True CyberChampion

How we work

Disciplined by design. Human by nature.

Every engagement follows a documented method with clear steps, named owners and quality gates. Here is how we work, so you know what to expect from the first meeting to the last report.

A True CyberChampion team works through an engagement plan around a boardroom table
Every stageends with a quality gate

Five principles behind every engagement

  • Quality gatesEvery stage ends with a defined check that must pass before the next begins.
  • Evidence over assertionWe show what was measured, tested or configured, not what we believe is true.
  • Standards-alignedEach stage maps to the NIST, ISO and federal frameworks our clients answer to.
  • Two-person reviewNo deliverable leaves the firm without a second qualified reviewer.
  • Plain languageLeaders get decisions, not jargon: what matters, what it costs, what to do next.

01 · Cybersecurity consulting

TCC Assurance Lifecycle

Six phases that take an organization from an unclear scope to a secure, provable and continuously monitored environment. The same lifecycle runs every engagement, whether the goal is a FISMA authorization, CMMC certification, HIPAA or PCI DSS compliance, or a hardened Azure environment.

  1. 01Scope
  2. 02Assess
  3. 03Engineer
  4. 04Prove
  5. 05Authorize
  6. 06Monitor

Monitoring feeds the next cycle of scoping, so the program keeps improving.

  1. 01

    Scope

    Define the mission, systems, data and frameworks that apply, so effort goes where risk actually is.

    How we do it
    • Interview leaders and system owners
    • Inventory systems, data and data flows
    • Confirm which frameworks apply
    You receive
    Scope statement and boundary diagramAsset and data-flow inventoryEngagement charter with named owners
    Quality gateScope and boundary signed by the system owner
  2. 02

    Assess

    Measure the current state against every requirement, objective by objective, and rank the risk.

    How we do it
    • Examine, interview and test against each requirement
    • Review cloud and identity configuration
    • Score and rank risk in business terms
    You receive
    Gap assessment by requirementRisk register with likelihood and impactPrioritized remediation roadmap
    Quality gateFindings validated with your technical team before reporting
  3. 03

    Engineer

    Close the gaps with working controls, not only paperwork.

    How we do it
    • Harden configurations to recognized baselines
    • Put identity, access and Zero Trust controls in place
    • Turn on logging, monitoring and alerting
    You receive
    Implemented configurations, as code where possibleSystem security plan and policy setPOA&M for anything deferred, with dates and owners
    Quality gatePeer-reviewed changes with a tested rollback plan
  4. 04

    Prove

    Produce the evidence an assessor, examiner or auditor will actually test.

    How we do it
    • Map evidence to every assessment objective
    • Run a mock assessment the way the assessor will
    • Crosswalk to every framework in scope
    You receive
    Assessor-ready evidence packageMock assessment reportControl crosswalk
    Quality gateIndependent internal quality review (two-person rule)
  5. 05

    Authorize

    Guide you through the formal assessment, authorization or certification.

    How we do it
    • Work alongside your assessor or authorizing official
    • Answer findings quickly and clearly
    • Brief leadership on residual risk
    You receive
    Authorization package or assessment responseUpdated POA&MRisk acceptance briefing for leadership
    Quality gateAuthorization, certification or attestation decision
  6. 06

    Monitor

    Keep posture current so compliance is a daily state, not a yearly event.

    How we do it
    • Watch controls and catch drift
    • Keep the plan of action current every month
    • Review risk with leadership every quarter
    You receive
    Monthly posture report and dashboardContinuous monitoring deliverablesAnnual program review
    Quality gateQuarterly leadership review of risk and progress

Used forFISMA and FedRAMPCMMCHIPAAPCI DSSBanking and GLBAAzure and Microsoft 365

Two engineers review a tablet in a security operations center

We do not hand you a binder and leave. Our engineers sit with your team, fix what we find and stay until the evidence holds up.

True CyberChampion delivery team

02 · AI systems

TCC AI Delivery Standard

Seven steps that every AI use case passes through, scaled to its risk. Low-risk productivity tools move quickly; high-impact systems get full testing, executive approval and continuous monitoring. Clients can adopt this standard as their own AI governance procedure.

  1. 01Intake
  2. 02Classify
  3. 03Design
  4. 04Build
  5. 05Test
  6. 06Approve
  7. 07Monitor

The risk tier sets how much control each AI system needs

  • Tier 1 · Low
    Applies when

    Internal productivity with no sensitive data, human always reviews output

    Controls required

    Standard guardrails, approved tools only, spot checks

  • Tier 2 · Moderate
    Applies when

    Sensitive data, or customer-facing content reviewed by a person

    Controls required

    Privacy review, evaluation report, human review of outputs, quarterly monitoring

  • Tier 3 · High
    Applies when

    Affects rights, safety, money or eligibility, or acts with autonomy (high-impact AI)

    Controls required

    Full TEVV and red-teaming, executive approval, human decision authority, continuous monitoring, incident playbook

  1. 01

    Intake

    Register the use case so nothing reaches production unseen.

