We run your security program,
so the audit passes and deals close.
30 minutes, no sales pitch. You leave with your top three gaps.
Enterprise buyers send security questionnaires before they sign. Healthcare clients ask about HIPAA. Without answers, deals stall for months.
A full-time CISO costs over $250,000 a year. Most growing companies do not need that yet. They need someone who knows the path and can lead the work.
Clear packages for cloud-native SaaS companies. Start with a project, keep us on as your fractional CISO.
Find the gaps, build the controls and walk into the audit ready.
See what is included in SOC 2 ReadinessRisk analysis, policies and safeguards for health tech handling patient data.
See what is included in HIPAA ReadinessOngoing security leadership for a monthly fee, without a full-time hire.
See what is included in Fractional CISOA ranked list of your biggest gaps and a plan to fix them.
See what is included in Security Risk AssessmentA 30-minute call. No sales pitch. You leave with your top three gaps.
We review your cloud, controls and policies, and size the work.
We build the roadmap and help your team close the gaps.
We support you through the audit and keep the program running.
Most compliance consultants come from audit and policy work. Black Castle is led by a security engineer who works directly with your engineers. Controls fit how your team ships software, not the other way around.
You work with the person doing the work. No hand-offs to juniors.
Hands-on with AWS, Google Cloud, Kubernetes, Terraform.
We run the program that Vanta, Drata or Secureframe support.
SOC 2, HIPAA, ISO 27001 and NIST CSF, for companies in both countries.
Not ready for a call? Sign in to the Black Castle portal with your work email. We watch your TLS certificates, grade each site and alert you before anything expires. Free while in early access.
No credit card. Your company email is all you need.
Eight practical ways to secure Kubernetes, from images and RBAC to supply chain, and the evidence SOC 2 and ISO 27001 auditors will ask for.
A security-first plan for cloud migration in seven steps, with the evidence SOC 2, ISO 27001 and HIPAA auditors will ask for afterwards.
A fractional CISO, or vCISO, is a senior security leader who works with you part time. You get the strategy, audit experience and customer-facing credibility of a CISO for a monthly fee instead of a full-time salary.
No. We prepare you for the audit. A licensed CPA firm performs the SOC 2 audit and issues the report. We can introduce you to audit firms we trust.
Not always. A platform helps collect evidence, but it does not run the program. If you already have one, we run it for you. If not, we help you decide whether you need one.
Most cloud-native companies are ready for a Type 1 audit in two to four months. A Type 2 report then covers an observation period of three to twelve months.
Cloud-native SaaS companies with 10 to 200 employees in the United States and Canada, usually selling to enterprise or healthcare customers.
A free 30-minute call. No sales pitch. You leave with your top three gaps.
