Columbia Advisory Group

What Columbia Advisory Group does

Columbia Advisory Group (CAG), founded in 2012 and headquartered in Plano, Texas, is a privately held IT consulting firm organized around three practice areas: Cybersecurity, Governance, Risk and Compliance (GRC); Managed Information Technology; and IT Leadership & Advisory. The firm delivers managed services, fractional executive leadership (vCISO, vCIO, DPO), and project-based advisory engagements to organizations across Higher Education, Government and Defense Contractors, Financial Services, Healthcare and Pharma, Oil and Gas, and Manufacturing. Service delivery spans a 24/7 US-based Security Operations Center, managed detection and response, compliance readiness across more than a dozen frameworks (CMMC, NIST 800-171/800-53, FedRAMP, HIPAA/HITECH, SOC 2, ISO 27001, PCI-DSS, SOX, GDPR, CCPA), managed ERP/CRM (Ellucian Banner, Microsoft Dynamics, SAP, Oracle NetSuite, Sage X3, Odoo, PeopleSoft, Salesforce), and multi-cloud managed services across Microsoft Azure, AWS, Google Cloud, and Oracle Cloud. The firm holds ISO 9001:2015 certification for the seventh consecutive year and is accessed by public sector buyers via E&I, TIPS-USA, and Buyboard procurement cooperatives.

The technology stack relies on third-party SIEM and AI threat detection platforms (Splunk, LogRhythm, QRadar, AlienVault, Darktrace, Stellar Cyber) layered with human analyst oversight, augmented by technology partnerships with Microsoft, AWS, Oracle Cloud, Salesforce, Arctic Wolf, Pax8, D2L, AppZen, and auditing partner Kirkpatrick Price. CAG's revenue model is a blend of recurring managed services contracts (multi-year terms with monthly or annual billing) and professional services engagements (project-based or retainer for vCISO/vCIO/DPO/M&A due diligence work). Sales motion is enterprise-field-sales-led, originating with custom needs analyses and system audits, targeting C-suite and IT leadership at Fortune 500, large institutions, and SMBs. The firm reports having served 300+ organizations and 100+ higher education institutions, completed 350+ assessments and 100+ managed services engagements, and supported 200+ M&A transactions through its leadership team. Leadership includes President and CEO David McLaughlin, SVP/CTO/CISO Brad Hudson, CMO Haley Rose, and CHRO Kimberly Hicks.

Name

Columbia Advisory Group

Legal name

Columbia Advisory Group LLC

Website

https://columbiaadvisory.com

Company type

Private

Founded year

2012

Operating status

Operating

Headcount range

51–100 employees

Short description

Columbia Advisory Group is a Dallas-area IT consulting and managed services firm delivering cybersecurity, compliance, managed IT, and fractional executive advisory (vCISO/vCIO/DPO) to organizations in higher education, government, financial services, healthcare, oil and gas, and manufacturing.

Ownership category

akta.pro rank

Product category

IT Consulting and Managed Services

NAICS

Management Consulting Services (54161), Computer Systems Design and Related Services (54151), Management, Scientific, and Technical Consulting Services (5416), Other Scientific and Technical Consulting Services (54169), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Management Consulting Services (8742), Services-Engineering, Accounting, Research, Management (8700)

akta.pro industry

PRIMARYBPAHAEAG

Cybersecurity & Identity Consulting

Business & Public Services/Professional Services (Legal, Accounting, Consulting)/Technology & Digital Consulting

SECONDARYBPAHAFAO

Compliance Technology, GRC Platforms & Controls Automation Advisory

Business & Public Services/Professional Services (Legal, Accounting, Consulting)/Risk, Compliance & Governance Advisory

SECONDARYBPAHADAB

Corporate Finance & Capital Advisory

Business & Public Services/Professional Services (Legal, Accounting, Consulting)/Strategy & Corporate Finance Advisory

SECONDARYBPAKADAG

Security Governance, Risk & Compliance (GRC) Advisory

Business & Public Services/Security & Investigations Services/Security Consulting, Risk Assessment & Audits

SECONDARYHDADAIAG

Regulatory Change Management (RCM)

Hardware, Technology & Telecom/Cybersecurity/Governance, Risk & Compliance (GRC)

SECONDARYHDAEALAK

IT Governance, Risk & Compliance (IT GRC) Platforms

Hardware, Technology & Telecom/Enterprise Platforms & Databases/Enterprise Service Management (ITSM/ESM) Platforms

