// ADVISORY AND RETAINERS · HANS STUDY · ONTARIO, CANADA
Advisory and retainers
Most organizations don't need a full-time CISO. They need senior security judgement they can reach when a decision matters, a strategy that fits their risk and their budget, and one person who's accountable for seeing it through. That's the work. Independent, with nothing to sell you but the advice.
I act as a fractional CISO, security architect, and advisor for regulated and operationally complex organizations: defence suppliers, critical infrastructure, public safety, and the operators who serve them. Strategy and governance, risk and compliance, framework alignment, vendor and third-party risk, and the board-level translation that turns a technical problem into a decision your leadership can actually make.
I work remotely, which means location isn't a constraint. Most of this is done over a call and a shared screen, with on-site time when an assessment or a build calls for it. I'm based in Ontario and take engagements across Canada and the United States.
Retainers
From monthly care to security leadership, lowest rung first.
Managed network and server care
Monitoring, patching in an agreed window, config backups, and hardening changes for one site, through a managed DHD. Works alongside your IT staff or MSP.
Fractional security architect
Design and change review, hardening standards, and integrator oversight for firms with an IT lead or MSP and nobody senior for segmentation, firewall policy, or OT.
Fractional CISO and vCISO
Program ownership, risk register, policies, a CPCSC, CMMC, or ISO roadmap, vendor reviews, and board and insurer reporting.
For integrators and MSPs
Level 3 escalation on subcontract: Genetec, VMS hosts, switching, firewalls, and Windows Server, bought in 10-hour blocks.
Remote delivery via the DHD, a remote access device.
Advise
Project advisory, on the buyer’s side of the table.
Strategic security and technology
A roadmap, an architecture direction, and a risk-based plan your board can act on.
Independent review
Owner-side review of somebody else’s design, bid, or build, by someone with no stake in the outcome.
Owner's technical representative
Somebody technical on your side for the life of a build. Submittals, progress claims, acceptance.
Pre-purchase design review
You have a quote and no way to judge it. What is oversized, what is missing, what returns as a change order.
RFP development and bid evaluation
Writing the specification and scoring the bids. Never written by anyone who could bid on it.
Expert opinion and failure investigation
Written technical opinion for disputes and insurers, and root cause on systems that failed.
OT/IT convergence security
The physical, OT, and IT boundary, read by someone who works on both sides of it.
Security design standards
Your own standard, so every future project and every future integrator inherits it.
The project work behind the retainers
Physical security
Genetec and other VMS and access control platforms, health checks, and security system design.
Networks, OT, and IT
Network architecture, OT networks, security network design, and the firewall and switch reviews.
Security and compliance
CPCSC, CMMC and NIST 800-171, ISO 27001, assessments, and the policy pack.
Independent throughout. No commissions, no product margin, no financial stake in what gets specified, and no installation work, so a recommendation is a recommendation rather than a quote in disguise. The independence policy sets out exactly what that covers and what it costs.
A straight read on where you stand
Start with a 30-minute scoping call or email contact@hans.study. You'll get a straight read on where you stand and an honest answer on whether I'm the right fit.
Related work: fractional CISO work that took a startup to ISO 27001 readiness.