Principal, CXD Consulting

Chris Donaldson

I think a company should be able to say out loud what enough security looks like for its business, defend it, and know where it stands. That’s the company’s call, not the auditor’s.

Start a conversation How the work runs

Alpharetta, Georgia · Clients nationwide

Enterprise security in Big 4 consulting, then SaaS compliance at a boutique firm.

My deepest experience is with B2B SaaS companies and consumer brands.

Enterprise security

In Big 4 consulting I spent seven years in Information Security, most recently as a Senior Manager, leading teams on security programs for Fortune 50 companies.

SaaS compliance

At a boutique firm that builds compliance programs for B2B SaaS companies, I ran the PCI practice and then the security consulting practice, working directly with CISOs and boards.

Certifications

CISSP · CISA · CRISC

LinkedIn

How the work runs

Three phases: decide what enough is, get there, and stay there.

Day to day, the work runs through your compliance and security leads, with legal, IT, engineering and your CTO in the same room. Your SOC 2 or ISO program stays, and your own standard sits on top of it.

My part is telling you plainly which requirements can flex and which can’t.

  1. 1 Your Defensible Standard

    What does enough security mean for this business, and where do we stand?

    What you have at the end

    • Requirements built from the risks you judge would be material, and how each risk would actually happen
    • Where you stand against each one, checked in your systems
    • Priorities in three tiers: required, expected and advanced
    • A roadmap for the next 12 to 24 months
    • The decisions you need to make
    • Benchmarks for spend and headcount

    Ends in one written standard your executive team agrees to, and a readout for them or your board.

  2. 2 Getting there

    What do we fix first, and who does it?

    What you have at the end

    The required tier in place and re-checked in your systems. IT and engineering make the fixes, each owned by the team that runs the system, with a date on it. I stay with the work until the required tier is done.

  3. 3 Staying there

    How do we stay covered once the fixes are done?

    What happens each quarter

    Every requirement is reviewed and re-tested, and requirements come and go with each acquisition, new market or product, and as the threats change.

From then on, your executive team can say whether you’re covered or need to do more, and agree on the answer.

It’s for B2B SaaS companies that have outgrown letting the audit set the bar.

They’re usually past $50 million in revenue and 200 people, a few years into SOC 2 or ISO 27001, at the point where a breach or an SLA miss would be material to the business. I do my best work with companies where an executive owns this, where a flag gets a response the same day, and where decisions get acted on instead of filed.

If you’re under $50 million in revenue, you probably don’t need me yet, unless an outage or a breach would cost you real money under your contracts. Do the basics well: MFA and single sign-on everywhere, tested backups, an endpoint tool, managed detection and response, your cloud provider’s built-in security, a yearly pen test, and someone who owns compliance, scanning and patching. Spend the rest on growth.

Chris Donaldson

Let’s connect.

I’d love to hear where your organization is today and where it wants to go, and share any perspective I can. Let’s find out if working together makes sense.