Founder of FA Consulting | Fractional COO | Developing high performing teams | Startup Advisor | Board Member

At Almeshaan Consulting, we drive organizational effectiveness for high-growth companies by aligning organizational goals, setting up structured performance management systems, and providing leadership development and management training.  

Services:
- 𝐅𝐮𝐥𝐥 𝐓𝐞𝐚𝐦 𝐀𝐥𝐢𝐠𝐧𝐦𝐞𝐧𝐭: Set clear, measurable objectives and key results to guide every team member’s efforts and ensure everyone understands their role in achieving company goals.

- 𝐋𝐞𝐚𝐝𝐞𝐫𝐬𝐡𝐢𝐩 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐦𝐞𝐧𝐭 & 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠: Equip your leaders and managers with the skills to lead effectively, from decision-making to people management.

- 𝐎𝐩𝐭𝐢𝐦𝐢𝐳𝐞 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 𝐰𝐢𝐭𝐡 𝐂𝐮𝐭𝐭𝐢𝐧𝐠-𝐄𝐝𝐠𝐞 𝐒𝐲𝐬𝐭𝐞𝐦𝐬 𝐚𝐧𝐝 𝐀𝐈: Develop systems to meticulously monitor and track critical metrics, ensuring your targets are met efficiently.

Curious how you can drive your team's performance? Reach out at faye@almeshaan.co

Faye Almeshaan

We help startups and SMBs strengthen their cybersecurity and compliance. Our 'One Scalable Plan' is designed for companies that are looking for flexibility. It can quickly be adjusted to keep up with requirements as they evolve. The plan includes strategy, assessments, and enhancements so clients can close deals while avoiding fines, penalties, and lawsuits. 

For CMMC, FedRAMP, or SOC 2 prep, we handle most of the work so your team can focus on other priorities. I also co-host The GRC Room, a monthly LinkedIn Live series featuring leading voices in cyber GRC. If you're a startup or SMB leader looking to strengthen your cybersecurity and compliance, feel free to send a connect request or DM anytime.

Mike Andrewes

“Should we do a risk assessment or start SOC 2 prep now?”

This question came up during a call a while back.

It’s a good question.

The person asking realized it was important to think about the actual cyber risks to their business.

They wanted SOC 2 because potential customers kept asking.

The risk assessment should happen first, even if SOC 2 is the goal.

Under the SOC 2 Trust Services Criteria, CC3 is titled “Risk Assessment.”

If we tell an auditor that our risk assessment was “preparing for SOC 2” itself, that’s less than ideal.

SOC 2 isn’t a risk assessment methodology.

It’s an independent assurance framework that evaluates whether a company’s controls meet the AICPA Trust Services Criteria. 

Once the risk assessment is done, it’s time for the SOC 2 gap analysis.

Then, we know what needs to be done to earn a clean SOC 2 report.

Why does the order matter?

Not all cyber risks are compliance gaps.

Non-compliance is a form of cyber risk.

All cyber risks are business risks.

There are fewer blind spots when we work in the right sequence.

✅ If you need to see where things stand when it comes to cyber risks and compliance, send me a message.

Cybersecurity Advisor | Scalable cybersecurity for startups and SMBs

Does it feel like states keep adding new privacy laws?

20 states now have privacy laws that are active or will be soon.

Other states are thinking of joining the party as well.

This is challenging for businesses to keep up with.

Getting this wrong can mean fines, legal action, and reputation harm.

Jodi Daniels knows this topic well and she's joining - Karina Klever - and me in The GRC Room on March 18th.

Jodi is the Founder & CEO of Red Clover Advisors and hosts the 'She Said Privacy / He Said Security' podcast.

👉 Next steps: RSVP today or share with your network!

Sahar Dahan, Kevin Le and 378 other attendees

"Lots of CISOs don't want to handle the GRC piece of cybersecurity."

This sums up the message that - Karina Klever - shared with Jake Bernardes and me during our recent LinkedIn Live.

She sees these CISOs keeping their environment very secure, but they don't want to handle the less technical aspects, like collecting evidence.

Then, Jake pointed out that being a CISO is an executive role that requires multiple competencies.

