Days 1–30
Baseline the truth
Read-only review of your Microsoft 365 tenant, identity, devices, SaaS and vendors. Every finding comes from your actual configuration, with its source attached. You get a risk register your board can read.
Fractional CIO · Silicon Slopes · Microsoft 365 & Entra ID
A CIO for the part of the week you need one.
Utah companies with 50 to 500 people have outgrown "the MSP handles IT" and can't justify a $250K full-time CIO. CognaIDM fills that gap: a day a week at your leadership table, running technology, security and identity on evidence instead of guesswork.
[EVIDENCE]→
[DECISION]→
[CHANGE]
Is this you?
You have IT. You don't have anyone accountable for it.
Most companies at this stage share a few symptoms. If three or more sound familiar, a fractional CIO pays for itself in the first quarter.
- 01A customer sent a security questionnaireOr an investor, insurer or enterprise prospect asked about SOC 2, and nobody on staff can own the answer.
- 02You went from 50 to 200 people fastIdentity, devices and SaaS sprawl were set up for a startup. Offboarding is a checklist someone forgets.
- 03Copilot is licensed and stalledLegal or IT paused the rollout because nobody can say what Copilot could surface. That's an access problem, not an AI problem.
- 04Your MSP runs tickets, not strategyThey're good at keeping things on. They aren't going to tell the board what to fund next year, or what to stop funding.
- 05Leadership decides IT by anecdoteSpend, risk and priorities are argued from opinions because nobody brings evidence from the actual environment.
- 06An acquisition or a close callYou're merging tenants, or a phishing incident got closer than anyone likes, and it exposed how little is written down.
How it works
Ninety days to an operating rhythm. Then a day a week to keep it.
Every engagement starts with the same 90-day arc, because leadership decisions are only as good as the evidence under them. After that, the work settles into a cadence your team can rely on.
Days 31–60
Roadmap and quick wins
A 12-month technology roadmap tied to business goals, with what to fund, what to stop and in what order. The two or three highest-risk fixes ship in this window, through proper change control.
Days 61–90
Install the rhythm
Monthly leadership review, quarterly board update, vendor and budget checkpoints, decision log and ownership matrix. Your IT lead or MSP knows exactly what they own.
What you get every month
- A seat at the leadership meeting and one written technology update
- Owned decisions on security, identity, vendors and spend
- Direction for your IT lead, MSP and security vendors
- Evidence packages ready for auditors, insurers and customers
What I don't do
- Replace your MSP or help desk, or compete with them
- Resell hardware, licenses or software
- Recommend tools I'm paid to recommend
- Stay longer than you need me; the goal is a team that runs it
Plans
Fixed monthly fee. No hourly billing, no surprises.
Pick the level of involvement your stage calls for. Every plan starts with the 90-day arc and runs month to month after that.
Advisor
Half a day a week · from $3,500/mo
- Monthly leadership review and written update
- Security and identity decisions owned
- Vendor, MSP and renewal oversight
- Email and phone access between sessions
Fractional CIO
One day a week · from $7,500/mo
- Everything in Advisor
- 12-month roadmap and budget, maintained quarterly
- SOC 2 or Copilot readiness run as a program
- Board and investor reporting
- Regular on-site days in Salt Lake City, Lehi and Provo
Embedded
Two days a week · from $12,500/mo
- Everything in Fractional CIO
- Hands-on Entra ID, Conditional Access and PIM work
- Tenant merges, migrations and audit remediation
- Mentoring an IT lead toward owning the role
Not ready for a retainer? Start with the Identity Health Check, a fixed-fee, two-week assessment of your Entra ID and Microsoft 365 estate. Its findings become the first 30 days of any plan.
Method
Decisions made on evidence, not on who argues loudest.
Most IT leadership runs on interviews and slide decks. Mine runs on a governed evidence graph pulled from your Microsoft tenant: every risk traces to a control, every control to a source, every change to an approved decision. This is a live sample. Switch persona to see what your board, your architect and your auditor each get shown.
Illustrative sample data. Open the full application for the evidence register and schema.
Specialist work
Where the hands-on hours go.
A fractional CIO who can also do the identity work is rare. These are the areas where I deliver, not just direct.
01
Azure & Microsoft Entra ID
Conditional Access, phishing-resistant MFA, PIM, hybrid sync and Azure governance, designed for Zero Trust.
02
Identity Management & SSO
ADFS to Entra ID single sign-on, SCIM provisioning and joiner-mover-leaver automation so offboarding is same-day, every time.
03
Active Directory
Security assessment, privileged access tiering, consolidation and a governed path to cloud identity.
04
Microsoft 365 Copilot readiness
Copilot sees what users can open. Fix oversharing and access first, then run a measured pilot your legal team will sign off on.
Identity Health Check
2 weeks · fixed fee
- Entra ID and AD evidence review
- Risk-to-control-to-Zero Trust mapping
- Executive readout you can hand to the board
SOC 2 Readiness Sprint
6–10 weeks · fixed fee
- Gap assessment against the Trust Services Criteria
- Identity and access controls implemented and evidenced
- Auditor-ready evidence packages
Copilot Readiness Sprint
3–4 weeks · fixed fee
- What Copilot can reach, per user
- Oversharing fixed in SharePoint and Entra ID
- Governed pilot with success metrics
About
Neal Flaxman, fractional CIO and Microsoft identity architect.
I've run Microsoft identity at enterprise scale. As Associate Director and global Microsoft Identity Architect at Sony, I supported more than 120 operating companies across Active Directory, Azure AD, MIM and Azure MFA on a Zero Trust model, and directed a service-provider team of over 80 engineers.
Before that I led identity architecture at Ingram Micro, moving 123 enterprise applications from ADFS to Azure AD SSO, and delivered Microsoft identity work for SAIC, SADA and public-sector clients, including a 1.5-million-identity consolidation for a ten-campus college district.
CognaIDM brings that to companies that will never need a full-time version of it: technology leadership grounded in evidence, approved through change control, and traceable to its source. I'm based along the Wasatch Front and on site in Salt Lake City, Lehi and Provo every week.
- SonyGlobal Microsoft Identity Architect, 120+ operating companies
- Ingram MicroSr. Identity Architect, Azure AD & SSO, pre-IPO controls
- SAICSr. Security Analyst, Identity & Access
- Boston Scientific20,000-user directory consolidation
- 1 patentIMMUTABLEID™ cryptographic identity anchoring
- 120+operating companies supported globally
- 123enterprise apps moved from ADFS to Azure AD SSO
- 1.5Midentities consolidated across ten campuses
Book a 30-minute call.
Tell me what's forcing the question: a questionnaire, an audit, a stalled Copilot rollout, a growth spurt. You'll leave with three concrete next steps whether or not we work together. Serving Utah, on site weekly in Salt Lake City, Lehi and Provo.
Or email flexflax24@gmail.com or call 801-987-0748