    How we do it
    • Capture purpose, owner and expected value
    • Identify data sources and sensitivity
    You receive
    Use-case record in the AI inventoryNamed business and technical owners
    Quality gateOwner and measurable value defined
  2. 02

    Classify

    Assign a risk tier that sets the controls the use case must meet.

    How we do it
    • Review privacy, impact and autonomy
    • Assign a risk tier that sets the controls
    You receive
    Risk tier (1, 2 or 3) with rationaleRequired control set for that tier
    Quality gateTier approved by the AI governance lead
  3. 03

    Design

    Decide how the system will work, where people stay in control, and how success is measured.

    How we do it
    • Set acceptance thresholds up front
    • Decide where people stay in control
    You receive
    Design specificationControl and oversight plan
    Quality gateDesign review by security, privacy and the business owner
  4. 04

    Build

    Build securely with approved tools and the least data and privilege needed.

    How we do it
    • Use approved models and platforms
    • Least data, least privilege, secure by design
    You receive
    Working system or configurationSystem card and documentation
    Quality gateCode and security review
  5. 05

    Test

    Prove the system is accurate, safe and fair enough for its tier before anyone relies on it.

    How we do it
    • Measure accuracy against ground truth
    • Red-team for injection, leakage and misuse
    You receive
    Evaluation (TEVV) report with measured results and varianceResidual risk statement
    Quality gateMeets acceptance thresholds for its risk tier
  6. 06

    Approve

    Make a documented, accountable decision to deploy, and prepare the people who will use it.

    How we do it
    • Accountable sign-off, executive for Tier 3
    • Train the people who will use it
    You receive
    Approval recordUser guide and training
    Quality gateSign-off by the accountable official
  7. 07

    Monitor

    Watch performance in the real world, and retire the system when it no longer earns its place.

    How we do it
    • Track accuracy, drift and incidents
    • Reassess, and retire when it no longer earns its place
    You receive
    Monitoring dashboardQuarterly review
    Quality gateAnnual recertification
  8. Three colleagues review an AI solution together on a tablet

    People stay in control. Every step has a named human owner, and Tier 3 systems keep a person in the decision.

Aligned toNIST AI RMFISO/IEC 42001OMB M-25-21NIST SP 800-53

03 · AI workforce training

Capability Proof System

Six stages and four integrated frameworks that design, develop, deliver and prove AI skills, so organizations get capability, not just completion rates.

  1. Diagnose
  2. Design
  3. Develop
  4. Deliver
  5. Prove
  6. Sustain
  1. 01

    Diagnose

    Understand your policy, roles and baseline skills.

    How we do it
    • Review your AI policy and tools
    • Baseline what each role can do today
    You receive
    Role map and baseline
    Quality gateSigned Outcome Contract
  2. 02

    Design

    Set outcomes and weight skills by role.

    How we do it
    • Weight skills by role
    • Agree outcomes you can measure
    You receive
    Program design
    Quality gateDesign approved
  3. 03

    Develop

    Build Work-Twin scenarios from real tasks.

    How we do it
    • Build scenarios from your real tasks
    • Review them with your leads
    You receive
    Labs and job aids
    Quality gateScenarios reviewed by your leads
  4. 04

    Deliver

    Hands-on labs where people produce first, then improve.

    How we do it
    • Coaching in the room, on your own work
    • Everyone launches a real work product
    You receive
    Launched work products
    Quality gateEvery participant launches a real work product
  5. 05

    Prove

    Measure what people can now do.

    How we do it
    • Compare before and after work samples
    • Report measured improvement
    You receive
    Evidence Report
    Quality gateMeasured improvement against baseline
  6. 06

    Sustain

    Make the skill stick.

    How we do it
    • Short follow-up drills at 30, 60 and 90 days
    • Check that the skill stuck
    You receive
    Sustainment report
    Quality gate90-day review

See why traditional AI training fails, and how this system fixes it →

Transparency you can count on

What you will see, every week of the engagement

  • Weekly statusProgress, risks and decisions needed, in plain language
  • Named ownersA person, not a team inbox, for every deliverable
  • Open findingsYou see every finding as we confirm it, with no surprises at the end
  • Shared evidence trailEvery claim is backed by something you can check

Our detailed playbooks, templates and tools are part of every engagement and stay with the delivery team.

A smiling team meets around a table
A consultant explains an approach to a client team

See how it fits your mission

Tell us what you are working toward. We will walk you through how we would deliver it.

Talk to our teamBack to home
True CyberChampion

This page is available online only. To discuss our methodology, contact beza@truecyberchampion.com or call 240-476-3268.