Risk Assessment
A structured review of your cybersecurity posture, data handling practices, and vendor relationships — with findings in plain language.
We strengthen community organizations and build workforce pathways through supervised, real-world service — bridging the gap between vulnerable communities and the expertise they need.
Request clinic support for your organization
Join the workforce pathway through clinic service
Connect with clinic-trained talent
Support scalable community cyber resilience
The TechStep Clinic delivers structured, supervised cyber and data risk services to nonprofits, schools, and community organizations — at no cost to you. Our participants do real work, reviewed by real practitioners, resulting in deliverables your team can actually use.
A structured review of your cybersecurity posture, data handling practices, and vendor relationships — with findings in plain language.
Practical, right-sized policies your team can actually use: data classification, incident response, acceptable use, and more.
Evaluation of third-party tools and vendors you rely on, with prioritized recommendations and a usable inventory.
Guidance on responsible AI use, data governance frameworks, and managing third-party tools your staff has adopted.
Alignment guidance for HIPAA, FERPA, NIST CSF, and other frameworks relevant to your organization type.
Short educational sessions to help your team recognize and respond to common threats — tailored to your context.
Your deliverables
Your commitment
Tell us about your organization. A member of our team will follow up within 5 business days.
The TechStep Clinic isn't a course or a bootcamp. It's a supervised workforce pathway where you develop real GRC and risk management skills by doing actual work — for real organizations, with real stakes, under the guidance of experienced practitioners.
Participants don't just learn about cybersecurity risk — they deliver it. Every engagement is real. Every deliverable matters. Every client is a community organization counting on your work.
You will be assigned to a team working with a real community partner. Under close supervision from experienced practitioners, you will conduct interviews, analyze risk, draft documentation, and present findings. Work product is reviewed before it goes to the client.
Engagements typically run 6–10 weeks. You may participate in multiple engagements over time, building depth across different organization types and risk domains.
Time & commitment
Mentorship & support
Tell us about yourself and your goals. We review applications on a rolling basis.
TechStep Clinic participants don't just know the frameworks — they have applied them. They have interviewed real clients, written real policies, and delivered real risk assessments under the supervision of experienced practitioners.
Governance, risk, and compliance frameworks applied in real organizational contexts — not just studied in isolation.
Third-party risk assessments, vendor questionnaires, and contract review for data and security provisions.
Data classification, handling policies, privacy considerations, and regulatory alignment basics across multiple frameworks.
Responsible AI use policies, AI risk inventories, and governance frameworks for emerging and third-party tools.
Writing and structuring security policies, procedures, and risk reports — including for non-technical leadership audiences.
Conducting risk interviews, presenting findings, and communicating risk to organizational leadership under supervision.
Let us know how you would like to engage and we will follow up with options that fit your needs.
The TechStep Clinic is a scalable, dual-impact model — delivering real risk services to underserved organizations while creating structured workforce pathways into the cybersecurity field.
Community organizations — nonprofits, schools, faith communities, local governments — are trusted with some of the most sensitive data in society: health information, youth records, financial data, immigration status. Yet most lack the resources, expertise, or internal capacity to manage cyber and AI risk in any structured way.
At the same time, the cybersecurity workforce gap remains critical. Traditional pathways favor candidates with expensive credentials and existing networks. First-generation professionals and career changers face structural barriers to entry.
The TechStep Clinic addresses both problems simultaneously — through supervised, community-based service.
We track outcomes at both the community level (risk posture improvements, deliverables received) and the workforce level (credential attainment, employment, compensation). We are committed to transparent, verified reporting.
We grow capacity deliberately — prioritizing quality of supervision and outcomes over speed of scale. As the model matures, we are developing a tiered sustainability structure that includes philanthropic support, earned revenue from hiring partners, and institutional partnerships with academic programs.
Funders who invest early help establish the evidence base for broader replication. We welcome conversations about multi-year support, evaluation partnerships, and aligned program investments.
We welcome conversations with foundations, government agencies, and institutional partners.