Keywords

• Managed IT services
• Cybersecurity consulting
• Regulatory compliance services
• Cloud infrastructure management
• Fractional IT leadership

Headquarters

HQ city

Dallas

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Managed IT Services: Recurring managed services engagements providing ongoing IT management, monitoring, and support. Services include managed IT, managed security, cloud management, and network operations. Delivered through multi-year contractual agreements with monthly or annual billing.
2. Professional Consulting Services: Advisory and consulting engagements including vCISO, CIO services, Data Protection Officer, IT Due Diligence, and cybersecurity assessments. Typically project-based or retainer arrangements for fractional/executive-level expertise.
3. Compliance and Governance Services: Compliance readiness assessments and implementation services for frameworks including CMMC, NIST 800-171, FedRAMP, HIPAA, SOC 2, PCI-DSS, SOX, GDPR, and CCPA. Includes continuous monitoring and third-party audit preparation.
4. IT Due Diligence (M&A): Transaction advisory services for mergers and acquisitions including IT posture evaluation, scalability assessment, and integration planning. Project-based engagements for private equity, venture capital, and strategic acquirers.

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels7 records

Core offering

Columbia Advisory Group is a Dallas-based IT consulting firm delivering managed cybersecurity, managed IT, and fractional IT leadership services (vCISO, vCIO, DPO). The firm operates a 24x7 US-based Security Operations Center and provides compliance readiness across frameworks including CMMC, NIST 800-171, FedRAMP, HIPAA, SOC 2, PCI-DSS, SOX, GDPR, and CCPA for clients in higher education, government, financial services, healthcare, oil and gas, and manufacturing.

Product overview

Columbia Advisory Group is an IT consulting firm offering a portfolio of managed services organized around three practice areas: Cybersecurity, Governance, Risk and Compliance (GRC); Managed Information Technology; and IT Leadership & Advisory. The Cybersecurity practice provides vCISO (CISOaaS), Security Operations Center Services with AI-powered threat detection using Splunk, LogRhythm, QRadar, AlienVault, Darktrace, and Stellar Cyber, Managed Detection and Response (MDR), and compliance readiness across CMMC, NIST 800-171, FedRAMP, HIPAA/HITECH, SOC 2, NIST 800-53, ISO 27001, PCI-DSS, SOX, GDPR, and CCPA frameworks. Managed IT encompasses Managed IT Services, Managed ERP & CRM (supporting Ellucian Banner, Microsoft Dynamics, SAP Business One, SAP ERP, Oracle NetSuite, Sage X3, Odoo, Oracle PeopleSoft, and Salesforce), Cloud and Infrastructure Managed Services leveraging Microsoft Azure, AWS, Google Cloud, and Oracle Cloud, and Network Operations Services. IT Leadership & Advisory provides CIO Services (CIOaaS), Data Protection Officer Services, and M&A IT Due Diligence. CAG delivers specialized solutions for Higher Education (including Banner SIS management, Canvas LMS, D2L Brightspace, Salesforce CRM, TargetX), Government/Defense (CMMC, NIST, FedRAMP), Financial Services (GLBA, PCI, NIST), Healthcare (HIPAA), Oil and Gas (TSA Pipeline Security), and Manufacturing (SOX, SOC 2, CMMC).

