Cybersecurity · Governance · Infrastructure
SEDSGA helps financial institutions and security-conscious organizations harden their technology, manage risk with discipline, and walk into regulatory examinations and independent audits with evidence in hand.
Areas of focus
The SEDSGA approach
Examiners and auditors don’t just read your policies. They test whether your environment actually operates the way those policies say it does, and the gaps between the two are where findings come from.
SEDSGA works on both sides of that line. We engineer and secure the infrastructure, and we build the governance documentation that describes it, so what you present is what is really in place.
PolicyMulti-factor authentication is required for remote and email access.
ConfigurationVPN and Microsoft 365 sign-ins enforce MFA through Conditional Access.
PolicyCritical patches are applied within defined timelines.
ConfigurationPatch compliance is reported monthly, with exceptions documented.
PolicyBackups are tested to confirm they can be restored.
ConfigurationRestore tests are scheduled, performed, and recorded.
PolicyFirewall rules are reviewed periodically.
ConfigurationEvery rule is tied to a documented business justification.
Services
Technical security, governance and compliance, and the infrastructure underneath both, delivered as services that reinforce one another.
Practical controls that reduce real risk across networks, endpoints, and cloud services.
Security programs aligned to NIST CSF 2.0 and FFIEC guidance, designed with examination in mind.
Reliable, well-documented infrastructure, managed with security built in from the start.
Financial institution focus
Banks and other financial institutions operate under layered guidance from multiple agencies. We help translate that guidance into controls, documentation, and evidence your team can maintain long after an engagement ends.
NIST CSF 2.0
We use the framework’s six functions (Govern, Identify, Protect, Detect, Respond, and Recover) to assess your current state, define a target profile, and prioritize the work in between.
FFIEC IT Examination Handbook
Guidance such as the Information Security, Business Continuity Management, and Architecture, Infrastructure, and Operations booklets shapes how we structure programs and organize evidence.
FDIC examination readiness
Readiness for IT examinations, including those conducted under the FDIC’s InTREx program, from pre-examination requests through management interviews.
Interagency guidance
Programs informed by the Interagency Guidelines Establishing Information Security Standards, the computer-security incident notification rule, and interagency third-party risk management guidance.
Independent by design. SEDSGA, LLC is not affiliated with, certified by, or endorsed by NIST, the FFIEC, the FDIC, or any regulatory agency. Our work supports examination readiness, but it cannot guarantee examination ratings or audit results. Those outcomes are determined solely by the examining agency or auditor.
How we work
Every engagement follows the same logic: understand the environment, fix what matters, and make sure it can be demonstrated.
Understand your environment, obligations, prior findings, and upcoming examination or audit timelines.
Evaluate technical controls and governance against NIST CSF 2.0 and applicable guidance.
Prioritize and fix what matters most, hands-on, with every change documented.
Align policies, procedures, and evidence with how the environment actually operates.
Keep controls, reporting, and documentation current between examination cycles.
What to expect
Whoever assesses your controls understands how to configure them. Recommendations come with practical implementation paths, not just a list of gaps.
Management and boards get clear explanations of risk and tradeoffs, without jargon or fear-driven sales tactics.
Every control we describe should be demonstrable through configurations, logs, tickets, or test results.
Deliverables, responsibilities, and service availability are documented in writing before work begins.
Next step
Start with a conversation about your environment, your timeline, and the findings or questions on your mind.
or email wes@sedsga.net