Closed Circuit Consultants · Las Vegas, NV · remote US
Independent verification and validation for public-sector software.
Agencies buy large systems from vendors they cannot fully check. We do the checking: requirements traced to delivered code, deliverable and schedule review, security controls against NIST 800-53 and HIPAA, and test oversight before go-live. Independent of the vendor.
Free 30-minute call. Written findings in 48 hours on the material you can share. Then a scoped SOW.
How it starts
Call → 48h findings → scoped oversight
- 1. Free 30-minute call. The contract, the vendor, the stage the project is in, and what is worrying the program.
- 2. 48-hour findings you keep. From what you can share: the RFP or contract, vendor plans and status reports, and test results. Where the risk sits, in writing.
- 3. Scoped oversight. Fixed price or monthly, written to fit how your program buys.
What oversight covers
Requirements traceability
Each requirement traced to design, code, and a passing test. Gaps listed before the vendor invoices against them.
Deliverables and schedule
Vendor plans, status reports, and change requests checked against what is actually in the repository.
Code and architecture review
Read the source the agency is paying for. Authorization, data handling, and how the system will be maintained after the vendor leaves.
Security control assessment
NIST 800-53, NIST 800-171, HIPAA, and HITECH. Findings mapped to controls your auditors already use.
Test oversight and go-live readiness
Witness the testing that matters, review defect trends, and give a written go or no-go basis.
Modernization oversight
Legacy moves such as .NET Framework 4 to .NET 10, scoped so the vendor cannot hide the hard parts.
Proof
Who has done this
CalHFA mortgage systems, built and now modernized
Sean O'Dea built the California Housing Finance Agency (CalHFA) mortgage application, frontend and backend, and its mortgage servicing application. He is now leading that mortgage application's upgrade from .NET Framework 4 to .NET 10, in waves, while it stays live.
IV&V on contracts up to $500M
Sean O'Dea led independent verification and validation on federal contracts up to $500M, including state child welfare and health information systems.
NIST 800-53 audits for CMS
Ran NIST 800-53 audits for the Centers for Medicare & Medicaid Services across multiple state Medicaid programs.
HIPAA system architecture
Architected a HIPAA-aligned child health information system for a state program, and mapped NIST 800-53 across AWS, Azure, and Google Cloud at a cloud compliance company.
A practice built from zero
Built Public Consulting Group's cybersecurity practice from $0 to multi-million annually. Benjamin R. (CISSP, GPEN Honors) worked the same programs.
Questions
What is IV&V?
Independent verification and validation. Verification asks whether the vendor built the system right: requirements traced to code, tests, and controls. Validation asks whether they built the right system for the program. Independent means we do not report to the vendor being checked.
Who do you work for on an IV&V engagement?
The agency or program buying the system. We stay independent of the vendor. If you are a vendor who wants an outside read before the agency's IV&V does, that is a different engagement, and we say in writing which one we are doing.
Which control frameworks do you assess against?
NIST 800-53 and 800-171, HIPAA and HITECH, and the security sections of your contract. We map findings to the controls your auditors already use.
Can you oversee a .NET Framework modernization?
Yes. We are leading the upgrade of the California Housing Finance Agency (CalHFA) mortgage application from .NET Framework 4 to .NET 10 now, in waves, while it stays live. Oversight of a vendor doing the same move uses the same inventory: every project, every WCF contract, every package with no modern build.
What does it cost?
The free 30-minute call is to understand the contract and the stage it is in. Oversight is then scoped as a fixed price or a monthly engagement, written to fit how your program buys.
Check the vendor before the vendor checks out.
Book the free call. Bring the contract stage and the next milestone date.
Closed Circuit Consultants · SOC LLC d/b/a · Las Vegas, NV · remote across the US