Where this fits - Roughly 10-200 staff
SMB
Enough to lose, not enough to hire a CISO or a chief architect.
What this stage typically needs
- Fractional security leadership: risk posture, control roadmap, vendor review
- A first audit - SOC 2, PCI DSS or HIPAA - passed without rebuilding the company around it
- Cloud migration and consolidation that lowers cost rather than moving it
- Answers to the security questionnaires that are now blocking your sales cycle
- How it usually runs
- Standing security guidance, usually alongside a one-off architecture review.
- Where the depth comes from
- Standing security leadership for organizations in this range, including first audits passed without rebuilding the business around them.
- First step
- A 30-minute call, no charge.
- Then
- A budget scoping exercise. This is senior engineering time and it is priced like it.
Usually involved
The capabilities this stage draws on most.
Not a limit - any of the twelve domains applies. These are simply the ones that come up first at this size.
Other stages