He told us that his APPSEC, IT, and Engineering teams know these functions better than he does, so he focuses on the strategic side.

This means knowing where things need to be and how to get there.

I see a lot of validity on both sides.

Some cybersecurity leaders are more technical than others.

This doesn't mean we can disregard certain pieces of the puzzle.

We need to think like an executive and pull it all together if we expect things to go well.

To see the rest of this exchange, check out the attached clip and let us know what you think!

SMB cybersecurity can be tough.

Common reasons it doesn’t happen:

• "We're too small."

• "We don't have the budget."

• "We plan to get to it soon."

• "I think our IT person handles that."

• "If something happens, we will deal with it."

The reason that's discussed less often?

There are a lot of moving parts.

Strategy, policies, tools, coordination across departments.

Monitoring never really ends.

It can be a lot.

When it comes to compliance, small companies often face nearly the same requirements as larger ones.

The way to make it manageable is to be proactive.

Tackle it a little at a time.

If the strategy feels impossible, simplify it.

Focus on what actually matters to the business.

If this feels daunting and your business needs to get it right, experienced outside firms can help bring structure and clarity.

When this is done right, security aligns with the business and feels manageable.

Step one?

Figure out how important this really is to your business.

• Do customers ask about your cybersecurity?

• Do contracts or insurance policies require it?

• What would one day of downtime cost you?

• What would a data breach cost? The average cost per record is around $160.

If you answer those four questions honestly, the next step becomes clearer.

Is there anything you’d add to this?

Compliance is a hot topic on LinkedIn and at parties.

Most people can't get enough.

Okay, fine. 

That might be a stretch.

We commonly hear "cybersecurity isn't compliance".

There's some truth to this saying, but there's no reason compliance can't look and feel like cybersecurity.

It's not like SOC 2 or PCI DSS secretly tells companies to avoid thinking about real cybersecurity.

Compliance is the floor.

We can elevate it.

We can fill in the gaps.

That sparse garden of compliance can grow into real security.

It doesn't even need to happen overnight. 

It can be done as time and money allow, a little at a time.

What are your thoughts on this debate?

On Saturday, I posted about deciding between a cyber risk assessment or SOC 2 prep.

The post concluded that starting with a cyber risk assessment is smart in either case.

Multiple cybersecurity practitioners agreed.

Here's the common objection:

"If we're doing SOC 2 anyway, is this double the work?"

If done correctly, it shouldn't be.

Yes, you may evaluate more control line items.

However, you're not:

• Scoping twice

• Reviewing documentation twice

• Testing configurations twice

There's significant overlap.

I can tell you with certainty, it doesn't take our company twice as long.

A properly executed risk assessment should directly inform SOC 2 readiness rather than duplicate it.

If efforts are being duplicated, the organization is likely creating silos.

Unless you run a farm (or a few other types of businesses), silos aren't good.

A mature cybersecurity program is designed to evolve. 

Risk and compliance should operate as connected disciplines, not separate tracks.

If leadership understands the compliance posture but lacks visibility into actual risk exposure, it's time for a risk assessment.

If leadership understands risk but lacks clarity on regulatory obligations, it's time to ask questions such as:

“We're a small accounting firm in Las Vegas. What cybersecurity laws, regulations, and industry guidelines apply to us?”

Even asking your favorite LLM is better than operating in the dark.

What do you think about this?

In 2026, AI gets a lot of attention in cybersecurity.

Most cybersecurity websites focus on tools, features, and automation.

Recently, our BDR Sandra Avila asked, “What’s something you do for clients that adds value in an unexpected way?”

The first thing that came to mind was something not so technical: 

Being able to communicate with business leaders and technical teams in a way that resonates.

When we present an assessment with risks and compliance gaps, it can be a stressful moment.

Finger pointing between departments is always a possibility.

Consensus gets harder.

Momentum slows.

We address this early, by pointing out that findings are normal.

What’s worse than having findings is not knowing where things stand.

It’s hard to fix issues you don’t know exist.

Clients hire us because they want to improve.

That in itself deserves some credit.

Is there a non-technical skill that helps you get good results for clients?

If so, what is it?

In cyber GRC, companies are looking to do more with less.

