agreed acceptance and handoff process. Where recurring support is part of the engagement, it begins at production handoff.
Our standard environments center on Google Workspace or Microsoft 365, with managed identity, endpoints and security. If your environment falls outside these standards, we agree what we can support and the additional work required.
Your licenses and cloud services remain customer-owned. Third-party licensing and cloud costs are separate from management fees.
Use tickets and email for routine requests. Work is scheduled within the service hours agreed in your engagement, with response targets defined in your agreement. Most delivery is remote and async-first. For on-premises environments, on-site work is scheduled as your engagement requires.
Escalation arrangements and response targets are defined in your agreement. Critical security incidents receive priority. After-hours emergency work is separately agreed and billed.
Onsite work is separately scoped and billed, including travel.
Standard service does not include immediate response or a 24/7 human help desk. Home Wi-Fi, consumer devices and routine printer support sit outside the standard scope.
Assessments are fixed-scope and quoted before work begins. Ongoing leadership is a monthly fee for a defined scope. Projects are quoted separately. We agree the scope, fees and third-party costs before any work starts.
We review the environment, agree the implementation plan and define the handoff. Implementation is billed 50% at signing and 50% on completion. Recurring support starts at production handoff.
Yes. Infrastructure and automation projects can stand alone without an ongoing management agreement. If you have internal IT, we can build and document the work, then hand it back to your team.
No. Most of our work is IT and security leadership for small and midsize businesses facing insurance requirements, client security questionnaires or a growing technology footprint. For defense contractors, we add hands-on CMMC and NIST 800-171 experience.
Day-to-day support can be included as a bounded part of a leadership or security engagement. If you need a full help desk, we will tell you and point you to providers who specialize in it.
Briefly describe your business, your current IT setup and what you need help with. We review initial inquiries and follow up to discuss fit, scope and availability. Services are available now, subject to fit and capacity.
