StrongCOR Technology Governance

StrongCOR is a subscription for ongoing security, governance, risk management, and compliance (SGRC) work — RESCOR's consulting expertise delivered at a flat monthly rate instead of project-by-project. It exists because an effective SGRC program is ongoing work, not a one-time purchase, and the subscription model lines the billing up with the reality.

What StrongCOR Covers

StrongCOR supports the components of an SGRC program that matter most across every major compliance regime — GLBA, HIPAA, FedRAMP, NERC CIP, FERPA, SOX, ISO 27001, and others. The specific services mixed into a given subscription depend on the organization's existing program, gaps, and regulatory exposure; the catalogue is:

How It Is Delivered

Every StrongCOR engagement runs on the RAPID methodology — short, repeating development cycles that each produce measurable progress against the organization's highest-priority SGRC issues. RAPID has been in continuous use since 1992 and is the framework that keeps StrongCOR from turning into open-ended consulting.

Risk measurement inside StrongCOR uses STORM, and where AI-assisted collection is appropriate, the measurements are produced through ATRA. The results carry forward year to year so progress is visible as a trend rather than as a series of disconnected reports.

Separation of Duties

RESCOR maintains a strict separation between testing and support. Any person who has provided emergency or operational support to a system is excluded from testing that system for two years afterward. The purpose is simple: a tester who has recently held a keyboard on the system being tested cannot render an objective test result, and a StrongCOR subscription does not compromise on that.

The Subscription Model

A StrongCOR subscription is configured along three axes:

• Services included. Pick the items from the catalogue that fit the organization's current program and known gaps. A subscription can begin with a minimum set and grow over time.
• Frequency per service. Annual, semiannual, quarterly, or monthly, chosen per service. Vulnerability scanning might be monthly; a full penetration test annual; a risk-assessment refresh quarterly.
• Term length. 12 to 60 months. Longer terms earn a lower monthly rate.

Support work is billed at a flat monthly rate; scheduled services are billed at or near the time of provision. Services can be added, removed, or re-frequencied at any time, and the subscription price adjusts accordingly. One-off services outside the subscription are also available.

Why Subscribe Rather Than Engage Project by Project

• Predictable cost. A flat monthly rate replaces the open-ended quotes that project consulting produces. Budgeting becomes a matter of picking the right scope up front, not reacting to quotes mid-year.
• Continuity. The same team holds context across engagements. Every RAPID cycle builds on the last, and the subscription ensures the cycles actually happen rather than being deferred when calendars fill up.
• Scalability without renegotiation. Growing the program is a configuration change, not a new statement of work.
• Objective testing. The separation-of-duties rule applies to subscription work automatically.

Further Reading

The philosophy and evidence behind StrongCOR — the Three Laws of Guerilla Security, the RAPID methodology, STORM quantitative risk, optimal privilege, control friction, and the governance model that holds them together — are covered in full in Guerilla Security: The Martial Art of Information Security. A plain-language companion for boards, staff, and customers is also available.

• Guerilla Security (practitioner edition, PDF)
• Guerilla Security: What Everyone Needs to Know (PDF)
• RAPID methodology — the engagement framework
• STORM and ATRA — risk measurement

Discuss a subscription via the contact page.

Simplified Total Risk Management, STORM, ATRA, StrongCOR, RAPID, and RSK are trademarks of Andrew T. Robinson.