Built by a paramedic and EMS supervisor with 20+ years in emergency healthcare · B.S. Cybersecurity, Cum Laude · SBA Certified SDVOSB
GRC Consulting FAQ: Trust and Credibility
Why should I trust a one-person consulting shop over a big firm?
Because you talk to the person actually doing the work, every time. No account manager, no junior analyst doing the assessment while a partner signs off, no handoff between sales and delivery. The person who built the FSL website, the assessments, and the exercise packages is the same person who answers your email and does your work. That accountability does not exist at most large firms.
What if you’re not around when I need ongoing support?
Fair question for any small firm. Every engagement includes a defined deliverable and, where relevant, a defined support window after delivery. Tabletop exercises include 30 days of post-program access. Assessments include a remediation roadmap built so you are not dependent on ongoing hand-holding to act on the findings. The work is built to outlast any single conversation.
What makes you different from any other GRC consultant?
Most GRC consultants have never run an actual incident. The person behind FSL is a paramedic and EMS supervisor with 20+ years in emergency healthcare and a U.S. Army combat veteran with a deployment to Afghanistan, in addition to a B.S. in Cybersecurity. That background shapes how risk, incident response, and preparedness work gets approached here. It is operational experience applied to compliance documentation, not theory applied to a checklist.
FSL’s SDVOSB status is verified through the SBA’s Veteran Small Business Certification program, not a self-issued claim.
Getting Started
We’ve never had a risk assessment before. Is that a problem?
No. Most organizations FSL works with are doing this for the first time. The intake process is built to surface what exists and what doesn’t without requiring you to already know HIPAA terminology or have documentation ready in advance. Starting from zero is normal, not a red flag.
Do I need to get on a call to start?
No. Everything at FSL is designed to run async. Send an email, fill out an intake form, get a written response. No scheduling, no meetings, no waiting on a calendar to line up. If a call genuinely becomes necessary for a specific complex engagement, it will be discussed, but it is never the default.
How long does an assessment or exercise actually take?
A HIPAA Security Risk Assessment typically takes one to two weeks from completed intake to delivered report, depending on organization size and complexity. A ready-to-run tabletop exercise package is instant download. A custom-built exercise is typically delivered within 10 business days of a completed intake form.
What if our organization is small or has a tight budget?
FSL was built with small organizations in mind. Pricing reflects that, from free assessment tools and low-cost templates up through full engagements. If a full assessment is not in budget yet, the free SOC 2 and HIPAA readiness checks or the self-serve policy templates are a real place to start without spending anything.
Working Together
Will the findings actually be specific to us, or a generic report?
Every finding traces back to something specific identified during intake or system review. Generic findings that could apply to any organization do not go in the report. If a finding cannot be tied to something specific about how your organization actually operates, it gets cut.
What happens to our information during an engagement?
Information shared during intake and assessment is used solely for the purpose of completing the engagement. It is not shared, sold, or reused for any other purpose. If a business associate agreement is appropriate for your engagement, that is established before any PHI changes hands.
Can FSL support us on an ongoing basis, not just a one-time engagement?
Yes. Beyond one-time assessments and exercises, FSL offers a recurring program for organizations with ongoing regulatory or accreditation requirements, including quarterly exercises and annual resilience assessments. Reach out to discuss what an ongoing relationship would look like for your organization.
Still Have a Question
Ask it directly.
No phone call required. Send a quick email and you’ll get a real answer.
Email Michaelmichael@forwardsecuritylabs.com · Direct. No sales team. No handoff.
Forward Security Labs / Forward Career Labs LLC · Wolcott, Connecticut ·
ForwardSecurityLabs.com ·
SBA Certified SDVOSB · SAM.gov Registered · CAGE: 1AFL4