Risk & Compliance Frameworks
- ISO/IEC 27001 and related standards
- NIST cybersecurity and risk frameworks
- PCI DSS
- SOC 1 / SOC 2 readiness and support
- FFIEC, EU-EBA and ENISA-aligned reviews
- DORA and NIS2 readiness
Cybersecurity · AI Governance · Risk · Regulatory Advisory
Independent cybersecurity, AI governance and regulatory advisory services for regulated organizations.
Arcelay & Associates gives boards and executive leaders clear analysis and practical recommendations on cyber, AI and regulatory risk — to protect and increase stakeholder value.
Cybersecurity Advisory
Strategy & Governance
AI Governance
Responsible Adoption
Risk & Compliance
Practical Alignment
Retained Advisory
On-Demand Expertise
Who We Are
Executive experience. Trusted advisory.
Our mission is to assist executive leadership in increasing stakeholder value through clear analysis and practical recommendations.
AALimited (Arcelay & Associates LLC) is a team of cybersecurity and technology risk advisors who bring executive and operational experience to every engagement. Our advisors have led security, risk, and compliance programs in regulated industries across U.S. and international markets, and have advised boards, executive teams, and investors on cyber risk, regulatory readiness, operational resilience, and acquisition due diligence.
Our work spans enterprise security governance, cloud and Zero Trust security, AI governance, and incident preparedness. We translate technical findings and regulatory expectations into clear analysis and practical recommendations that leadership can evaluate against business priorities.
The firm is led by its founder, who brings more than 30 years in technology leadership, including over 20 years building and leading cybersecurity programs. As worldwide Chief Information Security Officer (CISO) for a global payments company, he led the design and implementation of security programs across complex, regulated operations in multiple countries. His leadership experience also includes a cloud-native, AI-enabled digital banking platform provider serving banks and credit unions.
Capabilities
Built around risk, assurance and technical depth.
Our capabilities span cybersecurity governance, AI governance, regulatory frameworks, assessments, technical security reviews, and professional credentials across technology risk, audit, incident response, governance, and offensive security.
AI Governance
- AI governance operating models and accountability
- AI risk assessment and control frameworks
- Responsible AI policy and standards development
- Third-party and generative AI risk reviews
- Alignment with NIST AI RMF, the EU AI Act, and emerging requirements
Assessments
- Compliance pre-assessments
- Resiliency and security posture reviews
- Information security assessments
- Incident response preparedness
- Acquisition due diligence reviews
Technical Reviews
- Blue team security reviews
- Red team exercises
- Purple team validation
- Control effectiveness analysis
- Technical risk evaluation
Team Credentials
- CISSP, CRISC, CISM, CEH, GCIH
- ISO 27001 Lead Auditor, CGEIT, CSSLP
- CCISO, GCFA, GSE, GSEC, GPEN
Our Services
Focused engagements. Practical outcomes.
Our work gives leaders a clearer view of exposure, options, and tradeoffs so they can set priorities with confidence.
01 · ADVISORY
Advisory Services
We advise leadership on security priorities, governance, and investment tradeoffs. Depending on the engagement, that may include advising on AI oversight, security investment options, control ownership, or responses to regulatory expectations.
02 · ASSESSMENT
Assessment Services
We assess security programs, controls, resilience, compliance readiness, and technology risk. A scoped review may examine whether control evidence matches the stated process or identify dependencies that could affect business continuity. Findings are framed for leadership review.
03 · RETAINER
Retainer Services
Retained advisory gives leadership ongoing access to experienced cybersecurity perspective on strategy, control reviews, regulatory inquiries, and emerging risks. Scope and cadence are agreed with each client.
An advisory perspective
Explore an advisory challenge.
Explore how we frame the questions behind a leadership challenge. These examples show an advisory approach; they are not an assessment of your organization.
AI governance
Employees are using generative AI at work
Questions to examine
- What company or customer data may be entered into these tools?
- Who approves permitted uses and reviews exceptions?
- How are outputs checked before they affect customers or operations?
How AALimited can advise
Review current use and material exposure; advise management on policy, oversight, and training, as well as monitoring use cases for AI-enabled data loss prevention (DLP) or similar tools. Recommendations can address sensitive-data detection, alert review, and appropriate employee privacy safeguards.
A vendor proposes an AI-enabled service
Questions to examine
- What data will the provider receive, retain, or use for training?
- How are model changes, access, incidents, and subcontractors governed?
- What assurances can the provider substantiate?
How AALimited can advise
Examine vendor evidence and contractual risk, then present gaps and options for procurement, security, and executive review.
Leadership wants to scale AI adoption
Questions to examine
- Who owns AI oversight across business, legal, security, and privacy?
- Which use cases require heightened review or human oversight?
- How will the organization monitor performance and emerging risks?
How AALimited can advise
Assess the governance model and recommend an approach to accountability, use-case review, and ongoing monitoring that fits the organization.
Cybersecurity, risk & regulatory
Leadership needs a clearer view of cyber exposure
Questions to examine
- Which systems and services matter most to the business?
- What evidence supports the effectiveness of key controls?
- Where would disruption or data loss have the greatest impact?
How AALimited can advise
Review the security program and available evidence, identify material gaps, and explain options and tradeoffs in terms leadership can use to set priorities.
A regulatory examination or assessment is approaching
Questions to examine
- Which requirements apply, and who owns the related controls?
- Does the evidence show that controls operate as described?
- How are gaps, exceptions, and remediation documented?
How AALimited can advise
Assess readiness against the applicable requirements, test the clarity of control evidence, and recommend a practical response to material gaps.
An acquisition brings technology and cyber risk
Questions to examine
- Which inherited systems, data, and third parties create exposure?
- What material security or compliance issues affect integration?
- Which findings need deeper validation before or after closing?
How AALimited can advise
Conduct scoped technology, cybersecurity, and regulatory due diligence, then explain findings and integration considerations to the investment and leadership teams.
Your leadership team determines the course of action. AALimited provides independent analysis and recommendations.
Why clients return
Confidential work. Lasting relationships.
Every engagement is handled in strict confidence, which is why you won't find client names or case details on this site. The same discretion applies to your organization.
What we can share is this: our clients come back. Organizations that engage AALimited return for additional engagements as new security, regulatory, and AI governance challenges arise.
Contact
Discuss your security challenge.
Tell us the challenge facing your leadership team. We can discuss how independent security, AI governance, or regulatory advice can support your business priorities.
Address
100 Commerce Dr Unit #72
Tyrone, GA 30290-8004 USA
Tyrone, GA 30290-8004 USA
Start a conversation
For cybersecurity, AI governance, assessment, regulatory, or retained advisory inquiries, contact Arcelay & Associates directly.