From IT Operations to Security Governance with Derek Hardmon
Derek Hardmon, founder of Secure Technology Consultants, is our guest in this edition of our Founder Spotlight Series.
Born and raised in Mississippi, Derek leveraged his background in cybersecurity, risk management, and IT leadership to build an Atlanta-based firm dedicated to helping small and medium-sized businesses establish robust security posture, maintain audit readiness, and succeed in government contracting—all without needing an enterprise-level budget.
I sat down with him for the podcast to discuss the difference between IT operations and information security, how small businesses can build real compliance programs, and how AI is opening up new threat models and management opportunities. His answers are lightly edited for length and clarity.
The conversation
Could you tell us a little bit more about you and the work you do?
My name is Derek Hardmon, and I am the founder of Secure Technology Consultants, based out of Atlanta, Georgia. I was born and raised in Greenville, Mississippi, and graduated from Jackson State University in Jackson, Mississippi.
My background in cybersecurity, risk management, and IT leadership over the years helped me establish a business to assist smaller to medium-sized businesses with their growth, cybersecurity, government contracting efforts, and finding practical ways to improve their cybersecurity posture without needing an enterprise-level budget.
Weren't smaller businesses being attacked back in the day, or how did they defend themselves?
Why do criminals rob the bank? Because that's where the money is. As a hacker, you're primarily going after larger organizations where you get more bang for your buck. That doesn't mean smaller organizations don't hold sensitive information, but the payout is different.
It's like someone walking through a parking lot pulling on car doors to see which ones are unlocked. Pulling on the door of an inexpensive car isn't the same as pulling on the door of a luxury car, but you still want to make sure your doors are locked regardless.
Tell us a little bit more about Secure Technology Consultants. How did you come up with the name?
The name comes from "Secure Tech" and operating as a consultant. It's STC—straight to the point of what we're trying to accomplish. The main goal is to help small and medium businesses get onto the level they need to be regarding compliance, risk management, and policy development—things that in the past they probably couldn't afford to do, but are accessible to them now.
What type of businesses do you work with?
It's pretty much across the board. I've been fortunate enough to work with financial institutions, organizations in the public health space, and legal firms. All of them are regulated on some level.
When you talk about compliance, the goal is to be audit-ready at all times. Certain industries will be audited more frequently or quickly than others, but every business should operate within that frame of mind.
Do regulators pick at random, or how do audits work?
It depends on your industry. In finance, you're required to stay compliant under bodies like the OCC because you hold a high responsibility for your clients' assets, so those audits happen on a regular schedule.
In government contracting, mandates like CMMC require contractors to meet frameworks such as NIST 800-171. Meeting these expectations and demonstrating due diligence makes a business far more attractive than competitors when bidding on contracts.
What does it mean to build real cybersecurity and compliance programs?
For a small business, you start with foundational controls: identity and access management (IAM), multi-factor authentication (MFA), endpoint protection with reporting, backups, and security awareness training.
Identity management ensures people only have access to what they need to perform their daily duties—operating under the principle of least privilege. Endpoint protection should include monitoring so you can prove every device is secure. With backups, you have to actively monitor them; scheduled backup jobs can fail silently for months if no one is reviewing them. Finally, security awareness training is critical because the human element is often the biggest vulnerability due to lack of education rather than malice.
Why is it important for small businesses to build these compliance systems?
It's vital to recognize that IT operations and information security are not the same thing—they have two different goals. IT operations focuses on uptime, availability, and making sure employees can complete their work without technical friction.
Information security focuses on data protection, threat mitigation, vulnerability checking, and risk management. Companies must balance the two: keep employees functional while ensuring sensitive data remains protected according to industry, size, and budget.
Has AI made your job more difficult or less difficult?
It hasn't made my life more difficult. While there are concerns about job displacement, AI opens up an entirely new threat model. That creates significant opportunities around governance, auditing, compliance, and managing how AI systems are deployed securely.
For everyday users, AI brings convenience, but it still requires domain expertise. LLMs like ChatGPT or Gemini can output incorrect information; without working knowledge of the topic, users risk following inaccurate guidance down a rabbit hole.
What are some things a small business or startup founder can do to build these programs?
To stand up a real security program, leadership must start with a Business Impact Assessment (BIA) and a risk analysis. This needs to be business-driven, involving the custodians and owners of each operational area.
You map out your assets, assign value to them, evaluate the impact if an asset is compromised, and establish incident response and vendor management programs. From there, leadership defines the organization's risk appetite and codifies these expectations into top-down policies and standards.
What is one final tip regarding cybersecurity you would leave our audience with?
We live in an age where everything is important when it comes to protecting your data—whether for an individual, a small business, or a large enterprise—especially given AI-driven attack vectors. Everyone must take it seriously.
Closing thoughts
Derek’s insights underline the necessity of separating operational IT from information security governance while building scalable defenses tailored to small business resources. Key takeaways include:
Differentiate IT from Security: Uptime and access (IT) must be balanced with data protection and risk governance (InfoSec).
Cover the Foundational Basics: Enforce least privilege access, MFA, endpoint monitoring, verified backups, and continuous employee security training.
Conduct a Business Impact Assessment: Identify critical assets, evaluate risk appetite, and establish clear incident response procedures from the top down.
Prepare for AI Threat Models: AI tools add operational speed but require human oversight and updated compliance framework structures.
Connect With Our Guest?
Follow Derek Hardmon on LinkedIn and learn more at securetcllc.com
