Operational & AI Consulting · Security & Compliance ·
vCISO Advisory · MSP Partnership & Consulting

Map the process.
Find the pain points.
Then decide the fix.

Tech Cartographer is a consulting firm for small and mid-size businesses and the MSPs that serve them. We start by mapping how your work actually moves, find where the time and money go, and only then decide whether a tool, a process change, or a security control is the right fix. A person reviews every output.

Operational & AI Consulting Schedule a Call
Process Mapping Workflow Automation AI Readiness M365 / Entra ID SEC SOC 2 HIPAA NIST CSF CIS Controls
"Most owners know something is costing them time. Fewer can say what it is, what it costs, or whether the fix is a tool, a process, or a control."

A week eaten by paperwork. A hand-off that fails every month. An AI tool someone bought and nobody governs. A vendor questionnaire or an insurance renewal asking what you do not know.
That's where I come in.

I'm Martin Perkins, founder of Tech Cartographer and a 20+ year technology and operations leader. I help SMBs, regulated organizations, and MSPs map how the work actually moves, find what it costs, and fix it with the right mix of process change, AI, and security controls.

And when the fix is a security or compliance program, I build that too.

What usually forces the question:

The owner is the bottleneck
A process that fails every month
AI without guardrails
Vendor questionnaire
Cyber insurance renewal
Regulatory exam

What We Do

One method, four doors

Operational and AI consulting is where most engagements start. Security and compliance, vCISO advisory, and MSP partnership are the specialist practices behind it, for when the measurement says the fix is a control, a leader, or a partner.

Start Here

Operational & AI Consulting

"Map the process. Find the pain points. Then decide the fix."

Consulting for growing businesses and MSPs that know something is eating their week but cannot say what it costs. We map how the work moves, find the pain points and put a number on each, then decide whether a tool, a process change, or a control fixes them, and implement with a person reviewing every output.

Process Mapping & Measurement

How your work actually moves, where the pain points are, what each costs today in hours, errors, or delays, and the number we will measure against.

Workflow Automation

Redesign the hand-offs that fail, then automate the repetitive steps, often in Microsoft 365 and Power Automate, with compliance built in.

AI Readiness & Implementation

Put AI on the first pass of the work where the measurement says it fits, with data-handling rules and a person reviewing every output.

M365 & Stack Rationalization

Microsoft 365, Entra ID, and Power Automate expertise, plus eliminating redundant tools so your stack works as one system.

Every engagement starts with the map, not a rate sheet. If the answer turns out to be a security control or a compliance program, the practices below pick it up.

Learn More about Operational & AI Consulting
When the fix is a control

Security & Compliance

"Where do you stand, what are the gaps, what do you fix first."

For when an auditor, insurer, or client is asking, or the measurement points at a control. A structured assessment of where you stand, then an audit-ready program: the policies, controls, and documentation that satisfy the people asking.

Security & Compliance Assessment

A structured evaluation against CIS Controls, NIST CSF, and your target framework. Fixed fee, scoped after a 30-minute call. Most SMB assessments finish in 2 to 4 weeks.

Findings Report & Roadmap

Gaps ranked by risk severity and a sequenced plan with control owners and milestones built around your audit date, walked through live with leadership.

Program & Policy Development

WISP, incident response plan, BCP/DR, access control, vendor risk framework, and the control evidence your framework requires. Written to be used, not filed.

Audit & Exam Readiness

Readiness reviews before the audit, support for auditor, insurer, and questionnaire requests, and ongoing management to keep controls current.

SOC 2, HIPAA, NIST CSF, CIS Controls, SEC rules, or CMMC. No hourly billing. Stop after the assessment, continue into the program, or hand the roadmap to vCISO advisory.

Learn More about Security & Compliance

vCISO Advisory

Ongoing security leadership on a monthly retainer. Tech Cartographer serves as your organization's security and compliance function, owning the program, advising leadership, and keeping the controls current.

Scoped to your organization Size, risk profile, compliance obligations, and budget set the scope. No Fortune 500 program for a 40-person firm.
Cadence that fits From a monthly leadership touchpoint and risk register upkeep to weekly working sessions, audit preparation, and board reporting.
Adjusts as the program matures Heavier in the first months, lighter once controls are current and owned. The goal is that you need less of it over time.
Learn More about vCISO Advisory
For MSPs

MSP Partnership & Consulting

Two ways Tech Cartographer works with managed service providers: as the security and compliance engine behind your client offerings, and as an operator-turned-advisor for your own practice.

