Diriga Services — Senior advisory for compliance, cybersecurity, and program risk

Practice areas

Compliance advisory

Senior guidance through complex regulatory landscapes, including CMMC, HIPAA, and FINRA. We help organizations understand what compliance actually requires, not just what it costs.

Learn more

Cybersecurity strategy

Strategic assessment and roadmap development for organizations that need a defensible security posture. Not managed services. Strategic engagements with measurable outcomes.

Learn more

Program risk review

Independent assessment for organizations managing complex programs with overlapping compliance, security, and operational requirements. We identify where risk concentrates.

Learn more

"We don't sell hours. We sell judgment."

How we work

01

Diagnostic

We begin with a candid assessment of your current posture, obligations, and organizational readiness. No sales process. Just clarity.

02

Scope

We define the engagement together, with fixed deliverables, clear timelines, and a named senior practitioner who will lead the work.

03

Senior delivery

The same people who scope the work are the ones who deliver it. No handoff to junior staff. No bait and switch.

04

Handoff

We deliver findings, recommendations, and implementation guidance designed to outlast the engagement. Your team owns the outcome.

Selected engagements

Defense industrial base

CMMC Level 2 readiness assessment

Challenge

A mid-Atlantic defense contractor facing CMMC Level 2 assessment had been told by two previous firms that they were "almost ready." An independent review revealed significant gaps in access control and incident response documentation.

Approach

We conducted a thorough gap analysis against all 110 NIST SP 800-171 controls, prioritized remediation by assessment risk, and worked alongside their IT leadership to develop compliant procedures.

Outcome

The organization achieved CMMC Level 2 certification on first assessment attempt, with zero findings requiring remediation.

Healthcare

Security strategy and roadmap

Challenge

A regional healthcare network managing sensitive patient data across twelve facilities had no unified cybersecurity strategy. Each facility operated under different assumptions about risk tolerance and security controls.

Approach

We developed an enterprise security strategy aligned with HIPAA requirements and the organization's operational realities, including budget constraints and staffing limitations that previous consultants had overlooked.

Outcome

The network adopted a three-year security roadmap with measurable milestones. The first-year priorities were implemented within budget and ahead of schedule.

View all engagements

Principals

Ray Bazzi

Managing Principal

Two decades of advisory experience across defense, healthcare, and financial services. Former CISO and compliance officer who understands both the technical and organizational dimensions of risk.

Margaret Kessler

Principal, Compliance Advisory

Former federal auditor with deep expertise in CMMC, FedRAMP, and HIPAA compliance frameworks. Known for translating regulatory complexity into actionable organizational guidance.

James Rowan

Principal, Cybersecurity Strategy

Fifteen years in cybersecurity strategy for defense and critical infrastructure organizations. Specializes in aligning security investments with regulatory obligations and business objectives.

About our principals

Insights

The compliance gap most contractors don't see until audit day

Ray Bazzi · March 2026

Most organizations believe their compliance posture is stronger than it actually is. The gap between documentation and practice is where assessors focus, and where most failures originate.

Why cybersecurity strategy fails without organizational buy-in

James Rowan · February 2026

A security strategy that lives in a document no one reads is not a strategy. It is an artifact. The difference between the two is organizational commitment, not technical sophistication.

Program risk in an era of accelerating oversight

Margaret Kessler · January 2026

Regulatory complexity is increasing faster than most organizations can adapt. The programs that manage this well share a common trait: they treat compliance as a continuous discipline, not a periodic event.

Senior counsel for organizations operating where the stakes are highest.

Practice areas

Compliance advisory

Cybersecurity strategy

Program risk review

How we work

Diagnostic

Scope

Senior delivery

Handoff

Selected engagements

CMMC Level 2 readiness assessment

Security strategy and roadmap

Principals

Insights

The compliance gap most contractors don't see until audit day

Why cybersecurity strategy fails without organizational buy-in

Program risk in an era of accelerating oversight