SaaS founders facing a first SOC 2
You're chasing enterprise deals and the security questionnaire just landed. You need a Type 1 quickly, then a path to Type 2 — without spending six months building it twice.
Orlando, FL · Veteran-Owned · Official Drata Partner · CISSP-Led
Drata consultant in Orlando. Guidance on the instance, not just the license.
I'm Larry Downard — CISSP-credentialed, veteran-owned, Orlando-based. Cyberneza is an official Drata partner. The engagement delivers the control mapping, the list of integrations and monitors to connect, the policy set, the evidence list, and audit preparation. Each Drata configuration is specified in writing and reviewed with you against your own instance.
Fixed-fee engagements · Most readiness projects completed in weeks, not quarters · Free Consultation.
CISSP·
CRISC·
CCSK·
CCZT·
Official Drata Partner·
Veteran-Owned·
Orlando, FL
Who I work with
A short list — on purpose
I take a small number of engagements at a time so I can run them personally. These are the three situations where teams typically reach out about Drata.
Teams that bought Drata and stalled
The platform is sitting half-configured. Monitors are failing, policies aren't tailored, integrations aren't producing the right evidence. You need someone who reads the instance and tells you exactly what to change.
MSPs and IT firms needing a Drata partner
You're an MSP whose client is asking for SOC 2 help and you don't want to refer the work to someone who might compete with you. We co-deliver — your client relationship, my Drata and compliance expertise.
Service area
Based in Orlando. Delivered remote across the U.S.
Cyberneza is headquartered in Orlando, and on-site work within driving distance is available for engagements that benefit from it. Everything else is delivered remotely. Most Drata and SOC 2 work is remote-native anyway, so geography rarely drives engagement scope.
What I deliver
Five things, done well — instead of fifty, done shallow
Cyberneza is intentionally narrow. These are the engagements I personally lead. If you need something outside this list, I'll tell you and point you to someone who specializes in it.
Drata implementation guidance and SOC 2 readiness
Partner-priced licensing (or work with your existing instance), control mapping, the integration and monitor plan, policy tailoring, evidence wiring, and audit coordination. More about our Drata work →
Drata Configuration Review
A fixed-fee review of a Drata instance that is already running: failing monitors explained, integrations producing the wrong evidence identified, template policies flagged, and a prioritized change list you can act on the same week.
ISO 27001 readiness on Drata
Statement of Applicability, risk assessment, the ISMS policy set, and the evidence plan — mapped to Drata's ISO 27001 framework so one instance serves both reports. More about ISO 27001 readiness →
Fractional CISO
Senior security leadership on a fractional basis — for SaaS teams that need a CISO seat at the table without a full-time hire. Risk strategy, security roadmap, board-ready reporting. More about vCISO advisory →
Security gap assessment
A fixed-fee, fixed-scope review of where you stand against SOC 2 — before you commit to a full readiness program or a platform subscription. More about gap assessments →
The difference
Guidance on the instance — not a license handoff, not a deck
What most "Drata consultants" actually do
- Resell the license, then hand the work to a junior partner
- Run discovery, hand you a slide deck, walk away
- Offshore the policy writing and the Drata setup
- Bill hourly so timelines drift
- Give advice that never looks at the Drata configuration
How I work
- I'm the same person on the discovery call, the kickoff, and the audit prep
- I review the Drata configuration with you — integrations, monitors, policies, and evidence
- I review your AWS/Azure/GCP/Workspace configs against the controls they map to
- Fixed fee. You know the cost before we start.
- I run a small client load on purpose so engagements get my attention
How an engagement runs
Four phases. No surprises.
Discovery
Free Consultation. We talk about your stage, your stack, your customer pressure, and your timeline. If we're not a fit, I'll say so on the call.
Scoping
Fixed-fee proposal within 24–48 hours. Scope, deliverables, timeline, and price — all in writing before any commitment.
Configuration guidance
The Drata configuration specification, integration and monitor tuning guidance, policy tailoring, evidence wiring, and weekly working sessions reviewing each change against the control it serves.
Audit-ready handoff
Auditor selection support, audit kickoff prep, evidence-package review, and on-call backup during the audit window.
About the founder
Meet Larry Downard — your Drata consultant in Orlando
I'm Larry Downard Jr., founder and principal consultant at Cyberneza LLC. I'm based in Orlando, Florida, and I've worked in cybersecurity since 1997 — including senior architecture roles supporting enterprise banking, government cloud, and large-scale SaaS environments. Earlier in my career I helped run operations for one of the U.S. Department of Defense's earliest SaaS programs.
Cyberneza is intentionally a small practice. I run a limited client load so I can stay in the work — specifying the Drata configuration, mapping controls, writing policies that match how a company actually operates, and standing next to the team during the audit. That's the engagement I wish I could have hired when I was on the buy side.
Credentials
- CISSP — (ISC)²
- CRISC — ISACA
- CCSK v5 — Cloud Security Alliance
- CCZT — Cloud Security Alliance (Zero Trust)
- BS, Computer Information Systems
- 29+ years across banking, energy, government, and SaaS security
- Official Drata Partner · Authorized Vanta MSP Partner
- SBA-Certified U.S. Veteran-Owned Small Business (SAM-registered)
FAQ
Questions Orlando founders usually ask first
Are you actually located in Orlando?
Yes. Cyberneza LLC is a Florida-registered business headquartered in Orlando. Engagements are led personally by me — I live and work in the Orlando area.
Do you only take Orlando clients?
No. Orlando is home base. I work with clients across Florida and the United States. Most Drata and SOC 2 work is delivered remotely regardless of geography.
Is Cyberneza an official Drata partner?
Yes. Cyberneza is an official Drata partner and an authorized Vanta MSP partner, and recommends the platform that fits your stage, budget, and stack. The same person who runs your discovery call specifies the Drata configuration, maps your controls, reviews the evidence, and prepares you for the audit.
What is a Drata Configuration Review?
A fixed-fee, fixed-scope review of your Drata instance against your target framework: which monitors are failing and why, which integrations are producing the wrong evidence, which policies still read like templates, and what to change first. You get a written findings report and a prioritized change list.
How long does Drata and SOC 2 readiness take?
Most readiness projects finish in weeks, not quarters. A Drata Configuration Review takes 5–10 business days. Total time depends on your starting point and the complexity of your environment.
Can Cyberneza issue the SOC 2 report?
The SOC 2 report is issued by an independent CPA firm. Cyberneza prepares the evidence package, coordinates auditor selection and the audit kickoff, and stays on call during the audit window so the questions that come back get answered quickly.
Ready to talk?
Free Consultation. No pitch deck. We figure out whether Drata + SOC 2 readiness with Cyberneza is the right move for your team — and if it isn't, I'll tell you what I'd do instead.
- Email: info@cyberneza.com
- Location: Orlando, Florida
- Platform page: Drata implementation guidance →
- Prefer Vanta? Vanta consultant in Orlando →