Partnership Program

White-label, named-partner, or referral delivery of security and compliance services for your clients, with your brand and your client relationships intact.

Client Risk Assessments vCISO for Managed Clients Compliance Co-Delivery Joint Go-to-Market

MSP Consulting

Consulting for the MSP itself: how you run operations, deliver service, adopt AI inside your practice, and mature as a business. Built by someone who has run an MSP services division and coached more than 100 MSPs.

Operations & Service Delivery AI Implementation Operational Maturity Security Practice Build-Out

Structured around how your MSP operates: white-label delivery, referral arrangement, co-delivery, or a consulting engagement focused on your own operations.

Learn More about MSP Partnership & Consulting

Differentiation

Why Tech Cartographer

What separates this engagement from a typical consultant or advisory firm.

Operator Mindset, Not Consultant Theory

I've built MSP service lines from scratch, managed P&L, negotiated vendor contracts, and run teams. I know how businesses actually work, and I build fixes that fit that reality, whether the fix is a workflow, an AI tool, or a compliance program. Not enterprise templates nobody opens again.

Fluent in the MSP World

I've coached over 100 MSPs on building security practices, run an MSP services division, and spoken at national industry events. I know how to work alongside your IT provider, not around them. Your technology stack and your operations are a known quantity, not a learning curve.

Senior Engagement at Every Stage

No hand-off to a junior analyst. The person you meet is the person doing the work. You get direct access to 20+ years of technology and operations leadership throughout the entire engagement.

No Shelf Documents

You get a map you can act on, a number you can check the fix against, and a roadmap when one is needed. Not a 200-page report no one reads. Every deliverable is built to be used by the people who receive it.

Who We Serve

Industries and clients

Growing businesses whose operations have not kept pace with their size, regulated industries with real compliance obligations, and the MSPs that serve both.

Financial Services / RIAs

SEC cybersecurity rules, NCUA requirements, client onboarding and document review that wait on a principal, written policies, annual risk assessments, vendor oversight, and examination readiness.

Healthcare-Adjacent

HIPAA business associate obligations, intake and referral paperwork that waits on a clinician or owner, vendor questionnaires, breach risk, and clinical system access governance.

Law / CPA Firms

Intake, engagement letters, and document review that wait on a partner, bar guidance on data security, cyber insurance requirements, and client confidentiality obligations.

Managed Service Providers

Service delivery that varies by technician, onboarding and ticket flow that do not scale, AI inside the practice, and white-label security and compliance delivery for clients.

About

Built by an operator.
Delivered by the person you meet.

I think like an operator, not a consultant with a rate card. My background spans MSP practice development, regulated-industry compliance delivery, executive advisory, and critically, the operational reality of running a business or a technology practice when the week is eaten by work that waits on one person.

I spent a year coaching over 100 MSPs, helping them build and monetize security practices from the ground up. Before that, I built a managed services division from scratch, growing it 225% in year one. As Director of Services, I managed security and compliance programs for 15 regulated clients across financial services, healthcare-adjacent, and SEC-regulated environments.

I'm also co-founder of The Tech Degenerates, an independent MSP peer community that's grown to 800+ members, because the industry gets stronger when practitioners share openly.

I've spoken at national events including Xchange and NextGen. I work hands-on with Entra ID, Conditional Access, Intune, Microsoft Defender, and M365 Compliance (DLP, retention, audit, eDiscovery). I don't outsource the work. The person you meet is the person doing the work.

Security frameworks I work in

SEC Cybersecurity Rules SOC 2 HIPAA-Oriented Controls NIST CSF CIS Controls
Full Background & Approach →
20+
Years Technology & Operations Leadership
100+
MSPs Coached on Security Practices
15
Regulated Clients Served at Ki Security
800+
MSP Community Members (Tech Degenerates)

How It Works

Four steps, in order

The same method whether the fix turns out to be a workflow, an AI tool, or a security program. The order is the point.

Map the process

How the work actually moves today, walked with the people who do it. Who touches it, where it waits, what gets re-done, which tools it passes through. Not the org chart and not the procedure manual.

The map before the fix.

