Compliance shouldn’t be a privilege of scale.
We are a governance, risk and compliance firm in Akron, Ohio, with the security and software teams that make those controls real. Our clients face the same audits and the same buyer questionnaires as companies ten times their size — without a compliance department to own any of it.
Who we built this for.
A framework doesn’t care whether you have anyone to run it. SOC 2 turns up because an enterprise deal stalls without it. HIPAA applies the day you handle protected health information, whether or not anyone was hired to manage that. A federal contract clause names CMMC regardless of headcount. The obligation lands on the clinic, the law firm, the manufacturer and the software company holding its first enterprise security questionnaire — whether or not there’s a compliance department to own it.
Kings Consult exists for that gap: companies where the obligation is real and the ownership isn’t, where somebody has to answer the questionnaire, get ready for the audit, or close the gap, and that somebody doesn’t otherwise exist inside the business. The same rigour a framework actually demands, sized and priced for the business that has to carry it — not the enterprise it was written for.
In practice that means proportionate advice instead of a one-size-fits-all playbook, engagements scoped to a real budget rather than an enterprise one, and a consultant who explains what they found rather than hiding it behind jargon. Whatever your size or budget, the goal is the same: the obligation gets a name, an owner and a plan — instead of staying an open question until an auditor or a regulator asks it for you.
“Robust cybersecurity made affordable, streamlined, and dynamic — so you can take control of your cyber risk whatever your size, budget, or in-house skill.”
Kings Consult · Mission statement
Three practices, one accountable team.
A company without a security team usually ends up with a scanning vendor, a compliance consultant and a development shop who have never spoken to one another. We cover all three, and they answer to the same engagement lead.
Security operations
Monitoring, penetration testing, vulnerability management and incident response — the day-to-day work of finding problems and closing them before somebody else finds them for you.
Security services →Governance, risk & compliance
SOC 2, ISO 27001, HIPAA, PCI DSS and the rest: readiness, evidence and audit support, without the headcount a framework quietly assumes you already have.
Governance & compliance →Software engineering
When the fix is a system rather than a setting, the same firm builds it — reviewed for security at each stage instead of assessed for it after release.
Software development →What we don’t negotiate on.
Plain language
If you need a security background to understand our report, we’ve written it badly. Findings arrive with what they mean, what they could cost you, and what to do about them — in the words you would use in a board meeting.
Proportionate advice
We recommend what fits your risk and your budget, not what maximises our invoice. Sometimes the honest answer is that a control can wait until next year, and we would rather say so than sell it to you now.
Evidence over assertion
Every claim we make about your security posture is backed by something we can show you: a configuration, a log line, a test result. “Trust us” is not a finding, and it will not survive an auditor.
Senior people, always
The consultant who scopes your engagement is the one who delivers it. Nothing quietly moves down a grade once the paperwork is signed.
Five things we won’t do.
Each of these is ordinary practice in this industry. None of them is in your interest.
-
We don’t sell fear.
Breach statistics make a persuasive slide and a poor plan. You get your own exposure, ranked by what it would actually cost you, and a straight answer about what can safely wait.
-
We don’t take a margin on tools.
We resell nothing. That is the only reason we can tell you the licence you already own is enough, or that the platform you were quoted is three sizes too big.
-
We don’t send in a second team.
The people in the scoping call are the people doing the work. There is no senior pitch followed by a junior delivery.
-
We don’t hand over a PDF and disappear.
A findings report nobody can act on is an invoice, not a deliverable. Every engagement ends with a live walkthrough and a remediation plan somebody on your side owns.
-
We don’t lock you in.
Scope and price are fixed before work begins. Ongoing engagements carry on because they are worth carrying on, not because of a termination clause.
What working with us looks like.
A conversation, not a pitch
The first call is scoping. We want to know what set this off — a customer questionnaire, an audit date, an incident, a question from the board — because the answer changes what is worth doing first.
A scope and a fixed price
What is included, what is not, who does what, and what it costs. In writing, before anything starts, so there is no change order waiting halfway through.
We look at what is actually running
Not at what the documentation says is running. Assessments work from live configuration, real traffic, and the systems somebody stood up two years ago and never wrote down.
A readout you can act on
Findings ranked by business impact, written in plain language, and walked through live — so the questions get answered in the room instead of in a follow-up thread a week later.
The work, then the handover
We fix what we were engaged to fix, alongside your team or on their behalf, and leave your side able to keep it running without us.
Before you get in touch.
Organisations without a dedicated security function — which in our experience has less to do with headcount than with ownership. A 30-person practice and a 300-person manufacturer have the same underlying problem if security is something the IT manager gets to on Fridays. If you already run an internal security team and want extra capacity, that is a different kind of engagement and we are happy to scope it, but it is not what the firm was designed around.
No. Keeping systems running and proving those systems are secure are different jobs, and the second one is hard to do credibly if you also own the first. We are set up to work alongside an existing IT team or managed service provider — we assess, prioritise and advise; they keep operating what they operate. Where remediation falls to them, they get the same plain-language plan you do.
No, and that distinction matters. We get you ready for audit: gap assessment, remediation, controls, evidence collection, and sitting with you through the assessment itself. The audit is the formal, independent examination performed by a licensed CPA firm or an accredited certification body. No firm can honestly do both for the same client, which is why we prepare the evidence package and work with whichever auditor you choose.
Project work is fixed scope and fixed price, agreed in writing before anything begins. Ongoing services — monitoring, vulnerability management, continuous compliance — run on a monthly fee tied to what is actually in scope. You will not receive a change order for something that was inside the boundary we agreed.
Usually, because the question is rarely whether you have controls. It is whether they are the right ones for your risk, whether they are configured the way you believe they are, and whether you can show an auditor or a customer that they have been working. Those three answers are what an assessment produces. If it turns out you are in better shape than you thought, that is a useful result too.
No. Assessment, governance and software work runs remotely as standard, with on-site time where the engagement genuinely calls for it — physical security reviews, incident response, or a workshop that is better done in a room. We are based at 111 St Leger Ave in Akron, Ohio, and work with clients elsewhere in the country.
Work with people who explain themselves.
A no-obligation risk assessment, scoped to your business and delivered by a senior consultant.