The credentials and expertise behind our work.
Certified leadership, deep framework fluency and engineers who have built what auditors test. Here is what stands behind every MarkTillson engagement.
Lola Osoba, CISA, CISM
Our founder holds two of the most respected credentials in information systems assurance and security management, both issued by ISACA. They set the bar for how every MarkTillson engagement is scoped, delivered and reviewed.
Meet our founderThe global standard for professionals who audit, control and assure information systems. It is why our evidence holds up to an auditor’s scrutiny.
The standard for leaders who govern security programs and manage risk. It is why our programs keep working after the engagement ends.
Frameworks we work in every day.
Not a list of logos. These are the standards our practitioners read, interpret and implement on live engagements.
| Framework or program | Governing body | How we help |
|---|---|---|
| PCI DSS v4.0.1 | PCI Security Standards Council | Scoping, segmentation, gap remediation and Report on Compliance readiness for merchants and service providers. |
| SOC 1 and SOC 2 | AICPA attestation standards | Control design, readiness and evidence that carry you to a clean opinion from your CPA firm. |
| ISO/IEC 27001 and ISO/IEC 42001 | International Organization for Standardization | Management systems built to pass certification at the first attempt, and to keep improving after it. |
| NIST Cybersecurity Framework 2.0 | National Institute of Standards and Technology | Maturity assessments and roadmaps that boards and regulators understand. |
| NIST SP 800-171 and CMMC | Department of Defense and The Cyber AB | Practice-by-practice readiness so defense suppliers walk into their assessment prepared. |
| FedRAMP and GovRAMP | FedRAMP PMO and GovRAMP | System security plans, control implementation and authorization packages for cloud offerings. |
| HITRUST CSF and HIPAA | HITRUST Alliance and HHS | Scoping, remediation and evidence ready for validated assessment and regulatory review. |
| DORA and SWIFT CSCF | EU supervisors and the Swift Customer Security Program | ICT risk, resilience testing and control attestation support for financial institutions. |
| AWS, Microsoft Azure and Google Cloud | Cloud provider security benchmarks | Secure landing zones, posture management and identity hardening, engineered as code. |
Every proposal names the practitioners who will lead your engagement, with their experience and individual certifications.
Depth where trust is tested.
10 years of delivery across six domains.
Payment securityPCI DSS v4.0.1 · PCI PIN · PCI P2PE · PCI 3DS · PCI SSF
Banking & resilienceSWIFT CSCF · DORA · NIS2 · NYDFS Part 500 · FFIEC
AI governance & securityISO/IEC 42001:2023 · NIST AI RMF · EU AI Act · OWASP LLM Top 10
Government & attestationFedRAMP · CMMC · SOC 1 · SOC 2 · ISO/IEC 27001:2022 · HITRUST CSF · HIPAA
Cloud security engineeringCIS Benchmarks · CSA CCM · NIST SP 800-53 · Zero Trust
Offensive securityOWASP ASVS · OWASP MASVS · PTES · MITRE ATT&CKWhat to ask any adviser before you sign.
Ask for the names, certifications and experience of the people on site, not only the people in the pitch.
Advisers who have engineered controls give better advice about testing them.
By scanner score, or by what would actually hurt the business?
Evidence, runbooks and trained owners, or just a report?
Independence. We tell you plainly when a task belongs with your certification body, CPA firm or accredited assessor, and we work alongside them so their assessment goes smoothly.
Put certified expertise on your side.
Tell us your deadline. We will confirm scope, approach and team in writing.