Fractional security leadership
Security leadership without the full-time CISO.
CC West provides fractional security leadership for small and mid-sized organizations: a strategy, a roadmap, and someone accountable for the results.
Your first eight weeks
From unclear to in control
Understand · Weeks 1–2
What matters most to your organization, in plain language.
Assess · Weeks 2–6
Where you stand today, measured against NIST CSF 2.0.
Prioritize · Weeks 6–8
A 12-month roadmap sized to your budget and staff.
Sound familiar?
Most growing organizations reach the same point: security matters more than ever, but there is no one whose job it is to lead it.
You’re expected to answer for security, but no one on your team owns it.
Insurers, auditors, and customers are asking questions you can’t easily answer.
You’re buying tools without a clear picture of your risks or priorities.
Services
The leadership a CISO provides, sized for your organization.
Fractional CISO
Ongoing leadership for a set number of hours each month: strategy, board and executive reporting, vendor oversight, and ownership of your policies.
Security program assessment
A baseline against a recognized framework, NIST CSF 2.0, with a prioritized roadmap that tells you what to fix first and why.
Incident readiness
Incident response planning and tabletop exercises, so the first time your team rehearses isn’t during a real incident.
Vendor and tooling guidance
Independent evaluation of security tools and providers, so you buy what you need, not what a salesperson recommends.
The CC West Method
A clear path, with something in your hands at every step.
Built on NIST CSF 2.0 and the operational discipline of ITIL, so recommendations hold up with insurers and auditors and become repeatable processes, not one-off heroics.
Understand · Weeks 1–2
Before recommending anything, learn the organization: what it does, what it can’t afford to lose, who its regulators and insurers are, and what is already in place.
You get
A one-page summary of your business risks and constraints, in plain language.
Assess · Weeks 2–6
Measure your security posture across Govern, Identify, Protect, Detect, Respond, and Recover. The assessment looks at people and process as well as technology, because most real gaps are ownership gaps.
You get
A maturity scorecard and a risk register, ranked by likelihood and impact.
Prioritize · Weeks 6–8
Turn findings into a sequenced roadmap sized to your budget and staff. Every item has an owner, a cost range, and a reason it ranks where it does.
You get
A 12-month roadmap and an executive summary ready for your leadership team or board.
Build · Ongoing
Put the foundations in place: policies and standards, incident response plans, access and vulnerability management, vendor risk reviews, and security awareness.
You get
Documented, working processes your team can run without me.
Operate and report · Monthly
The fractional CISO rhythm: a standing leadership meeting, an executive metrics report, vendor and tool oversight, readiness exercises, and regular checks on roadmap progress.
You get
A named, accountable security leader and a clear monthly picture of whether risk is going down.
Framework-based
Recommendations map to a recognized standard, so insurers and auditors accept them.
Business-first
Priorities come from what your organization can’t afford to lose.
Vendor-neutral
No tools to resell, so the advice has no commission behind it.
Built to transfer
The goal is a program that works without constant consulting hours.
About
Michael Nelson, founder of CC West
Thirty years in IT and twenty in cybersecurity, supporting organizations from 50 to 30,000 users. I’ve helped leaders turn security from an unanswered question into a program they can explain, fund, and trust.
CC West exists for organizations that need that experience at the table but not on the payroll full time.
Let’s talk about where you are.
The first conversation is free, and there’s no obligation. We’ll talk through your situation and whether fractional leadership is the right fit.