At the same time, regulatory pressure, third party scrutiny, and customer expectations continue to increase.

Compliance theatre might close a few deals, but it's a fragile strategy.

What is growing instead is GRC engineering.

This means:

• Embedding controls directly into workflows.

• Automating monitoring and evidence collection.

• Producing defensible, real time reporting.

• Aligning security controls with business objectives.

Practitioners who understand GRC principles will thrive in this environment, even as more companies leverage AI.

This shift benefits:

• SOC 2 audit firms that want cleaner, more reliable evidence.

• Companies pursuing SOC 2 for the first time.

• Security teams tired of spreadsheet-driven compliance.

It doesn't have to be all or nothing.

We can use these principles even if we don't have someone with the title of GRC Engineer.

We can start by engineering one control, workflow, or reporting process.

Once compliance becomes systematic, we can shift the focus from collecting evidence to providing actual assurance business leaders want.

Have you thought about leveraging these principles at your business?

We have two types of cybersecurity advisory clients:

- Ones that had an assessment within the past ~12 months.

- Ones that are about to have an assessment.

This is the best way to see where things stand with cyber risk and compliance.

Then, we can take informed action.

However, some companies may prefer to skip the assessment and treat symptoms or go off of "best practices".

"We don't have much in place anyway".

This might work for a while, but here's a couple of reasons not to skip the assessment altogether:

- Every business is different, so one-size-fits-all plans rarely work.

- The things that get missed often turn into deeper issues.

The hidden upside to an assessment is that we often find cybersecurity spending that doesn't need to happen anymore.

There are opportunities for one new solution to solve five problems.

There's very little downside to this.

Have you thought about doing a cybersecurity assessment at your business?

✅ If so, send me a message if you have questions.

In cybersecurity, knowing how to properly prioritize and schedule things is underrated.

We often use High-Medium-Low, 1-10, or 1-100 as part of this.

Determining if a task is outside of our control commonly don't get enough attention though.

On internal cybersecurity schedules or project plans, we've seen:

- "Review and update all policies and playbooks (1 week)"

- "Conduct annual vendor security reviews (1 week)"

Do you see the difference? 

Don't worry about the lack of dates, since the company did have that.

What was missing was the consideration of:

"What's in our control and what isn't?"

The top task was completely within their control.

Between their team and ours, that was fairly simple. 

It took less than three days.

The second part though?

That part was destined to be tough.

What if some vendors didn't respond that week?

A lot of vendors won't. 

Some won't respond at all.

Unless the task is simply "go look at their website / trust center", one week isn't enough if you're dealing with a lengthy list of vendors.

Third-party risk management (TPRM) is far from easy.

The responsive angle is one part of this.

It's also hard because we may need to work off partial information.

If we're trying to build a schedule, we need to think about this.

This is unlikely to change anytime soon.

Have you seen a project get derailed because the timeline wasn't realistic?

If so, what happened?

Two years ago, we were helping a new-ish payment platform with PCI DSS.

This is a security standard that applies to organizations that store, process, or transmit payment card data.

We asked to see certain documents:

- Network diagram

- Data classification plan

- Data flow diagram

- Hardware list

- Software list

This way, everyone knows what the project is focused on and what it isn’t.

When they shared the documents, we reviewed them and provided feedback.

They asked “do you have templates for this?”

I told them we do.

They asked “then why didn’t you share them before?”

That was a bit surprising.

There were two reasons:

- We were there to assess the current state.

- There’s not one correct way to do this.

We shouldn’t be trying to make changes until we know whether there’s a need to make changes.

We don’t want to find more issues so we can do more work and make more money.

If we do an assessment and the only thing to report is how great everything is, that’d be fantastic.

After we spoke about why it’s important to finish the assessment before making changes, they understood and were very reasonable.

This helped the project move at a brisk pace and things turned out well.

Have you ever had a misunderstanding like this as a project was getting started?

taplio

The Battle

Faye Almeshaan

Mike Andrewes

Followers

Posts

Engagements

Likes

Performance ScoreMike Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Faye Almeshaan

Mike Andrewes

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Mike Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreMike Andrewes's LinkedIn Performance