What I do
Every engagement, scoped before it starts.
You'll always know what you're getting, what it costs, and when it's done. No open-ended retainers dressed up as strategy, and no surprise invoices.
You do not need to know what to call the engagement
Most people arrive with a situation, not a service name. These are the kinds of moments that usually bring the work into focus:
- A renewal is on the table
- Your MSP, software vendor, ISP, or copier company wants a longer commitment, and you want an experienced second opinion before signing it.
- The dashboard is green
- The backup reports success, but nobody can say when a complete restore was last tested or how long recovery would take.
- A move or expansion is coming
- The new location needs internet, Wi-Fi, phones, security, and a sequence that will not put the construction schedule in charge of the technology plan.
- An insurer is asking
- A cyber-insurance application wants precise answers about MFA, backups, access, and response planning, but responsibility is spread across several people and providers.
- AI use is already happening
- Staff have useful new tools and no shared rule about customer information, confidential documents, or which accounts and products are approved.
- No one owns the whole picture
- Every vendor understands one slice of the environment. You need someone to look across the seams and put the work in a sensible order.
Choose the starting point
- You need to know where you stand
- Start with an IT & Security Health Check. It looks across the whole environment and puts the useful work in order.
- You need a senior IT person, but not a full-time hire
- Start with Ongoing IT & Security Advisory. It gives you one experienced person to pressure-test vendors, decisions, budgets, and risk.
- You have a bounded job that needs doing
- Start with Scoped Project Work. The outcome, timing, and price are written down before the work begins.
- You need a practical answer about AI
- Start with Practical AI for Small Business. It turns questions about tools, customer data, and staff use into a short policy or decision you can actually use.
- You hold regulated data or have heavier obligations
- Start with a Specialist Engagement. Private AI, encryption, key management, HSMs, and compliance-mapped assessments remain the deeper end of the practice.
IT & Security Health Check
The question this answers: Where do we actually stand — and what’s worth fixing first?
A fixed-fee, fixed-scope review of the whole environment: network and Wi-Fi, email security, endpoints, accounts and access, backup and restore, and the recurring services that have accumulated over time. The backup is not marked healthy because a dashboard is green; the ability to restore is what matters.
What you get:
- A plain-language picture of the environment as it actually operates
- A prioritized list of what matters now, what can wait, and what is not worth doing
- A record of avoidable costs, overlapping tools, and services you may be able to stop paying for
- A written report and a walkthrough of the findings
Format: Fixed fee. Days, not weeks. Defined deliverable.
Fee: Fixed and agreed in writing before work begins — sized for small businesses. Nothing starts until you approve it.
You own the plan whether you ask me to carry out the work, use your current provider, or handle it internally. The point is to give you a clear view, not to manufacture a project.
If backup confidence or an insurance application brought you here, start with the guides to testing whether a backup actually restores and answering a cyber-insurance questionnaire from evidence.
Want to see the shape of the report first? Review the illustrative Health Check sample — findings, priorities, ownership, and the work that can safely wait.
Start with a Health Check See a sample
Ongoing IT & Security Advisory
The question this answers: Who do we call when an IT decision is bigger than our team but smaller than a new hire?
This is your IT person without hiring an IT person: a seasoned second set of eyes for vendor proposals, budget decisions, security questions, renewals, and the moments when a problem crosses from one part of the stack into another.
It is advisory, not a help desk and not a contract designed to sell hardware. I help your team and existing providers make better decisions, challenge recommendations that do not add up, and keep the work pointed at the business outcome.
Format: Monthly retainer, sized to how much of me you need. Often the natural next step after a Health Check.
If you are still deciding whether the business needs managed service, project help, or an independent advisor, read Do you need an MSP, or just someone in your corner?.
Scoped Project Work
Some problems do not need an assessment or a retainer. They need a clear finish line.
That may be a network or Wi-Fi refresh, a Microsoft 365 or email migration and hardening, backup and disaster-recovery setup, an MFA or phishing-resistance rollout, a new-location setup, or an independent look at a vendor or ISP proposal. The work is scoped around the outcome, not an endless menu of billable tasks.
If it plugs in or logs in, ask. If it is not a fit, I will say so.
