About | KGA Partners

Who we are

An independent assessment practice based in Austin, Texas.

KGA Partners assesses IT controls against NIST SP 800-53, CMMC Level 2 readiness (NIST SP 800-171), Texas DIR security control standards, and IT general controls (ITGC). Our assessment methods and supporting tools are built around those frameworks, and every engagement is evidence-based and explained in practical business terms.

KGA Partners does not implement the controls it assesses. That keeps every review independent.

KGA Partners serves organizations across Texas and nationally, with a focus on public-sector, regulated, and government-contractor compliance requirements.

Credentials and experience

CISA® Certified Certified Information Systems Auditor (ISACA) Verify credential
PMP® Certified Project Management Professional (PMI) Verify credential
Airbus + Texas Government Experience Prior experience across enterprise IT operations, access management, controls, and compliance support, including Airbus Helicopters and the Texas Office of the Attorney General.
Business + IT + Accounting A multidisciplinary background connecting technology controls with business risk.
NIST · CMMC Readiness · Texas DIR · ITGC Assessment methods developed and aligned with the compliance requirements most relevant to public-sector, regulated, and government-contractor organizations.

Engagements are led by Sherif Kassem, CISA®, Principal Consultant.

How we work

The process, from discovery to final report.

Discovery call. Understand your environment and drivers
Scope agreement. Confirm the framework and engagement boundaries
Framework identification. Confirm NIST SP 800-53, CMMC Level 2 readiness, Texas DIR, or ITGC
Evidence request. Documentation list provided to your team
Evidence review. Documents gathered and reviewed against applicable requirements
Stakeholder clarification. Questions resolved with your team directly
Control evaluation. Controls evaluated against the agreed scope
Gap identification. Gaps documented and risk-scored
Findings report. Risk-rated report drafted and reviewed
Final delivery. Report and remediation plan delivered and walked through with your team

Engagement timelines are confirmed during scoping based on scope, evidence requirements, and stakeholder availability.

What we will not do

KGA Partners is an assessment and advisory practice. We assess what's there. We never audit what we built.

We do not implement or configure the controls we subsequently assess, and we maintain appropriate independence between advisory and assessment work. That independence is how you get findings you can trust.

KGA Partners does not perform CMMC certification assessments.

We assess. You implement.

How KGA Partners operates

What every engagement looks like.

◆

Evidence-based

Every finding is documented against the applicable control or requirement with the evidence that supports it.

◆

Explained in business terms

Findings are written for leadership, not just IT staff, with risk context, not just technical observations.

◆

Direct access, no layers

You work directly with the person who conducted the assessment, from the discovery call through the final walkthrough.

◆

Practical remediation guidance

The remediation roadmap is actionable, specific enough that your IT provider can execute it without a follow-up consultation.

Independent IT audit and compliance assessments, explained in plain business terms.