Know what needs attention first.
A scoped review of systems, access, and risk, with a plain-language report and prioritized fixes.
Explore Security AssessmentSecurity consulting · California
Security consulting for California organizations.
CyberWiz helps California water districts, public agencies, and nonprofits get audit-ready and stay secure, without hiring a full-time CISO.
I review systems and access, provide ongoing security leadership, and prepare organizations for an audit. You work directly with me, Lewis Matlock.
Yucaipa, California
10+ yearsIn cybersecurity and IT
CISSP-ISSMP · PMP · MBASecurity, project, and business perspective
Practitioner & lecturerInformation Systems Technology at CSUSB
The work starts here
A security question deserves a clear answer.
You may have an IT provider and still need someone to connect security risk to a leadership decision. I help you identify the work, document the priorities, and decide what comes next.
Security leadership that fits your organization.
Monthly security leadership for policy, vendor review, leadership reporting, and incident planning.
Explore Fractional CISOPrepare the evidence before the audit.
Gap assessment, policies, controls, and evidence preparation for organizations preparing for a SOC 2 audit.
Explore SOC 2 ReadinessBuilt around your responsibilities
For businesses and organizations with work to protect.
Explore security priorities for water districts, public agencies, nonprofits, and small businesses.
Who I helpCalifornia small and midsize businesses
Has a customer asked for evidence of your security controls?
California water districts
Which vendors can access important systems, and who approves that access?
Public agencies
Can your existing staff and providers explain who owns each security decision?
Mission-driven nonprofits
Has a partner or funder asked for security policies or a SOC 2 report?
The person behind the practice
Enterprise experience.
A teacher’s approach.
I was Cloud Security Manager and Architect at City National Bank for 6 years. Today, I bring that experience to my consulting work and my role as a Lecturer in Information Systems Technology at Cal State San Bernardino.
I contributed to the CIS Microsoft Azure Foundations Benchmark, credited in v1.4.0.
Meet Lewis MatlockYou should be able to explain the decision, not just read the report.
I write for the person who has to decide what happens next. That means naming the finding, the work it creates, and the boundaries of the engagement.
Professional affiliations and previous employers do not imply endorsement of CyberWiz.
Selected experience
Security work in the context of a mission.
California · Nonprofit
SOC 2 readiness for a water-data nonprofit.
Readiness work sits between the request for an audit and the evidence an auditor needs to examine. My engagement experience includes SOC 2 readiness for a California water-data nonprofit.
I prepare you for the audit. The auditor performs it.
Explore engagement notes
From the field notes
Useful questions.
Practical preparation.
Security assessments
How to respond to a customer security questionnaire
A practical workflow for small businesses answering customer security questions: define scope, verify evidence, record gaps, and review commitments.
Read the field noteSecurity assessments
How to prepare for a security assessment
Prepare a useful scope, collect the right evidence, and turn assessment findings into decisions your team can carry out.
Read the field noteSecurity leadership
Fractional CISO or managed IT: which responsibility is missing?
Separate leadership decisions from daily technical delivery before selecting security support.
Read the field noteSOC 2 readiness
Prepare SOC 2 evidence without building a document warehouse
Organize evidence around the system, the control, and the activity it needs to demonstrate.
Read the field noteQuestions, answered
What you may be wondering.
Who does CyberWiz work with?
CyberWiz works with California small and midsize businesses, water districts, public agencies, and mission-driven nonprofits that need security assessments, leadership, or audit readiness support.
Will I work directly with Lewis?
Yes. CyberWiz is my solo security practice. I scope the work with you and provide the agreed consulting deliverables.
Where is CyberWiz based?
I am based in Yucaipa, California, in the Inland Empire of Southern California. The initial call is a place to discuss your location and engagement needs.
What happens on the introductory call?
The 20-minute call is a place to explain the question, identify the relevant service, and discuss scope. You do not need a completed security plan before getting in touch.
Start with a conversation
What security question is on your desk?
Tell me what prompted the question. A 20-minute call is a place to establish the next step.