Cybersecurity & compliance consulting
Since 2002, Security Best Practices has helped organizations harden their networks, meet CMMC, SOC 2, HIPAA and PCI DSS requirements, and respond decisively when incidents happen. You work directly with a senior, CISSP-certified consultant.
Trusted by organizations including
Services
Four practice areas, delivered by the same experienced team from first assessment through remediation and ongoing support.
Gap assessments, remediation roadmaps and evidence preparation so you pass your audit or certification the first time.
Design, hardening and day-to-day support for the infrastructure that keeps attackers out and your users productive.
Senior security leadership on a fractional basis: strategy, policy and governance without a full-time executive hire.
Find the weaknesses before attackers do, and be ready with a tested plan if the worst happens.
Compliance frameworks
Regulations and frameworks keep changing. We track the latest versions and translate them into controls your team can actually operate.
Cybersecurity Maturity Model Certification for Department of Defense contractors handling FCI and CUI.
The updated Cybersecurity Framework, including the new Govern function for risk ownership and oversight.
The 110 security requirements for protecting Controlled Unclassified Information in non-federal systems.
AICPA Trust Services Criteria for service organizations, covering both Type I and Type II reports.
Security Rule risk analysis and safeguards for covered entities and business associates handling ePHI.
Payment Card Industry Data Security Standard v4.0.1, including the now-mandatory future-dated requirements.
The international standard for an information security management system (ISMS) and its updated Annex A controls.
Governance, risk management and material-incident disclosure requirements for public companies.
How we work
Understand your environment, obligations and risk, and measure where you stand today.
Deliver a practical roadmap ranked by risk reduction and audit impact, not vendor wish lists.
Implement controls, configurations and policies hands-on, alongside your team.
Test, document evidence and keep you compliant as threats and standards evolve.
About us
Security Best Practices, Inc. was founded in 2002 by Keith W. Salustro, CISSP®, a senior network security consultant with more than 25 years of specialized experience. A graduate of Brown University's engineering program, Keith has designed and supported security infrastructure for global banks, healthcare organizations, law firms and growing businesses, conducted security and compliance assessments, and spoken widely on information security.
Clients choose us because they work directly with an experienced practitioner who has seen what works in the real world and who explains risk in plain business terms.
Insights
AI agents don't just answer questions. They read your email, call APIs and take actions with real credentials. Here are the new risks, what the latest OWASP and NIST guidance says, and a practical checklist for governing agents safely.
From 600+ firewalls breached with nothing more than weak passwords to VPN zero-days exploited by ransomware crews, 2026 has shown that edge devices are attackers' favorite way in. Here's how to harden yours.
On November 10, 2026, third-party CMMC Level 2 certification becomes a condition of award for many DoD contracts involving CUI. Here's what changes, who is affected, and a practical readiness checklist.
Contact
Whether you're facing an upcoming audit, a CMMC deadline, a firewall project or a security incident, tell us what's going on. We'll respond within one business day.
Your message has been sent. We'll be in touch shortly.