Brian Geis, CISSPSecurity and Compliance Documentation

How I Work

I work as a subcontractor to firms that deliver security and compliance documentation to their clients: compliance and readiness consultancies, CMMC RPOs, vCISO practices, and managed service providers with more to write than time to write it.

What I Take On

Policy sets. Policies and procedures written to a framework, and sized to the organization that has to follow them.

Control mappings. Settings, systems, or documents mapped to a framework's controls, with the reasoning shown and the gaps stated.

System security plan narratives. Control implementation statements, written from your description of the system.

Remediation. Documentation produced by a platform or a template, rewritten to describe what the organization actually does and to answer the questions an assessor will ask.

For NIST SP 800-53, NIST SP 800-171 for organizations preparing for CMMC Level 2, SOC 2, and ISO 27001.

Under Your Name

Your template, your house style, and your name on the deliverable. I write to the format your clients already receive, and the finished document goes out as yours. The client relationship stays yours: I work through you, and I don't approach your clients.

Fixed Fees

Every deliverable is quoted as a fixed fee, agreed in writing before work starts. You know the cost before you commit, and nobody tracks hours. The written scope states what's included, so a larger or smaller version of the same deliverable is a different quote rather than a surprise.

If you'd like to see how I work before committing to a set, start with one document.

How an Engagement Runs

  1. A conversation. By call or by email, whichever suits you: the deliverable, the framework, your client's environment, your template, and the deadline. If you want an NDA in place first, send it and I'll return it within a business day.
  2. A written scope. What I'll deliver, the fee, the delivery date, and what I need from you.
  3. A draft. Written in your template, with questions for your client marked where they arise.
  4. Two review rounds. Each round is one consolidated set of comments from you. Further rounds, and changes of scope, are quoted separately.
  5. Delivery. The final document in your format, ready for your client.

From you, I'll need your template and style guide if you have them, the organization's facts (its size, who administers what, and which tools are in use), any existing documentation, and one person who can answer questions.

Confidentiality, AI, and CUI

Confidentiality. I'll sign your NDA before we discuss scope. Each engagement's material is held in its own encrypted container, under its own key, and returned or destroyed on the terms we agree.

AI. I use AI tools for verification and consistency checking: reconciling counts, testing cross-references, and catching terminology drift. Client material goes into an AI tool only where our agreement permits it, and never material containing CUI.

CUI. I don't take CUI into my environment. Where a deliverable needs it, I work inside yours, or from material you've sanitized.

Getting Started

Email brian@briangeis.com with the deliverable, the framework, your deadline, and whether you have a template. I reply within one business day.