Not sure where to start? Tell us where you are.

Critical-infrastructure operators and the OT integrators who work for them, especially operators whose remote sites run over cellular, radio, or satellite links. Most work comes through the integrator or prime that holds the contract, and a direct operator engagement is scoped the same way: fixed price, under a Statement of Work. State and local work comes through utilities and integrators, and federal work through a named prime. Advisors, vCISOs, and MSPs can bring us in behind their own client relationship.

FEDLIN runs one security program, delivered in five phases. (1) Security Assessment & Gap Analysis: threat model and gap assessment mapped to your target framework. (2) Control Implementation: security controls built at the infrastructure layer, CI/CD gates, IAM enforcement, and continuous evidence instrumentation. (3) SSP Development: system boundary documentation, control narratives, and control-to-framework mapping. (4) Compliance Readiness Review: pre-audit control validation before fieldwork begins. (5) Evidence Pipeline & ConMon Setup: GRC platform configured to collect continuously against your actual stack. Clients run the full program, or enter at the phase that fits where they are.

Yes. AI-native security is a core part of the practice. Agentic systems, MCP servers, and LLM integrations introduce a compliance perimeter that standard gap assessments don't reach: context boundary enforcement, tool-call access scope, prompt injection exposure, and audit logging fidelity. We assess and harden these surfaces against SOC 2 and PCI-DSS control requirements, and map findings to NIST AI RMF, the framework enterprise buyers and regulators are increasingly referencing for AI governance.

Yes. This is one of the most common entry points. Vanta surfaces the gaps; we own the technical layer that closes them. That means deploying the controls, wiring the evidence pipeline, and getting your dashboard from red to audit-ready. If you have persistent failures on specific controls (CC6.1, CC7.2, CC8.1), that's exactly the kind of scoped remediation work we take on.

SOC 2 (Trust Services Criteria), PCI-DSS, NIST 800-53 Rev 5, and ISO 42001. The underlying methodology is NIST CSF, which maps to all of them, and NIST AI RMF for engagements that include AI-native infrastructure. If you're targeting a framework not listed, ask. Most structured frameworks overlap significantly with these.

Scope and starting posture determine this more than any fixed timeline. The Architecture Review typically returns a gap report within two to four weeks. Targeted control remediation sprints close specific gaps in two to four weeks. A full program build (Architecture Review through Evidence Pipeline) typically runs two to three months. We define scope before any work begins so you know what's included and what the timeline looks like.