Practical AI for Small Business
The question this answers: What should we let people use, what should stay out, and what does a sensible policy look like?
Should you turn on Microsoft Copilot? Staff are already pasting customer information into ChatGPT — what should the rule be? A vendor says its tool is private; what does that claim actually cover?
These are short, fixed-fee engagements: a tool review, a practical AI-use policy, or a staff guidance session built around the data your business handles. The aim is not to turn a small business into an AI laboratory. It is to make a useful decision before informal use makes the decision for you.
If the immediate need is a rule people can use, start with the guide to a practical AI-use policy for a small business.
Specialist engagements
For organizations with regulated data and heavier obligations, this is the deeper end of the practice.
Private AI Readiness Assessment
The question this answers: Can we run AI on our own data — safely, compliantly, and on infrastructure we control — and what will it actually take?
Everyone wants the productivity of modern AI. Few have looked honestly at what feeding sensitive data to an outside model does to their risk and compliance posture. This assessment closes that gap before you’ve committed a dollar to building anything.
What you get:
- A review of your candidate use cases — which are worth doing, which aren’t, and which carry hidden data-exposure risk
- A recommended on-premise / private architecture, grounded in a working reference design rather than theory
- A data-protection and compliance assessment mapped to your actual obligations
- A phased roadmap with a realistic implementation cost estimate
- A written report and a live walkthrough with your team
Format: Fixed fee. Two to three weeks. Defined deliverable.
The fee is quoted after the initial working call, and varies mainly with the number of use cases, data systems, and compliance obligations in scope. You approve it before any work begins — that’s what “fixed” means here.
What it is not: This engagement decides whether and how — it doesn’t start building. Implementation is a separate, clearly scoped engagement, so this stays honest and bounded. You leave with a plan you own, whether you build it with me or on your own.
If “private AI” and “confidential computing” are being used interchangeably in your planning, start with the guide to what each one protects — and what it does not.
Want to see the shape of it first? There’s an illustrative sample deliverable — structure, use-case triage, reference architecture, and all.
Start with an assessment See a sample
Encryption & Key Management Advisory
The question this answers: Is our sensitive data genuinely protected — and will it still be protected in five years?
This is the foundation everything else sits on, and it’s where I’ve spent my career. It’s rarely urgent until it suddenly is: a failed audit, a breach, a regulator’s letter, a merger’s due-diligence review.
Where I help:
- Encryption architecture reviews — is data actually protected at rest and in transit, or only on paper?
- Key management strategy — because who controls the keys determines whether your encryption means anything
- Hardware security module (HSM) guidance and design
- Post-quantum readiness — the migration NIST says organizations should begin planning now, started before it becomes an emergency. Most teams have no inventory of where their cryptography even lives. That’s where this begins; the practical first step is a cryptographic inventory.
Format: Scoped to the engagement — from a focused architecture review to a full key-management strategy.
Fit and boundaries
- Do you replace our MSP?
- Not necessarily. If you need regular help-desk coverage, monitoring, and after-hours response, the right MSP may be exactly what you need. I can help you choose one, work alongside the one you have, or cover the decisions and projects that sit outside its normal service.
- Will you work with our current providers?
- Yes. Good work often means giving the existing network, software, copier, security, or managed-service provider a clearer plan and one person who can connect the decisions across vendors.
- Do you provide a help desk or emergency support?
- No. Herzog Enclave is an independent consulting practice, not a staffed service desk or round-the-clock incident-response line. I will say so early when reliable coverage matters more than individual expertise.
- Can you implement what you recommend?
- Often, yes. An assessment stays separate from implementation so the recommendation remains honest. Any follow-on work receives its own written scope, timing, and fee.
- How are fees established?
- The initial call is no-obligation. If there is a fit, you receive a written scope with the deliverable, timing, and fixed fee—or a clearly bounded retainer for ongoing advisory. Nothing begins until you approve it.
- Do you work outside Eastern North Dakota?
- Yes. On-site work is centered on Eastern North Dakota; advisory, assessments, vendor reviews, and much of the specialist work can be done remotely.
Not sure which fits? Most engagements start with a short call to figure out what you actually need — which is sometimes less than you feared, and occasionally something you hadn’t considered.