Partners
We lead the security program. Our partners do the hands-on and credentialed work. The client gets both, with each role written down.
An example
An illustration of how the roles fit together.
A small water utility has to show that its control systems are protected. The board wants a plan it can approve, the auditors want proof, and the operators want to keep the water running.
Security Medic assesses the utility against the rules that apply, writes the plan and the policies, and reports to the board in plain language. Some fixes need hands in the control room: separating the plant network from the office network, for example. That work goes to an OT specialist who does it every day, under its own terms with the utility.
The utility gets one program with one owner. The specialist gets a well-scoped project with the requirement behind it already explained. And every finding is fixed by the people best placed to fix it.
How we partner
Security Medic delivers its governance, risk, compliance and assessment work itself. When a client also needs work we do not offer, such as installing equipment, testing systems, monitoring around the clock or issuing a certification, attestation or PCI Report on Compliance, we bring in a partner who specializes in it.
- Roles in writing first. Who does what, who the client contracts with and the dates are agreed in writing before anyone speaks to the client.
- Clients stay with the side that brought them. We protect our partners’ client relationships and staff, and expect the same.
- Honest credit. Each firm presents its own experience and its own credentials under its own name.
- Confidential by default. A mutual non-disclosure agreement comes before any client name or detail is shared.
- Give first. We pass along work that fits a partner better than it fits us.
- The client decides. The client’s leadership approves its policies, accepts its risks and signs its own filings and attestations.
What the work is measured against
Every joint engagement names two things, and keeps them apart:
- The obligation is what the client must meet: a law or regulation such as the HIPAA Security Rule or NYDFS Part 500, or a contract such as an insurer’s questionnaire or a card-payment agreement.
- The standard is how it is met and checked: for example NIST Cybersecurity Framework (CSF) 2.0, NIST SP 800-53, CIS Controls or PCI DSS.
That gives every partner a clear target: the requirement behind the work, and how the result will be checked.
Who we partner with
IT providers (MSPs)
Managed service providers that run IT for small and mid-sized businesses and public bodies.
What Security Medic brings
The security program above the technology: risk assessment, policies, evidence for insurers and auditors, incident response planning, vendor reviews and reporting to the client’s leadership.
What the partner keeps
Every tool, every ticket and the client relationship. Gaps we find go back to the MSP as project work, because the MSP operates the tools.
Security installers and central stations
Licensed alarm, access control and video installers, and the central stations that monitor alarms around the clock.
What Security Medic brings
Physical security design: a walk-through of the site, the risks it faces, and a written specification of what to install and where, tied to the client’s policies.
What the partner keeps
Installation, programming, service and monitoring under the installer’s own licence, with the installer contracting directly with the client.
OT and industrial control systems
Control-system integrators and OT security specialists who work on SCADA, PLCs and plant networks, for example at water and wastewater utilities.
What Security Medic brings
The utility’s cybersecurity program: the assessment against the rules that apply, the plan, the policies, incident response planning and reports to the board or council.
What the partner keeps
Hands-on work in the control environment: network segmentation, field assessments, configuration and support of the control systems.
Penetration testing and vulnerability scanning
Testing firms that attack systems the way an adversary would, with permission, and firms that run recurring vulnerability scans.
What Security Medic brings
Why the test is needed and what it must cover: the scope, tied to the client’s obligation. Afterwards, the findings go into the client’s risk register and remediation plan, in business terms.
What the partner keeps
The testing itself, under the tester’s own methods and rules of engagement, and the technical report.
Incident response and forensics
Firms that contain a live attack, investigate what happened and preserve evidence.
What Security Medic brings
The incident response plan and the tabletop exercise that tests it before anything goes wrong. During an incident, coordination against the plan, a record of decisions, and support for the client and its counsel on notification duties.
What the partner keeps
Technical response and forensic investigation, under its own terms with the client or its counsel.
Managed detection and response (MDR)
Providers that watch a client’s systems around the clock and act on alerts.
What Security Medic brings
What the monitoring must cover and how fast alerts must be handled, written into policy, and a regular check that the evidence shows it is working.
What the partner keeps
The monitoring service, its platform and its security operations team.
PCI Qualified Security Assessors (QSAs)
Assessor firms qualified by the PCI Security Standards Council to issue a formal Report on Compliance.
What Security Medic brings
Preparation: scoping the card environment, readiness work against PCI DSS, the evidence register and a mock assessment, so the client arrives ready.
What the partner keeps
The formal assessment and the Report on Compliance. Only the assessor issues it.
Cloud engineering
Engineers who build and run workloads in AWS, Microsoft Azure, Google Cloud and other clouds.
What Security Medic brings
Cloud security governance: which controls the provider covers, which are shared and which are the client’s, and the proof for the client’s part.
What the partner keeps
Building, configuring and operating the cloud environment.
Health-IT and electronic health record vendors
Vendors whose systems run clinics, behavioral health programs and correctional health services.
What Security Medic brings
The client’s own obligations around the system, such as the HIPAA Security Rule and 42 CFR Part 2: risk analysis, policies, and security and privacy answers for bids and implementations.
What the partner keeps
The product, its implementation, hosting and support.
K-12 IT providers
IT providers and shared-service programs that run technology for school districts.
What Security Medic brings
The district’s data privacy and security program under New York Education Law § 2-d: the data security and privacy plan, policies, vendor contract reviews, training and reports to the board of education.
What the partner keeps
The district’s networks, devices, student systems and helpdesk.
Public-sector teaming: primes, M/WBE and SDVOB firms
Firms that lead large state and local government and education contracts, and New York-certified minority- and women-owned (M/WBE) and service-disabled veteran-owned (SDVOB) businesses.
What Security Medic brings
A named governance team member for bids that ask for security, privacy or AI governance, policy or assessment work alongside the prime’s delivery.
What the partner keeps
The prime contract and its delivery, or its own certified scope of work. Each firm’s role is written into the teaming agreement.
Where Security Medic stays
We stay in governance, risk, compliance and assessment, and we report to the client independently, including on how well the controls our partners operate are working. Findings about a partner’s work go to that partner first, so it can respond or fix them before the report is final.
We never sell the hands-on services our partners provide, and we never sign a client’s attestations for it.
How to start
- Book a free call. Thirty minutes to learn what your firm does, whom you serve and where our work meets yours.
- Sign a mutual non-disclosure agreement. This lets both firms talk about real opportunities.
- Agree the standing terms. A short partner agreement protects both firms’ clients and staff.
- Work one engagement at a time. Each joint engagement gets a short work order with the roles, who contracts with the client and the dates.
IT providers (MSPs): see the MSP partner program for the full responsibilities table and how a joint engagement starts, or how we work with IT providers.
Talk about partnering
Tell us about your firm and the clients you serve. We will talk through where a partnership fits and what a first joint engagement could look like.
Book a free call