An Independent Security Assessment of a County Health Department

The independent-assessor role is not a new service for me. It goes back to the start of my career — and it is still one of the most valuable things a business can buy, precisely because almost nobody selling it is actually independent.

In the early 2000s, during the wave of heightened security scrutiny that followed 9/11, I led a four-person team through a full cybersecurity assessment of the Oklahoma City-County Health Department — a top-to-bottom review of a government agency’s security posture, reported straight to leadership in a written assessment.

The engagement

We examined how the agency’s systems, access, and data were actually protected — not how the documentation said they were. The deliverable was a written report leadership could act on: what the real exposures were, ranked, and what to do about them. No products attached, no services to upsell. Just an honest read of where things stood.

Why “independent” is the whole point

Here is the structural problem with most security assessments: the company performing the assessment also sells the fix. When the assessor profits from what they find, the findings are never fully neutral — not because they are dishonest, but because that is how the incentives are built. An independent review has nothing on the invoice arguing for one conclusion over another.

What I do with this today

It is the same role, scaled to small and mid-sized business: verifying whether the security you are already paying for actually holds up. Vendor-neutral, nothing to sell — I assess your posture and risk, hold your MSP and vendors accountable to a real standard, and translate it into terms leadership can act on. If your MSP says security is “handled,” an independent set of eyes is how you find out whether that is true before an attacker does.

← All articles