FOR THE FILE
Red Stick Solutions on two printed sheets, front and back.
The person who recommends a firm is rarely the person who signs for it. This is the firm on two sheets; each section says where its full text is.
The entity, the people and the market.
- Entity
- Red Stick Solutions, L.L.C., a cybersecurity and AI governance firm in Baton Rouge, Louisiana, formed in 2003. Two practices.
- Address
- We do not publish a street address. A full mailing address and registration details are provided on request and appear on every engagement contract.
- Sign off
- Every deliverable is reviewed and signed off before it leaves the firm.
- Market
- Financial services: banks, credit unions, insurers, mortgage lenders and servicers. Mortgage is the specialization; the work travels.
- Advice
- Not tied to product sales; commercial relationships disclosed in writing first.
In full on About and its procurement file.
What can be bought, in its published scopes.
| Offer | In one line |
|---|---|
| Security Assessment | Core with four review areas, or Full with eight. |
| Its four deliverables | Executive Summary, Findings Register, Risk Context, Ranked Roadmap. |
| Platform Review | The smaller first step: one platform, read only, against a written baseline. |
| Offensive security | Continuous Offensive Security Testing (COST), Red Team, Purple Team; a result an examiner, board or counterparty can use. |
| Cyber defense | Detection and response design, cloud and identity hardening. |
| Vulnerability Management | The continuing scanning and remediation program. |
| AI governance | Five engagements, inventory to monitoring, and the evidence behind them. |
| Advisory and vCISO | Security program ownership, board and leadership reporting, a continuing advisory relationship. |
Eight published commitments, not intentions.
- Fee and duration in writing before you sign: in the first conversation for a published scope, once a written scope is agreed for any other.
- A first reply from a principal within one business day. Name a date and that reply says whether we can meet it.
- One round of verification of remediated findings included on testing and assessment engagements. Further rounds are quoted.
- Red Stick Solutions will not assess or test a security program it owns as virtual CISO for the same client in the same period.
- If an engagement is interrupted for any reason, you keep everything produced to that point.
- No subcontractor on your engagement without telling you first, and you can decline.
- We will tell you within two business days of becoming aware of any incident affecting your material.
- References are provided at proposal stage, under NDA, on request.
Each is stated in full, with its conditions, on Trust and Assurance.
What this firm does not do.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
- It does not give legal advice, does not advise on licensing, and guarantees no one's compliance.
- It does not operate a security operations center, monitor overnight or answer alerts.
- It does not perform statistical fairness testing or independent quantitative model validation, which are distinct disciplines with their own practitioners.
- In a live incident the correct call is to the breach counsel and response provider carried on your insurance policy, and this firm will say so rather than take the work.
Four answers come in writing, since we publish only what we can state: attestation, insurance, personnel screening, engagement data handling.
Ask for any of the four and you have the answer in writing within two business days.
An answer may be that nothing is held in the form you want. In full: Trust and Assurance, Partners, Legal.