Cloud Security
Kubernetes Security Best Practices: How to Protect Your Containerized Applications
Eight practical ways to secure Kubernetes: container images, RBAC, network policies, pod security, secrets, monitoring and supply chain.
Fractional CISO · SOC 2 · HIPAA
Pass SOC 2 and HIPAA without hiring a full‑time CISO.
Fractional security leadership for cloud-native SaaS companies. We build your security program, prepare you for audits and help you close enterprise deals.
30 minutes. No sales pitch. You leave with your top three gaps.
Frameworks we prepare you for
- SOC 2
- HIPAA
- ISO 27001
- NIST CSF
- PIPEDA
- Quebec Law 25
The problem
Your next big customer wants a SOC 2 report.
Enterprise buyers send security questionnaires before they sign. Healthcare clients ask about HIPAA. Without answers, deals stall for months.
A full-time CISO costs over $250,000 a year. Most growing companies do not need that yet. They need someone who knows the path and can lead the work.
Services
Security leadership and audit readiness
Clear packages for cloud-native SaaS companies. Start with a project, keep us on as your fractional CISO.
SOC 2 Readiness
Find the gaps, build the controls and walk into the audit ready.
Learn moreHIPAA Readiness
Risk analysis, policies and safeguards for health tech handling patient data.
Learn moreFractional CISO
Ongoing security leadership for a monthly fee, without a full-time hire.
Learn moreSecurity Risk Assessment
A ranked list of your biggest gaps and a plan to fix them.
Learn more
How it works
From first call to audit-ready
- 01
Free call
A 30-minute call. No sales pitch. You leave with your top three gaps.
- 02
Assess
We review your cloud, controls and policies, and size the work.
- 03
Build
We build the roadmap and help your team close the gaps.
- 04
Audit-ready
We support you through the audit and keep the program running.
20+years in IT, cloud and security
100+cloud environments built and secured
48hto a written proposal after your free call
2 to 4weeks to a full gap assessment
Why Black Castle
A security leader who speaks cloud.
Most compliance consultants come from audit and policy work. Black Castle is led by a security engineer with over 20 years in IT, cloud and security, who works directly with your engineers. Controls fit how your team ships software, not the other way around.
About Black CastleDirect senior access
You work with the person doing the work. No hand-offs to juniors.
Engineering depth
Hands-on with AWS, Google Cloud, Kubernetes, Terraform.
Works with your tools
We run the program that Vanta, Drata or Secureframe support.
US and Canada
SOC 2 and HIPAA, plus PIPEDA and Quebec Law 25.
FAQ
Common questions
What is a fractional CISO?
A fractional CISO, or vCISO, is a senior security leader who works with you part time. You get the strategy, audit experience and customer-facing credibility of a CISO for a monthly fee instead of a full-time salary.
Are you a SOC 2 auditor?
No. We prepare you for the audit. A licensed CPA firm performs the SOC 2 audit and issues the report. We can introduce you to audit firms we trust.
Do we need a compliance platform like Vanta or Drata?
Not always. A platform helps collect evidence, but it does not run the program. If you already have one, we run it for you. If not, we help you decide whether you need one.
How long does SOC 2 readiness take?
Most cloud-native companies are ready for a Type 1 audit in two to four months. A Type 2 report then covers an observation period of three to twelve months.
Who do you work with?
Cloud-native SaaS companies with 10 to 200 employees in the United States and Canada, usually selling to enterprise or healthcare customers.
Find out how far you are from audit-ready
A free 30-minute call. No sales pitch. You leave with your top three gaps.