Cybersecurity and Cyber GRC consultingFort Worth, Texas. Founded 2016.

Cybersecurity that protects the business. Not just the audit.

  • Customers need proof.
  • Requirements keep changing.
  • Risks need attention.
  • Your team is stretched thin.

And somehow, all of it lands on you.

Hotman Group is a CPA-led cybersecurity and Cyber GRC professional services practice. We bring leadership, independent perspective, practical expertise, and hands-on capacity across assessment, remediation, implementation, and ongoing operations.

Talk With Us See how we help
A cybersecurity leader on a video call reviewing priorities, risk decisions, and next steps.
Working with HGAn extension of your team: leadership, an independent view, and people who do the work.We care whether it actually works.
Business, finance, and security judgmentCPA-led
We assess, fix, implement, and operateHands-on delivery
Four verified client reviews
Certified woman-owned small businessWOSB

Selected client outcomes

Complex problems. Work that changes the outcome.

A few examples from our work. More are on the case studies page.

Customer security review

Banking contract, secured.

A niche service provider faced a major bank's security review that went beyond industry norms. We turned each demand into a risk decision, proposed alternative controls where they fit, and helped the client make a defensible case, without taking on unnecessary requirements.

Read the banking contract case
GRC technology, Trintech

Audit evidence, 95% reused.

Trintech consolidated more than 20 tools into one GRC platform and handled a 33% increase in audit volume without additional resources, reusing evidence across SOC, ISO, CSA, and DORA.

Also documented in StandardFusion's Trintech case study Read the Trintech case
Ongoing vGRC

400+ controls, operated.

As an ongoing extension of one organization's team, we help operate a five-framework program: monitoring controls, prioritizing remediation, and organizing audits. The program expanded while internal GRC headcount stayed flat.

Read the ongoing vGRC case

Our work spans federal and defense contractors, public SaaS and AI companies, organizations serving the financial sector, and health and wellness organizations, from first programs to complex multi-framework environments.

See all client results

The cost of waiting

When the work doesn't get done, the business feels it.

The work isn't hard to find. It's hard to finish with a team that already has a day job.

  • Deals stall.A customer security review can hold up a contract until you can show the right protection.
  • Findings return.Fixing for the auditor instead of the cause brings the same issues back next year.
  • Risk goes unowned.Without clear owners, leadership can't tell what is actually being managed.
Cybersecurity leader balancing customer requirements, audit findings, risk questions, and limited team capacity.

Meanwhile, on your desk

  • CustomerAnother security questionnaire.
  • New frameworkA requirement nobody planned for this year.
  • AuditA finding that needs to be fixed, not just answered.
  • Leadership"Where is our real risk?"
  • GRC platformBought to make this easier. Somehow it created more work.

That's where we come in.

We don't hand you a report and wish you luck. We help you decide what matters most, then help you get it done.

Talk With Us

Why Hotman Group

Every organization has a budget, a backlog, and only so many people. Good security has to work within all three.

There's rarely one right answer. The right one depends on your objectives, risk, resources, and maturity. We bring an independent perspective, find the responsible way forward, and keep the bigger objective in view, whether that means starting small or supporting a complex enterprise program.

  • We'll tell you what matters most, and what can wait.
  • We'll find a legitimate way forward within your budget and team.
  • We won't recommend work you don't need, even if you're ready to buy it.
  • We'll care whether it actually works, not just whether it's done.

The right first step isn't always the one on the purchase order.

A client was ready to buy a CMMC gap assessment. We could have taken the engagement. Instead, we asked whether it was the right first step.

What the client was ready to buyA gap assessment

Tens of thousands of dollars, before anyone knew where CUI lived.

The question we asked firstWhere does CUI actually live?

Seven ERP systems, and a major technology transformation underway.

What we recommendedScope first. Then assess.

So the client's investment would evaluate the right environment.

See this and other examples of independent judgment
See why clients choose HG

How we help

Wherever the problem starts, we help you solve it.

Our work spans cybersecurity strategy, program design, risk management, governance, compliance and frameworks, GRC technology, assessments, remediation, implementation, and ongoing operations. Most problems cross those lines. These are common starting points.

See all the ways we help

Security and GRC decisions are piling up, and no one senior has the time to own them.

Fractional CISO (vCISO) and vGRC support

Security leadership and GRC capacity that sets priorities, manages risk, and keeps controls working.

A customer, contract, or regulator asks for SOC 2, ISO 27001, CMMC, or a requirement you didn't see coming.

Security and compliance readiness

Meet the requirement legitimately while improving actual protection.

You're choosing a GRC platform, or the one you bought isn't delivering what you expected.

GRC platform selection and implementation

Independent selection, implementation, or improvement, built around your program and people.

Findings keep coming back, security processes aren't working, or you need to know where you really stand.

Cybersecurity assessments and remediation

Root causes found, real risk prioritized, and fixes verified in practice.

Your situation doesn't fit neatly in any of these.

Bring us the problem

Strategy, governance, risk, or something harder to name. Most of our work starts that way.

Many requirements, one purpose

Requirements inform the program. They don't define it.

Frameworks and customer requirements overlap, but they aren't interchangeable. We connect them to one security and risk program, reusing what's shared and handling what's specific, so the work protects the business and earns trust.

See how we approach new requirements
  • NIST CSF
  • ISO 27001
  • SOC 2
  • HIPAA
  • CMMC
  • PCI DSS
  • FedRAMP
  • CIS Controls
  • And others
Protection and trustA connected security and risk program that also stands up to audits and customer review.

How it begins

A clear way forward in three steps.

You don't need to know exactly what's needed before you call.

Talk With Us

  1. Tell us what's going on.

    One conversation about the problem, the pressure behind it, and what you're being asked to deliver.

  2. Agree on what needs to happen.

    A recommendation that fits your objectives, risk, budget, and team. Sometimes it's smaller than you expected.

  3. Get it done.

    We do the work with your team, scoped to what you need: a focused assessment, a defined project, remediation, implementation, or ongoing support.

What changes

Less activity for the sake of compliance. More control over risk.

  • Reacting to the latest requestPriorities set by actual risk
  • A separate effort for every frameworkOne connected security and risk program
  • Work no one clearly ownsClear ownership and follow-through
  • Tools expected to run the programTools supporting people who pay attention
  • Passing the audit as the goalProtection you can also prove
  • ⅔ fewer mapped controls across SOX ITGC, SOC 1, and SOC 2 at a public SaaS company. Read the case
  • 3+ risk registers unified into one view leadership could act on. Read the case

Know where your risks stand, and be able to prove it.

See what your team is doing about the risks that matter, and what you can show customers, leadership, and auditors.

Bring us the problem. We'll help figure out what needs to happen.

Talk With Us
About the practice

Hotman Group is a cybersecurity and Cyber GRC professional services practice founded in May 2016 by Cheri Hotman, CPA, MBA, CISSP, CCISO, CMMC CCP, and author of Rebuilding Cybersecurity (forthcoming, CRC Press). Trent Hotman is Managing Partner. Based in Fort Worth, Texas. Certified Woman-Owned Small Business (WOSB).

Meet the team