Find the pain points

The map shows where the time and money go. We pull out the specific points of friction and put a number on each: hours, errors, delays, or dollars, counted before anything changes. If we cannot put a number on it, we are not ready to buy a fix for it.

A number on each one.

Decide the fix

A tool, a process change, a security control, or sometimes nothing. The measurement decides, not the vendor. This is where the specialist practices come in if they are needed.

The measurement decides.

Implement with a person reviewing

Build it, run it, and measure again. Where AI takes the first pass, a person reviews every output before it leaves the building. The work is done by the person you met.

It drafts. You decide.

Common Questions

Common questions

Answers to the questions we hear most from SMBs and MSPs weighing consulting, security, and compliance help.

Four steps, in order. Map the process: how the work actually moves today, walked with the people who do it. Find the pain points: the specific places the time and money go, with a number on each in hours, errors, delays, or dollars. Decide the fix: a tool, a process change, a security control, or sometimes nothing. Implement with a person reviewing every output. Tech Cartographer does this for growing businesses and for MSPs, often in Microsoft 365 and Power Automate, and only brings in AI where the measurement says it fits.
Pick the process that costs the most owner or senior-staff time each week and that you can measure in a day. Time it, count the errors, or count the hand-offs for one week. The one with the biggest, clearest number is first. Our guide on which process to fix first walks through the method with examples from independently published small-business cases.
A vCISO (Virtual Chief Information Security Officer) provides executive-level cybersecurity leadership on a fractional basis, so you get the strategic guidance of a senior security executive without the cost of a full-time hire. For a small business, that means setting security priorities, building policies and procedures, managing risk, overseeing compliance requirements, and advising leadership on cybersecurity decisions. Tech Cartographer's vCISO advisory is scoped to your organization's size and risk profile, so you're not paying for a Fortune 500 security program.
Every assessment starts with an intake questionnaire to understand your organization's size, industry, existing controls, and areas of concern. Scope and pricing depend on the number of users, systems, and compliance requirements involved. Tech Cartographer provides a fixed-fee proposal after the initial discovery, with no hourly billing surprises. Most SMB assessments are completed within 2 to 4 weeks and delivered with a prioritized findings report and remediation roadmap.
A CISO (Chief Information Security Officer) is a full-time executive employee, typically costing $200,000 to $400,000 or more annually in salary and benefits. A vCISO delivers the same strategic leadership on a part-time or fractional basis, at a fraction of the cost. For most small and mid-size businesses, a full-time CISO is unnecessary, and a vCISO provides the right level of oversight without the overhead.
It depends on your industry and the data you handle. Healthcare organizations face HIPAA requirements. Businesses processing credit cards must meet PCI DSS standards. Companies targeting enterprise clients or government contracts increasingly need SOC 2 or CMMC compliance. Even without a regulatory mandate, following a framework like NIST CSF or CIS Controls significantly reduces breach risk and demonstrates security maturity to clients and partners. Tech Cartographer helps you identify which requirements apply and build a program to meet them.
If your MSP clients are asking about security assessments, compliance, or incident response and you don't have dedicated security expertise on staff, that's the signal. MSPs are increasingly being held accountable for the security posture of the clients they manage, and a single breach at a client site can damage your reputation and your business. Tech Cartographer partners with MSPs to extend their security capabilities without adding headcount, providing assessments, vCISO services, and compliance support under your brand or as a named partner. It also consults for the MSP itself on operations, service delivery, and AI inside the practice.
You receive a written findings report with identified gaps ranked by risk severity, along with a prioritized remediation roadmap. Tech Cartographer walks you through the findings in a debrief session and can support remediation directly or hand off recommendations to your internal team or MSP. Many clients follow an assessment with an ongoing vCISO engagement to work through the roadmap systematically over time.

Get in Touch

Ready to map
the process?

A process that fails every month, an AI tool nobody governs, a vendor questionnaire, an insurance renewal, or a nagging feeling that something costs more than it should. Start with a conversation. No agenda. No pitch.

Email martin@techcartographer.com
Phone +1 (260) 255-6994
Location Wabash / Fort Wayne, Indiana
Serving clients nationally
LinkedIn linkedin.com/in/martinjperkins

Founder | Operational & AI Consulting | Security & Compliance | vCISO

Operational & AI Consulting | Security & Compliance | Helping SMBs and MSPs map the process, find the pain points, and fix them

Start the Conversation

No pitch. Just a conversation.