About Sylvan Assurance

Sylvan makes security legible — plain-English, defensible guidance, whether you run the business or run the security.

A Vermont LLC with two lines under one roof. Sylvan Assurance publishes plain-English compliance and security toolkits for small businesses, fractional Chief Information Security Officers (CISOs), Managed Security Service Providers (MSSPs), and incident-response operators. Sylvan Press publishes field-tested operator references for security practitioners. Built deliberately small to stay close to the work.

Mission

To make the operator-grade compliance and security playbook — the kind a senior consultant would email a Word document for — available as a one-time-purchase printable toolkit at a price a small team can actually approve.

The format is opinionated on purpose. Every acronym is expanded on first use. Every claim cites the underlying standard. The disclaimer in every document distinguishes operational guidance from legal advice without hiding behind boilerplate. The page count is whatever the work needs — not stretched to look impressive, not compressed to ship faster.

What makes Sylvan different

Written from experience

Sylvan toolkits are written from experience, not theory. They're grounded in decades of frontline security work across incident response and network security, and in the professional standards that field holds people to. Sylvan Assurance's work draws on Certified Information Systems Security Professional (CISSP) and Certified Secure Software Lifecycle Professional (CSSLP) certification. It's backed by 26+ years in incident response and product security. We publish under the imprint rather than a personal byline on purpose: the work should stand on what it says, not on who says it. Every claim cites the standard behind it, so you never have to take our word for it.

Privacy-first by architecture, not by promise

Every free assessment we publish runs entirely in your browser. We never receive your assessment answers. No analytics, no cookies, no telemetry. The Content-Security-Policy on our assessment pages prohibits the script sources that would make tracking possible. That is the architectural enforcement of the brand promise; you can verify it yourself in your browser's developer tools — the policy arrives with every page as a response header.

The only data we collect, and only when you give it to us explicitly: email address (free-guide opt-in), purchase information (handled by Lemon Squeezy as Merchant of Record), and support correspondence. Aggregate Cloudflare server-side traffic counts — page views and country, no individual identification — round out our analytics footprint. Details in our Privacy Policy.

One-time purchases

Every toolkit is a one-time purchase. Your files, yours forever. Thirty-day money-back guarantee, no questions asked. The model is closer to a well-edited book than to a software subscription. Pricing tops out at $299 for any single product.

No sales calls

There is no sales call. The toolkits are self-serve through Lemon Squeezy. If you want to know whether a toolkit fits before buying, take the free assessment for that product or read the table of contents on the product page. If a real-person question would still help, email support@sylvanassurance.com. We answer every message ourselves.

The eleven toolkits

Company facts

Press kit

For journalists, podcasters, conference organisers, or partners. Email support@sylvanassurance.com with the subject "Press — <outlet name>" for high-resolution assets or interview requests.

Boilerplate (one-sentence)

Sylvan Assurance is a Vermont LLC publishing plain-English compliance and security toolkits for small product teams, fractional CISOs, MSSPs, and incident-response operators — privacy-first by architecture, files you own forever.

Boilerplate (paragraph)

Sylvan Assurance, LLC is a Vermont limited liability company that publishes operator-grade compliance and security toolkits as one-time-purchase printable documents. Eleven toolkits cover General Data Protection Regulation readiness, small-business security baselines, product-security incident response, and vulnerability management. They also cover AI security, cloud security, the first hour of any incident, the Article 33 72-hour breach-notification clock, security-questionnaire response, SOC 2 audit-readiness, and cyber-insurance renewal readiness. Every free assessment runs entirely in the visitor's browser. Sylvan never receives the answers.

Brand colour palette

Navy #1F3864, sage #4A7C59, cream #FAF7F2, paper #FFFFFF. Full brand kit available on request.

Downloadable assets (available on request)

Talking-point sheet — the questions journalists ask

"Why downloadable PDFs instead of software as a service (SaaS)?"

Because the work the toolkits do — answer a security questionnaire, run the first hour of an incident, draft the Article 33 notification — is bursty rather than continuous. A SaaS subscription is the wrong shape for a need that arrives twice a year. A one-time-purchase printable playbook the customer owns is the right shape. The format also keeps Sylvan small and focused, which is itself part of the strategy.

"How can you stay in business without selling annual subscriptions?"

Low fixed costs, matched to how customers actually buy. The toolkits are self-serve, so there's no sales operation to fund; static hosting keeps infrastructure lean; and Lemon Squeezy acts as Merchant of Record, handling sales tax and VAT so we don't carry that overhead. Each toolkit is a one-time purchase of work people genuinely need, so the unit economics hold at modest volume — we don't have to chase scale to stay sustainable.

"What's the brand stance on 'AI'?"

Sceptical of the buzzword; clear-eyed about the tool. We treat AI like any good tool in the workshop — used well it speeds the work along, but on its own it can't build anything worth keeping. The expertise, the judgement, and the decisions about what's actually correct come from people who have done this work for real. That's why we don't sell the toolkits as AI-generated, AI-powered, or AI-anything: what you're buying is the human craft behind every page.

"What's next?"

Books. Under our Sylvan Press imprint we're bringing the same operator-grade material into long-form: a series of field guides, each paired with a companion operator's workbook, covering incident response, product security, and data-protection practice. The first titles are in final production now — see them on the Sylvan Press page. Each book stands on its own but deepens the thinking behind the toolkits — where a toolkit hands you the playbook to run, the field guide explains the judgement behind it. Long-form articles (the "First hour of an incident" and "The 72-hour clock" pieces are the first two) keep shipping alongside them.

Contact

For any question, email support@sylvanassurance.com. Mention the topic in the subject line ("Press —", "Partner —", "Support — <product>", etc.) for fastest routing.