Bit Fellowship Request a consultation

Advisory plans it.

Fractional security leadership for nonprofits and community organizations. We turn risk and compliance into a plan your board can approve and your funders, insurers and auditors can trust.

Request a consultationSee what we deliver

Have an IT provider? We work alongside them. No security lead? We fill the seat.

For organizations with an IT person or managed provider

Advisory support

We add the security leadership they were never hired to provide, and we never compete for their role.

  • Independent second opinion on risk and priorities
  • Board and funder reporting in plain language
  • Framework depth on demand: HIPAA, CIS Controls, PCI DSS
  • Support during audits, insurance renewals and incidents

Our rule: your provider runs the systems. We help you decide what they should protect first.

For organizations where no one owns security

Fractional security lead (vCISO)

We take the seat until you are ready to hire, or for as long as you need us.

  • Security leadership accountable to your executive director and board
  • Policies, a risk register and a roadmap that stay current
  • Answers for insurers, funders and partners who ask about security
  • Readiness support through audits and assessments

Our rule: we build a program you could hand to a full time hire tomorrow.

What Advisory delivers.

A security leader in your corner who reports in mission terms, not technical jargon.

Fractional security lead

Ongoing leadership that owns your security program, reports to leadership and keeps the roadmap moving.

Risk assessments

A clear picture of where you stand against the CIS Controls, what matters most and what to fix first.

HIPAA readiness

Security risk analysis, policies and safeguards for health and human services organizations.

Build the in house team

Competency maps, onboarding plans and career roadmaps so your own staff can run the program after we step back.

Policies that fit

Acceptable use, access, incident response and AI use policies written for how your staff and volunteers actually work.

Insurance and funder questionnaires

Accurate, defensible answers to cyber insurance applications and funder security reviews.

One turn of the cycle.

  1. Scope and requirements

    Inventory people, assets, software and data, read the contracts, and map the legal and data residency requirements that apply.

  2. Controls and gaps

    Build the full control set, then run the gap assessment, risk assessment and any penetration testing against it.

  3. Baseline and roadmap

    Set the baseline, turn the gaps into a roadmap with milestones and owners, and brief the board.

  4. Measure and renew

    Track KPIs, report quarterly, and each year repeat the major steps and issue a new roadmap.

Start with a baseline risk assessment.

Find out where you stand against the CIS Controls Implementation Group 1 safeguards and what to fix first, in language your board can act on.

Request a consultation

Meet the other programs.

The same team plans, rehearses and teaches, so nothing gets lost between a finding and the fix.

Rehearse it.Teach it.

Readiness

Rehearse it.

Most incidents at small organizations start with one email. We write your response plan, test your backups and run tabletop exercises so your team acts in minutes, not days.

  • Incident response plans
  • Tabletop exercises
  • Microsoft 365 and Google reviews
  • Vendor oversight
Explore Readiness

Training

Teach it.

Plain language security and AI training for staff, volunteers and boards, plus community programs that help seniors stay safe online and veterans move into technology careers.

  • Staff and volunteers
  • Safe AI use
  • Board briefings
  • Seniors and veterans
Explore Training