Differentiator

Problem solved

Functional benefit

Products and services

• Cybersecurity, Governance, Risk and Compliance Comprehensive risk mitigation services including security program development, compliance readiness assessments, and regulatory adherence across frameworks such as CMMC, NIST, HIPAA, FedRAMP, SOC 2, ISO 27001, PCI-DSS, SOX, GDPR, and CCPA.
• vCISO (Virtual Chief Information Security Officer) Fractional or virtual CISO service providing strategic cybersecurity leadership, security roadmap development, compliance governance, and program implementation on an as-needed basis, including CISOaaS offerings with end-to-end security leadership and vendor-neutral advice.
• Security Operations Center (SOC) Services 24x7 tactical SOC providing advanced monitoring using SIEM and AI threat detection platforms (Splunk, LogRhythm, QRadar, AlienVault, Darktrace, Stellar Cyber), automated threat detection combined with live analysts, and continuous compliance reporting across cloud, network, and endpoints.
• SOC-as-a-Service 24/7/365 SOC-as-a-Service utilizing US-based cybersecurity professionals and cloud-native SIEM and AI platforms (Splunk, LogRhythm, QRadar, AlienVault, Stellar Cyber) for real-time visibility of entire threat landscape with automated threat detection combined with live analyst oversight.
• Managed IT Services Managed IT service delivery covering technology stack maintenance through people, communication, data and analytics, infrastructure, applications and systems, governance, audit and compliance, service and support, and innovation. Includes IT outsourcing, network operations, service desk, and managed security services.
• Managed ERP & CRM Managed services for ERP and CRM systems including Ellucian Banner, Microsoft Dynamics, SAP Business One, SAP ERP, Oracle NetSuite, Sage X3, Odoo, Oracle PeopleSoft, and Salesforce. Covers customization, integration, data warehousing, and functional consulting.
• Cloud and Infrastructure Managed Services Managed cloud services leveraging Microsoft Azure, AWS, Google Cloud, and Oracle Cloud for cloud migration, workload management, and digital transformation. Includes cloud strategy, landing zone setup, data sovereignty auditing, and secure cloud operations.
• Network Operations Services 24x7 network monitoring and management via Network Operations Center (NOC) including incident management, maintenance and troubleshooting, patch management, and compliance-focused operations. Provides proactive monitoring of network assets and equipment in real-time.
• Chief Information Officer (CIO) Services On-demand CIO leadership services including IT strategy definition, budget management, vendor interactions, IT steering committee facilitation, performance metrics, IT roadmap execution, and staff management. Also referred to as CIOaaS (CIO as a Service).
• Data Protection Officer (DPO) Services Fractional DPO service providing controls covering GDPR and CCPA compliance, regulatory monitoring, employee training, security audits, and data subject interfacing. Monitors compliance with data privacy legislation and serves as link between organization and supervisory authorities.
• Mergers and Acquisitions (M&A) Consulting IT due diligence and technology advisory services for M&A transactions covering IT budget analysis, cybersecurity evaluation, infrastructure scalability assessment, cost reduction opportunities, and 3-5 year capital expenditure projections. Supports Private Equity, strategic acquisitions, and carve-outs.
• Higher Education Technology Services Comprehensive IT services for higher education institutions including Managed IT, vCIO/vCISO/DPO, Student Information Services (Ellucian Banner), infrastructure, cybersecurity MDR, ERP/CRM, cloud migration, Learning Management Systems (Canvas, D2L Brightspace), and CRM (Salesforce, TargetX). Supports enrollment, recruitment, student success analytics, research, and data security.
• Government Sector Cybersecurity Cybersecurity solutions for Federal, State, Local, and Defense contractors covering CMMC, NIST 800-171, FedRAMP, NIST 800-53, HIPAA/HITECH, GDPR, CCPA, ISO 27001, TAC 202, and FISMA compliance frameworks.
• Financial Services Technology Managed services for Banking, Insurance, and Private Equity firms covering strategy, governance, risk and regulatory compliance, cybersecurity operations, identity and access management, incident response, application security, GLBA compliance, PCI compliance, and NIST 800-171 compliance.
• Healthcare & Pharma IT Services IT and cybersecurity services for healthcare entities covering regulatory compliance (NIST 800-171, HIPAA, PCI), strategy, governance, risk assessment, interim/fractional CIO/CISO leadership, digital transformation, identity-based security, encryption, and data forensics.
• Oil and Gas Cybersecurity Specialized cybersecurity services for oil and gas companies covering TSA Security Directive Pipeline compliance, Cybersecurity Implementation Plans, incident response planning, and cybersecurity assessment programs. Includes managed cybersecurity operations and fractional CISO services.
• Manufacturing Cybersecurity Managed compliance services for manufacturing covering SOX, SOC 2, PCI/DSS, and CMMC frameworks. Includes cybersecurity risk assessment, vulnerability identification, and policy standards development aligned with industry security frameworks.

Quantifiable outcome

• Identified 181,000 annual ineffective hours translating to $10.8 million annual savings opportunity for Fortune 50 financial institution
• +2 more outcomes

Named customers12 records

Segments6 records

Ideal customer profiles6 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration32 records

AI capability4 records

Feature4 records

Partnerships

13 partnerships are on record, tiered core and supporting.

