Tabletop exercises, cyber reviews and compliance documentation
for healthcare, EMS, fire and government teams.
I’m Michael Messina. I spent more than 20 years in emergency healthcare, including EMS leadership. At Forward Security Labs, I help teams with cybersecurity GRC consulting, emergency preparedness, and documentation they can actually use.
I work with healthcare, SaaS, public safety, and government teams. Tell me what you’re working on, and we’ll define the scope and deliverables before work begins.
U.S. Army Combat Veteran · Afghanistan Deployment · Paramedic / EMS Supervisor, 20+ Years · B.S. Cybersecurity, Cum Laude · SBA Certified SDVOSB · Connecticut Veteran-Owned Micro Business Certified · SAM.gov Registered · CAGE 1AFL4 · UEI XLRANAT2ULJ9
Operational judgment applied to cybersecurity GRC consulting, compliance, and preparedness.
Combat deployment to Afghanistan. 20+ years in emergency healthcare as a paramedic and EMS supervisor. A cybersecurity degree earned while working full time. That background is what makes practical cybersecurity GRC consulting possible, not theoretical. The work is built around evidence requests, customer security reviews, regulatory requirements, cyber incidents, outages, emergency plans, and the moment somebody asks who actually owns the next decision.
The goal is usable documentation, clear ownership, defensible answers, realistic exercises, and a prioritized path forward. Not theoretical compliance. Not fear marketing. Work designed to survive contact with the real organization.
U.S. Army combat veteran, cybersecurity graduate, and former EMS supervisor with more than two decades in emergency healthcare.
View LinkedIn →Cybersecurity, Resilience & Preparedness Services
Start with a focused check, a fixed-scope sprint, a ready-to-run exercise, or recurring GRC support. The right entry point depends on the problem, not which package happens to have the prettiest button.
HIPAA Readiness
Risk-analysis and readiness support for healthcare organizations and business associates, with scope based on the actual ePHI environment.
- Free informational readiness check
- HIPAA readiness sprint: $1,500–$3,500
- Broader compliance buildout scoped separately
SOC 2 Readiness
Readiness, documentation, evidence, and remediation support before a formal SOC 2 examination by a CPA firm.
- Free informational readiness check
- SOC 2 readiness sprint: $1,500–$3,500
- Ongoing evidence and GRC support available
Tabletop Exercises
Ready-to-run Gumroad packages, facilitated exercises, custom scenarios, and regional exercise programs for healthcare, public safety, government, and business continuity.
Need planning beyond one exercise? See emergency preparedness consulting.
- Ready-to-run packages: $499
- Virtual facilitated exercises: from $999
- Custom and regional programs available
Ongoing & Fractional GRC Support
Recurring ownership of risk registers, policies, vendor risk, evidence, questionnaires, continuity, and readiness work without another full-time hire.
Need a defined documentation project? See cybersecurity documentation services.
- GRC Rescue Sprint: $1,500–$3,500
- Monthly support from $2,500
- Founder-led, implementation-ready support
Security Questionnaire Support
Questionnaire and vendor-assurance support built from client-confirmed facts, existing controls, and available evidence.
- Questionnaire support from $250
- Managed vendor assurance from $750
- Client approves factual responses before submission
Fire & EMS Cyber Readiness
Cybersecurity and operational-readiness support for fire departments, EMS agencies, and regional systems that depend on dispatch, ePCR, communications, vendors, field devices, and continuity procedures.
- Fire department focused review: $749
- EMS Cybersecurity Assessment: $995
- Regional EMS cyber resilience programs
CMMC Readiness
Practical cybersecurity GRC consulting for defense contractors and subcontractors, including readiness, scoping, evidence, documentation, SSP, POA&M, and remediation support.
- Readiness sprint: $1,500–$3,500
- Level and scope determined from actual requirements
- FSL is not a C3PAO
AI Governance & Readiness
Policy, vendor-risk, governance, and operational-readiness support for organizations adopting AI tools without clear ownership or control boundaries.
- AI usage and governance policy support
- Vendor and use-case risk review
- Governance reviews and incident exercises
Most organizations do not fail because nobody cared.
They fail because ownership is unclear, evidence is scattered, dependencies are assumed, and the plan has never been tested under pressure.
Nothing Is Documented
Critical practices live in people’s heads. When a customer, auditor, regulator, or incident asks for evidence, the organization has nothing reliable to show.
Deals Stall in Review
Questionnaires take too long, evidence is inconsistent, and vague answers create avoidable friction during enterprise customer review.
No One Owns the Disruption
A vendor fails, ransomware hits, or a key employee disappears. The first hour is spent figuring out who decides what instead of executing a plan.
The Plan Was Never Tested
Policies and continuity plans can look excellent on paper. A useful tabletop exercise exposes the assumptions before a real event does.
Organizations that cannot afford to improvise everything.
Healthcare
Hospitals, clinics, practices, business associates, and healthcare-adjacent organizations needing HIPAA, preparedness, and GRC support.
EMS & Fire
Emergency-services organizations needing cyber readiness, continuity, HIPAA risk work, or realistic exercise design.
SaaS & Technology
Teams facing SOC 2 readiness, customer questionnaires, vendor-risk requests, and recurring evidence demands.
Government & Defense
Contractors and public organizations needing readiness, documentation, resilience, or exercise support within a defined scope.
Growing Businesses
Organizations with meaningful risk and customer obligations but no full internal GRC department. FSL can align work to recognized guidance such as the NIST Cybersecurity Framework where appropriate.
Prime Contractors & Partners
Primes, MSPs, MSSPs, vCISOs, and consultancies needing defined subcontract, overflow, white-label, or surge work.
Do not discover the gap
during the incident, audit, or customer review.
Use a free readiness check for an initial screen, buy a ready-to-run tabletop package when you want a structured exercise, or put recurring governance work under one owner with ongoing GRC support. FSL provides hands-on cybersecurity GRC consulting when the problem needs more than a template or automated score.
Describe the outcome you need.
Start without sending PHI, CUI, passwords, customer data, production exports, or other restricted information. FSL will confirm scope, required inputs, pricing, and appropriate data handling before the engagement begins.
Useful reading before somebody turns the acronym into a crisis.
EHR Downtime Procedures: What to Put in Writing
Who declares downtime, what to print before the outage, how orders move on paper and how it all gets entered back in.
Read the guide →What Is Fractional GRC? When the Work Is Real but the Department Is Not
A practical field guide to recurring compliance work, ownership, and when fractional support makes sense.
Read the article →What Is a HIPAA Security Risk Assessment and Do You Need One?
What the Security Rule risk-analysis requirement actually means and where a readiness process begins.
Read the article →EMS Agencies and HIPAA Compliance: What You Need to Know
Mobile, distributed EMS workflows create compliance questions a clinic-oriented checklist can miss.
Read the article →Small Businesses Are Not Ready for Business Email Compromise
Why trusted-looking payment requests and vendor changes deserve a tested verification process.
Read the article →Prefer a self-serve starting point? Ready-to-run tabletop exercises, templates, checklists, and continuity tools are available as digital products.
Browse FSL Products →Looking for cybersecurity career help or resume audits?
Visit Forward Career Labs →Forward Security Labs provides consulting, readiness, documentation, risk, and exercise support. Services do not constitute legal advice, independent certification, a SOC 2 examination, a CMMC certification assessment, or a guarantee of compliance, security, customer approval, procurement outcome, audit result, or incident prevention. Final scope, pricing, responsibilities, data handling, assumptions, and deliverables are controlled by the applicable written engagement terms.