Security work is judged twice: once by whether it prevents the incident, and once by whether the file holds up afterwards. We build for both. Our approach treats security as a strategic enabler rather than a business constraint — but the test of the program is the same test a regulator, an insurer, or a court applies: can you produce the evidence.
This practice covers the technical and program side. Where the same obligation is a governance or examination question — enterprise risk, vendor programs, control testing — see Risk & Compliance. Where it is an operating-model question, see Strategy & Operations. The pages should not be collapsed into one noun.
01Security strategy and architecture
A security strategy that is not anchored to a named obligation is a wish list. We start from what actually binds the organization — the regulation an examined entity answers to, the security terms a vendor owes a regulated buyer, the control standard a defense supplier has to meet, a funder’s data conditions for a grantee — and design the control set that answers it.
Architecture follows the risk register, not the other way around. Identity and access, network and workload boundaries, logging and retention, encryption in transit and at rest, and the segmentation decisions that determine how bad an incident can get. Each choice is written down with the reason, because the reason is what an examiner asks for.
Where an organization is small, we say which controls it can realistically operate and which it should buy or outsource. A design that assumes staff the organization does not have is not a design.
02Cyber risk management
Risk work here is quantitative enough to be useful and plain enough to be read. What the exposure actually is, what a realistic loss looks like, what a control costs, and what to do first — in a document an executive committee can act on in one sitting.
We keep the register tied to the organization’s real shape: a single administrator who can move funds, a vendor holding production data, an OT boundary that was never really a boundary, a backup nobody has restored. Each risk gets an owner, an existing control, a residual rating, and a decision the committee can record.
Testing cadence is part of the program, not an afterthought. Penetration testing and vulnerability scanning on a stated schedule, with findings that close or get accepted in writing.
Judged twice
Once by whether it prevents the incident, and once by whether the file holds up afterwards. We build for both.
03Privacy compliance
Privacy work starts with an inventory: what you collect, where it lives, who can see it, how long you keep it, and what notice you owe if it leaves. We build that inventory, the retention and disposal schedule, and the notice decision tree for the jurisdictions you actually operate in.
Then we make the public artifacts match the practice. A privacy policy that describes a comment system the site does not have is not a privacy program; it is a liability that a counterparty will notice. If a regulator or a client’s procurement team asks for the program, the documents should already exist.
Breach notice is where privacy meets the clock. We write the decision tree against the obligations that apply — including the short notification clocks that start running the moment something is discovered — and we name who has authority to make the call at 9pm on a Friday.
04Technology innovation and integration
Most organizations do not need custom software. They need the right platform configured properly, integrated to the systems of record, and operated by someone who will still be there next year. Cloud and SaaS have made that cheaper than building — and the failure mode has moved from “we could not build it” to “we bought something nobody owns.”
We advise on the build-versus-buy decision, the integration and identity model, data residency and retention, and the exit: what happens to your records if you leave the vendor. For grant-funded organizations we put federal procurement rules in the first draft, not in an appendix.
05Digital transformation
On this page, digital transformation is the technology, identity, and security-control design of a change. The operating-model half — decision rights, process ownership, and how the board will know the change worked — lives on Strategy & Operations.
The two have to be run together or the control environment quietly degrades during the cutover. A finance-system migration that moves the data but loses the approval trail has not modernized anything; it has removed the evidence.
Where federal policy is moving underneath a sector — the energy-sector cybersecurity executive order, EO 14409 and the CISA directives that followed — we say what it actually requires of a non-federal entity, and what it does not.
Sosa & Arvelo, LLCNext step
Tell us what you’re facing.
A 30-minute conversation, no charge, no obligation. We will tell you whether an assessment is the right next step, whether we are the right firm — and if we are not, who is more likely to be.