• E&I Cooperative ServicescoreChannel Partner/ Reseller/ Distributor · 23 September 2024Selected as E&I Cooperative Services partner for cybersecurity and compliance services, enabling CAG to serve public sector and education clients through cooperative purchasing agreements.
• AbacodesupportingTechnology or Integration · 14 June 2022Partnership added Extended Detection and Response (XDR) capabilities to CAG's IT managed service portfolio, enhancing 24/7 threat monitoring and incident response services.
• TIPS-USA Purchasing CooperativecoreChannel Partner/ Reseller/ DistributorContract awards with TIPS-USA allow education, municipal, county, and state agency clients to meet technology needs through pre-negotiated cooperative purchasing contracts.
• Buyboard Purchasing CooperativecoreChannel Partner/ Reseller/ DistributorCooperative purchasing agreement enabling education and public sector clients to procure CAG services through established buying consortium.
• Arctic WolfsupportingTechnology or IntegrationTechnology partner providing 24/7 cybersecurity vigilance with Concierge Security Team delivering advanced threat detection and response capabilities.
• SalesforcesupportingTechnology or IntegrationTechnology partner for CRM systems, particularly supporting higher education customer relationship management and nonprofit organization operations.
• Oracle Cloud InfrastructuresupportingTechnology or IntegrationCloud infrastructure partner supporting enterprise cloud migrations, data warehousing, and Oracle-based Student Information Systems for higher education clients.
• MicrosoftsupportingTechnology or IntegrationAzure cloud platform partner utilized for cloud migrations, data warehousing solutions (Azure Data Factory, Azure SQL, Azure Purview), and security services (Azure Sentinel).
• AWSsupportingTechnology or IntegrationCloud infrastructure partner supporting enterprise cloud migrations and multi-cloud management strategies.
• Kirkpatrick PricesupportingImplementation/ SI/ Consulting PartnerInformation security auditing firm partnership providing SOC 1, SOC 2, HIPAA, HITRUST CSF, PCI DSS, GDPR, ISO 27001, and FISMA audits for client compliance verification.
• Pax8supportingChannel Partner/ Reseller/ DistributorCloud distribution partner simplifying procurement and management of cloud solutions with consolidated billing and automated provisioning.
• D2LsupportingTechnology or IntegrationLearning innovation partner supporting higher education institutions with modern learning management systems.
• AppZensupportingTechnology or IntegrationFinance AI platform partner for financial transformation and expense management capabilities.

Scale indicators8 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Sikich: Mid-market professional services firm combining technology, cybersecurity, and managed services across multiple industries. Closely comparable to CAG in size, vertical breadth, and managed-IT-plus-compliance positioning.
• KirkpatrickPrice: Information security auditing firm delivering SOC 1/2, ISO 27001, HIPAA, PCI DSS, GDPR, and FISMA audits. Overlaps with CAG's GRC readiness practice; CAG also partners with KirkpatrickPrice for client audit delivery.
• eSentire: Managed Detection and Response provider offering 24/7 SOC services and incident response. Directly comparable to CAG's SOC-as-a-Service and MDR practices, with similar mid-market and enterprise target customers.
• Arctic Wolf: Pure-play MDR/SOC provider offering 24/7 managed detection and response with a concierge security model. Directly comparable to CAG's SOC-as-a-Service and MDR offerings; CAG also partners with Arctic Wolf, evidencing direct overlap.
• CampusWorks: Higher education IT services firm providing managed services, SIS/ERP support, and CIO advisory to colleges and universities. Directly comparable to CAG's Higher Education practice and Ellucian Banner lifecycle expertise.
• A-LIGN: Cybersecurity and compliance audit firm specializing in SOC 2, ISO 27001, HITRUST, PCI, and FedRAMP assessments. Comparable to CAG's GRC readiness and compliance advisory business across SMB and enterprise clients.
• Schellman: Specialty compliance and cybersecurity assessment firm delivering SOC 2, ISO 27001, HIPAA, PCI, and FedRAMP attestation services. Directly competes with CAG's compliance readiness and GRC advisory practices across regulated industries.

Broad incumbents

• Slalom: Large US-based management and technology consulting firm with strong cloud, cybersecurity, and data practices. Competes with CAG on enterprise IT strategy, cloud migration, and digital transformation mandates.
• Optiv: Large US cybersecurity solutions provider delivering advisory, managed security, and integration services across enterprise and government. Overlaps with CAG's vCISO, SOC/MDR, and GRC practices but at much greater scale and breadth.

Emerging players

• Pivot Point Consulting: Healthcare-focused IT consulting and managed services firm delivering EHR, ERP, and cybersecurity advisory. Comparable to CAG's Healthcare & Pharma vertical practice and HIPAA/HITECH compliance work.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xtwitter.com/CAG_Dallas
• Facebookfacebook.com/ColumbiaAdvisoryGroup
• LinkedInlinkedin.com/company/columbia-advisory-group

Compliance19 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Columbia Advisory Group