doc@prestonrich.com · 972.837.7463
Executive-level security.
Without the full-time price tag.
Dr. Preston Rich brings 30+ years of CISO-level expertise to your organization as a fractional partner — delivering the strategic security leadership of a National CISO at a fraction of the cost. Real experience. Real results. No fluff.
One experienced partner. Every engagement is led personally by Dr. Rich — not delegated to a junior consultant. You get 30+ years of real-world CISO experience applied directly to your organization’s most pressing security challenges.
Virtual CISO
(vCISO) Services
Get expert cybersecurity leadership without the $250,000+ full-time CISO salary. Dr. Rich acts as your strategic security advisor on a retainer basis — attending board meetings, managing risk, building your security program, and aligning your security posture with your business goals.
- ◆Strategic security roadmap development and execution
- ◆Board and C-Suite advisory on cybersecurity risk thresholds
- ◆Security program governance and policy development
- ◆Vendor and third-party risk management (TPRM)
- ◆Incident response planning and tabletop exercises
- ◆Security awareness program implementation
- ◆Ongoing compliance monitoring and reporting
Cybersecurity
Risk Assessment
You can’t protect what you can’t see. Dr. Rich’s risk assessment process uses proven frameworks — CIS RAM, NIST, and ISO — to uncover your vulnerabilities, quantify their business impact, and build a prioritized remediation roadmap your leadership team can act on immediately.
- ◆Full-scope vulnerability identification and analysis
- ◆Business impact analysis tied to financial risk exposure
- ◆CIS RAM, NIST SP 800-30, and ISO 31000 methodology
- ◆Prioritized remediation roadmap with cost estimates
- ◆Executive-ready risk report for board presentation
- ◆Cyber insurance readiness evaluation
- ◆Annual re-assessment option for continuous improvement
Cybersecurity Program
Development
Most organizations don’t have a security program — they have a collection of disconnected tools and policies. Dr. Rich designs and implements comprehensive security programs using his proprietary Comprehensive Cybersecurity Management System (CCMS™) — a proven framework built from real-world CISO experience across five industries.
- ◆Information Security Management System (ISMS) design
- ◆Security policy and procedure development
- ◆IT System Security Plans (SSP) development
- ◆Security awareness and training program implementation
- ◆Incident response program design and testing
- ◆IT Governance Committee establishment
- ◆Metrics framework for measuring program effectiveness
Compliance & Audit
Management
Compliance isn’t a checkbox — it’s a competitive advantage. Dr. Rich has personally directed audits across 200+ hotel properties, maintained SOC 2 and ISO 27001 programs for higher education, and earned Best in Industry ratings. He brings that same rigor to your organization.
- ◆PCI-DSS 4.0 readiness assessment and audit management
- ◆SOC 2 Type I & II preparation and ongoing compliance
- ◆ISO 27001 certification readiness and ISMS implementation
- ◆HIPAA security rule compliance and risk analysis
- ◆NIST CSF 2.0 gap analysis and implementation roadmap
- ◆HECVAT audit program management (higher education)
- ◆Cyber insurance optimization and documentation
The CCMS™ — Comprehensive
Cybersecurity Management System
Dr. Rich’s proprietary framework is the backbone of every security program engagement. Built from 30+ years of real-world deployments across healthcare, hospitality, higher education, energy, and nonprofit sectors — CCMS™ integrates program management, control frameworks, and risk governance into one cohesive, defensible system.
A structured information security management system aligned to NIST, ISO 27001, and CIS — providing defensible, audit-ready documentation for every control.
Interdependent security controls mapped across technical, administrative, and physical domains — eliminating gaps that single-framework approaches miss.
A repeatable risk management process that quantifies exposure, ties risk to business impact, and gives leadership the data they need to make informed security investments.
Built-in mapping to PCI-DSS, SOC 2, HIPAA, NIST CSF, ISO 27001, and GDPR — so compliance efforts reinforce your security program rather than running parallel to it.
Pre-built IR workflows, tabletop exercise templates, and communication protocols that transform your team from reactive to resilient before an incident occurs.
Executive-ready dashboards and KPIs that translate technical security performance into business language — giving your board the visibility they need to govern effectively.
30-minute conversation to understand your organization, industry, current posture, and most pressing security challenges.
A structured evaluation of your current security environment — gaps, risks, and compliance status — using proven frameworks.
A prioritized, executive-ready action plan with timelines, resource requirements, and expected risk reduction outcomes.
Ongoing partnership to implement, monitor, and continuously improve your security program as your organization evolves.
that need security most.