GhostByteCyber Let’s Talk
Cybersecurity GRC · Third-party risk · Readiness

Security that makes sense to everyone in the room.

GhostByte Cyber helps organizations build practical cybersecurity governance, assess third-party risk, prepare for frameworks like ISO 27001 and SOC 2, and write the policies and procedures that make it all stick, in plain language everyone can follow.

Start a conversation See how I can help
GhostByte Cyber logo
  • Enterprise-scale governance experience
  • Plain-language communication
  • Cross-functional by habit
  • Readiness-focused

Helping organizations prepare for and align with

ISO 27001Preparation and scope planning
NISTBest-practice guidance and alignment
SOC 2Readiness guidance
GDPRWorking alongside privacy and legal teams

I help you prepare and align. Certification and attestation are issued by accredited third-party auditors.

Services

Governance, risk, and readiness, without the jargon

Whether you need a vendor's risk assessed, a policy written, or a clear path toward ISO 27001 or SOC 2 readiness, this is where I help.

Governance, Risk & Compliance

Practical programs that hold up to scrutiny and still work on a Tuesday afternoon.

  • Cybersecurity governance structure and ownership
  • Support for an information security management system (ISMS)
  • Risk assessment and risk register support
  • Practical guidance on everyday governance and compliance questions
Discuss this

Third-Party Risk Analysis

Know what a vendor brings to your risk profile before they touch your data or your network.

  • Vendor and supplier cybersecurity risk assessments
  • Due diligence questionnaire design and review
  • Cyber and data protection clause review with legal and privacy teams
  • Plain-language risk summaries with recommendations
Discuss this

Framework Readiness & Alignment

A realistic path toward the standards your customers and regulators ask about. I help you prepare; accredited auditors certify.

  • ISO 27001 preparation and scope planning
  • SOC 2 readiness guidance and a clear place to start
  • Plain-language explanations of what a framework requires
  • Best-practice guidance informed by NIST and ISO standards
Discuss this

Cybersecurity Policy Writing

Policies people can actually read, understand, and follow.

  • Information security and acceptable use policies
  • Risk, access, and third-party management policies
  • Review, revision, and rationalization of existing documents
  • Mapped to your framework and your business reality
Discuss this

Cybersecurity Procedure Writing

The step-by-step detail that turns policy into daily practice.

  • Standard operating procedures for security processes
  • Access, change, and vendor onboarding procedures
  • Clear roles, steps, and ownership
  • Audit-friendly, evidence-ready documentation
Discuss this
Why work with me

I speak both languages: technical and human

Most security programs fail in the gap between the people who understand the risk and the people who have to act on it. Closing that gap is what I do best.

  • Fluent in every room. I move comfortably between engineers, legal, privacy, operations, and executives, and I adjust the conversation for each.
  • Built for real organizations. Practical controls and documents sized to how your people actually work, not shelfware.
  • Policy, risk, and third parties together. They fail together, so I review them together.
  • Documentation that gets used. Policies and procedures written for the people who have to follow them.
How it works

A simple, collaborative process

No black boxes. You always know where things stand and why.

  1. Listen

    We start with a conversation about your goals, constraints, and what is keeping you up at night.

  2. Assess

    I review your current policies, procedures, and vendor relationships to understand where you stand.

  3. Prioritize

    Findings are ranked by real business risk, so effort goes where it matters most.

  4. Build

    I write and revise policies and procedures, working alongside your legal, privacy, and technical teams.

  5. Enable

    I brief stakeholders in plain language and stay available as questions come up.

About

The person behind the work

I have spent years helping large, complex organizations make security understandable and workable. I work side by side with legal, privacy, engineering, operations, and leadership, and my favorite moment in any project is when a difficult idea finally clicks for someone.

I started GhostByte Cyber to bring that experience to organizations that want clear, practical security guidance, delivered by someone who genuinely enjoys helping people get to the right answer.

Josh

How I work

  • Plain language first. If a concept cannot be explained simply, it is not ready to be acted on.
  • Helpful over gatekeeping. Security should help the business say yes, safely.
  • Cross-functional by default. The best outcomes come from bringing the right people together early.
  • Pragmatic and risk-based. Right-sized recommendations, never fear-driven ones.
  • Honest about my limits. If something is outside my lane, I will say so and point you to the right specialist.
What you receive

Outputs you can use the next day

Clear documentation

Policies, procedures, and risk assessments written to be read, understood, and followed.

Risk you can act on

Third-party assessments and prioritized findings, each explained in plain language with a suggested next step.

A clear starting point

A plain-language summary of where to begin and what to prioritize on the way to the framework you are working toward.

Let’s talk about what you’re working on

Tell me about your situation and what you are trying to accomplish. We will talk through scope and pricing once I understand what you need. No pressure, no pitch.

Start a conversation