Cybersecurity and Cyber GRC consulting

Cybersecurity that protects the business. Not just the audit.

  • Customers need proof.
  • Requirements keep changing.
  • Risks need attention.
  • Your team is stretched thin.

Hotman Group is a CPA-led cybersecurity and Cyber GRC professional services practice, working across security strategy, risk, governance, compliance, remediation, implementation, and ongoing operations.

Talk With Us See how we help
A cybersecurity leader on a video call reviewing priorities, risk decisions, and next steps.
Working with HGLeadership, independent judgment, and hands-on support, as an extension of your team.
Business, finance, and security judgmentCPA-led
We assess, fix, implement, and operateHands-on delivery
Verified client reviews
Certified woman-owned small businessWOSB

Selected client outcomes

Complex problems. Work that changes the outcome.

A few examples from our work. More are on the case studies page.

Service provider, major bank as customer

Banking contract, secured.

A specialized service provider had to pass a major bank's pre-contract security review, with demands beyond industry norms. We turned each demand into a risk decision and helped the client make a defensible case, without taking on unnecessary requirements.

Read the banking contract case
GRC technology, Trintech

Audit evidence, 95% reused.

Trintech consolidated more than 20 tools into one GRC platform and handled a 33% increase in audit volume without additional resources, reusing evidence across SOC, ISO, CSA, and DORA.

Also documented in StandardFusion's Trintech case study Read the Trintech case
Ongoing vGRC

400+ controls, operated.

As an ongoing extension of one organization's team, we help operate a five-framework program: monitoring controls, prioritizing remediation, and organizing audits. The program expanded while internal GRC headcount stayed flat.

Read the ongoing vGRC case

Our work spans federal and defense contractors, public SaaS and AI companies, organizations serving the financial sector, and health and wellness organizations, from first programs to complex multi-framework environments.

See all client results

The cost of waiting

When the work doesn't get done, the business feels it.

The work isn't hard to find. It's hard to finish with a team that already has a day job.

  • Deals stall.A customer security review can hold up a contract until you can show the right protection.
  • Findings return.Fixing for the auditor instead of the cause brings the same issues back next year.
  • Risk goes unowned.Without clear owners, leadership can't tell what is actually being managed.
Cybersecurity leader balancing customer requirements, audit findings, risk questions, and limited team capacity.

Meanwhile, on your desk

  • CustomerAnother security questionnaire.
  • New frameworkA requirement nobody planned for this year.
  • AuditA finding that needs to be fixed, not just answered.
  • Leadership"Where is our real risk?"
  • GRC platformBought to make this easier. Somehow it created more work.

That's where we come in.

We don't hand you a report and wish you luck. We help you decide what matters most, then help you get it done.

Talk With Us

Why Hotman Group

Complex problems rarely have one right answer. They deserve the right judgment.

We weigh your business objectives, risk, technology, budget, and the capacity of your team, then find a responsible path forward. Sometimes that means starting small and maturing over time. Sometimes it means supporting a complex enterprise program. Either way, the objective stays in view.

We'll recommend what's right for you, even when it isn't what you came to buy.

  • We'll tell you what matters most, and what can wait.
  • We'll help you make the best responsible progress with the resources available.
  • We'll follow up when something isn't right, and help your people own the work.

The right first step isn't always the one on the purchase order.

A client was ready to buy a CMMC gap assessment. We could have taken the engagement. Instead, we asked whether it was the right first step.

What the client was ready to buyA gap assessment

Tens of thousands of dollars, before anyone knew where CUI lived.

The question we asked firstWhere does CUI actually live?

Seven ERP systems, and a major technology transformation underway.

What we recommendedScope first. Then assess.

So the client's investment would evaluate the right environment.

See this and other examples of independent judgment
See why clients choose HG

How we help

Wherever the problem starts, we help you solve it.

Our work spans cybersecurity strategy, program design, risk management, governance, compliance and frameworks, GRC technology, assessments, remediation, implementation, and ongoing operations. Most problems cross those lines. These are common starting points.

See all the ways we help

Security and GRC decisions are piling up, and no one senior has the time to own them.

Fractional CISO (vCISO) and vGRC support

Security leadership and GRC capacity that sets priorities, manages risk, and keeps controls working.

A customer, contract, or regulator asks for SOC 2, ISO 27001, CMMC, or a requirement you didn't see coming.

Security and compliance readiness

Meet the requirement legitimately while improving actual protection.

You're choosing a GRC platform, or the one you bought isn't delivering what you expected.

GRC platform selection and implementation

Independent selection, implementation, or improvement, built around your program and people.

Findings keep coming back, security processes aren't working, or you need to know where you really stand.

Cybersecurity assessments and remediation

Root causes found, real risk prioritized, and fixes verified in practice.

Doesn't fit neatly in any of these? Most of our work doesn't. Bring us the problem

Many requirements, one purpose

Requirements inform the program. They don't define it.

Frameworks and customer requirements overlap, but they aren't interchangeable. We connect them to one security and risk program, reusing what's shared and handling what's specific, so the work protects the business and earns trust.

See how we approach new requirements
  • NIST CSF
  • ISO 27001
  • SOC 2
  • HIPAA
  • CMMC
  • PCI DSS
  • FedRAMP
  • CIS Controls
  • And others
Protection and trustA connected security and risk program that also stands up to audits and customer review.

How it begins

A clear way forward in three steps.

You don't need to know exactly what's needed before you call.

Talk With Us

  1. Tell us what's going on.

    One conversation about the problem, the pressure behind it, and what you're being asked to deliver.

  2. Agree on what needs to happen.

    A recommendation that fits your objectives, risk, budget, and team. Sometimes it's smaller than you expected.

  3. Get it done.

    We do the work with your team, scoped to what you actually need.

What changes

Less activity for the sake of compliance. More control over risk.

  • Reacting to the latest requestPriorities set by actual risk
  • A separate effort for every frameworkOne connected security and risk program
  • Work no one clearly ownsClear ownership and follow-through
  • Tools expected to run the programTools supporting people who pay attention
  • Passing the audit as the goalProtection you can also prove
  • ⅔ fewer mapped controls across SOX ITGC, SOC 1, and SOC 2 at a public SaaS company. Read the case
  • 3+ risk registers unified into one view leadership could act on. Read the case

Start a conversation

Know where your risks stand, and be able to prove it.

See what your team is doing about the risks that matter, and what you can show customers, leadership, and auditors.

Have a specific need in mind? Tell us what's going on, and we'll help figure out what needs to happen.

Talk With Us
About the practice

Hotman Group is a cybersecurity and Cyber GRC professional services practice founded in May 2016 by Cheri Hotman, CPA, MBA, CISSP, CCISO, CMMC CCP, and author of Rebuilding Cybersecurity (forthcoming, CRC Press). Trent Hotman is Managing Partner. Based in Fort Worth, Texas. Certified Woman-Owned Small Business (WOSB).

Meet the team