About ISS Labs
Experienced guidance.
Personal attention.
Information System Security Laboratories helps organizations build secure, compliant, and resilient information systems by translating complex cybersecurity requirements into practical solutions.
Principal consultant
Timothy McGee
Our principal consultant brings 30 years of IT industry experience, including eight years working directly for the IRS Office of Safeguards, and 15 years of federal government contracting.
His prior professional experience spans federal information systems, state and local agencies, financial services, healthcare, education, and enterprise technology. He has led safeguarding reviews, guided secure development practices, and worked with technical teams on security architecture and control implementation.
Security architecture and implementation
Prior work includes cloud security-control design, Microsoft 365/Azure migration planning, security-tool architecture, and system hardening guidance.
Federal safeguarding assessments
Experience includes agency safeguarding reviews, NIST-based control assessments, federal tax information requirements, and findings reporting.
Secure development
Experience includes application-security guidance, CI/CD security touchpoints, NIST SP 800-218 implementation work, and cross-functional team development.
Expertise includes security architecture, NIST-based security, IRS Publication 1075, FedRAMP consulting, DevSecOps, HIPAA, PCI DSS, security assessments, and remediation planning.
Previous IRS experience does not imply endorsement of ISS Labs by the Internal Revenue Service.
Working together
A clear scope. A useful result.
Define
Agree on objectives, scope, access, responsibilities, and the outputs your organization needs.
Assess & design
Review relevant evidence and architecture with your technical team; identify gaps and practical options.
Deliver
Connect findings and recommendations to business priorities, owners, milestones, and decisions.
Support improvement
Address agreed implementation questions and remediation priorities. Follow-up is defined in the scope.
Implementation guidance and follow-up can be included in the agreed scope. Initial inquiries should contain only non-sensitive information.
A clear next step
Let’s make your security
requirements actionable.
Tell us what you’re building, preparing for, or working to improve.