“A customer is asking about CMMC and we do not know where we stand.”
A gap assessment against the practices you will actually be measured on, and a remediation plan that fits your budget and your calendar.
Cybersecurity consulting
Security decisions you can defend.
Cybersecurity should make the business stronger—not bury it in generic checklists.
Kenneth Ingham Consulting helps small and medium-sized organizations understand their actual risk, meet demanding security requirements, and put durable protections into practice.
Where organizations get stuck
If one of these is your week, this is the right place.
“We think we are ready, and we cannot afford to be wrong on assessment day.”
A candid readiness opinion first—including when the honest answer is “not yet”—and then an advocate in the room who knows your environment and speaks the assessor’s vocabulary.
“Our documents do not describe what we actually do.”
Policies and procedures written from how the work really runs, and written so you can tell whether they are being followed.
“Nobody has ever tested our incident response plan.”
A tabletop exercise finds the step in the wrong order, the notification nobody owns, and the decision the plan never says who makes. Run through Ultimate TTX, where Kenneth facilitates.
“Someone handed us a standard and we do not know which controls apply.”
Most of these standards are NIST SP 800-53 in different clothing, so work done once tends to count more than once. That includes finding where a baseline is tighter than it needs to be.
“We are adopting AI faster than we are governing it.”
Policy review, an AI risk assessment, and a way to find the AI use nobody registered—including the device with its own cellular connection that no proxy log will ever show.
Nothing is sold on commission
No vendor pays for a recommendation from here.
No commissions, no referral fees, no reseller margin. That is the reason a recommendation is worth anything: nothing here is gained by which way it goes. When the right answer is a product this practice does not sell, or a specialist it cannot supply, that is the recommendation you get.
How independence works hereFrom the blog
Useful security thinking, away from the sales pitch.
The blog is a separate place for practical cybersecurity analysis, implementation notes, and lessons learned.
Read the blog