Built in Dallas. Built to be proven.
Lola Osoba founded MarkTillson in 2016 after seeing too many organizations pass an audit on Friday and fail an attacker on Monday. Ten years later, that is still the gap we close.
Systems built by one team. Controls checked by another. Nobody owning the gap.
Technology teams shipped what the business asked for. Compliance teams documented what they were told. Auditors tested what was in scope. Then the incident arrived through the system nobody had connected to the control that was supposed to protect it.
A clean report on the wrong scope is worse than no report at all.
Ten years, one standard.
How a single Dallas practice became a three-practice firm, one capability at a time.
- 2016
Founded in Dallas
Lola Osoba incorporates MarkTillson LLC in Dallas, Texas, with one idea: the people who build technology and the people who audit it should work from the same plan.
- 2017
IT audit and compliance readiness
The first service lines take shape: IT general controls, SOC readiness and the evidence programs that carry clients through their audits.
- 2018
Payment security
PCI DSS readiness, scoping and segmentation work begins for merchants and service providers that handle card data.
- 2019
Cloud security engineering
As clients move to AWS, Azure and Google Cloud, MarkTillson builds a cloud engineering practice that designs secure landing zones rather than reviewing them afterward.
- 2020
Resilience under pressure
A year of remote everything. Continuity, identity and ransomware resilience become core services as clients rebuild how they operate.
- 2021
Offensive security
Application, network and cloud penetration testing join the firm, so the controls we design are attacked before anyone else attacks them.
- 2022
Federal and defense readiness
FedRAMP and CMMC readiness programs help software providers and defense suppliers meet the government’s bar.
- 2023
Multi-framework programs
One evidence model for SOC 2, ISO/IEC 27001, PCI DSS and HITRUST, so clients stop paying to prove the same control four times.
- 2024
AI governance
ISO/IEC 42001, the NIST AI Risk Management Framework and AI red teaming for organizations putting models into production.
- 2025
Financial services resilience
SWIFT CSCF and DORA programs for banks and payment institutions with international obligations.
- 2026
Ten years
Three practices, 35 service lines and eight industries, led from Dallas by the founder who started it.
Build it right. Prove it works. Keep it that way.
Architecture designed with the audit already in mind.
Evidence programs that turn audits into a formality.
Models that reach production governed, tested and defensible.
Five habits we never trade away.
- 01Scope before controlsData flows and trust boundaries come first.
- 02Evidence that holdsAny conclusion can be re-performed by a skeptic.
- 03Findings by consequenceSeverity reflects real-world impact.
- 04Engineering with the audit in mindWhat we build is ready to be tested.
- 05Practitioners on the workThe person who scopes it delivers it.
The firm organizations call when the answer has to be right.
Today we design, secure and evidence technology across payments, banking, SaaS, cloud, AI, healthcare and government. The conviction we started with in 2016 still runs every engagement: work is only finished when it can be proven.
Work with a firm that tells you the truth.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.