// Platforms I support
- Independent advisor
- Compliance
- Networks
- Physical security
Independent advice on compliance readiness, network security, and physical security.
Hans Study is an independent network and security consultant based in Ontario, Canada. Most of the work is compliance readiness, CPCSC first, then CMMC, NIST SP 800-171, and ISO 27001, alongside IT and OT network security and hardening. Physical security systems, such as CCTV and access control, are covered where they meet the network. Clients engage Hans when the problem is complicated and they need someone who will tell them what is true, not what is profitable to say.
IndependentNo reseller margin
CurrentCISSP
FocusCPCSC and CMMC
Compliance and readiness
CPCSC Level 1 and Level 2 readiness, CMMC and NIST SP 800-171 for suppliers selling to U.S. primes, and ISO 27001. Gap assessment, policies, and the system security plan, then a sequenced plan.
Explore compliance work
Networks and security
IT and OT networks. Segmentation, firewall and switch review, vulnerability and network security assessments, and hardening for Windows, Cisco, Aruba, and Juniper.
Explore network security
Physical security
Cameras, access control, intercom, and VMS. Genetec Security Center, C-CURE, Milestone, Avigilon, and Axis, designed with the network they run on.
Explore physical security
Now available
Managed network and server support, and fractional CISO retainers.
Preventative monitoring, patching, and maintenance for the infrastructure a business actually depends on, on a monthly plan, with on-demand remote support when something breaks. Senior security leadership on retainer for organizations that need a CISO's judgment without a full-time hire. Independent, CISSP-certified, delivered remotely.
Compliance and advisory05
Compliance readiness and security leadership.
The compliance and leadership side. CPCSC and CMMC readiness, NIST SP 800-171 and ISO 27001 gap assessments, fractional CISO work, and the OT, IT, and physical security boundary. Independent, with nothing to sell you but the advice.
Talk through a decisionCPCSC and CMMC readiness
Scoping, gap assessment, policies, and the system security plan for Canadian defense suppliers, with CMMC and NIST SP 800-171 for those selling to U.S. primes.
Security assessments and reviews
Independent program and gap assessments against NIST 800-171, NERC CIP, ISO 27001, and CIS Controls, plus architecture, hardening, and project oversight.
OT/IT convergence security
The physical, OT, and IT boundary, assessed and secured by someone who reads both sides. Where a lot of real exposure hides.
Fractional CISO and vCISO
Retained, part-time security leadership for organizations without a full-time CISO. Strategy, board reporting, program ownership, risk, and incident oversight.
Strategic security and technology
Independent strategy for the decisions that are expensive to reverse. Roadmaps, architecture direction, platform selection, and due diligence. Project-based and vendor-neutral.
Not sure which fits?
A scoping call sorts out whether this is advisory, consulting, or both.
Book a scoping call
Networks and systems08 services
Hands-on technical work, done independently.
The delivery side of the practice. Design, review, troubleshoot, harden, and stabilize the systems and networks an operation runs on. Independent of reseller and integrator incentives. Hans works with integrators and end clients to make the system work for them.
All consultingEnterprise network architecture
Most platform problems are network problems wearing a costume. Topology, segmentation, routing, and wireless designed properly from the start, not bolted on later.
Industrial and OT networks
Segmentation, the iDMZ, passive monitoring, and secure remote access applied in a way that respects how plant systems actually run.
ICAT design and project advisory
Integrated facility systems advisory, owner's representative services, and commissioning oversight for complex physical security and technology projects.
Physical security design
Design and gap assessment for access control, CCTV, and integrated physical security. From threat model to a specification an integrator can build to.
Data centre and cabling
Physical-layer work is cheap to fix at design and expensive after construction. Pre-construction review catches it before it becomes an installed fact.
Mentorship and technical guidance
For integrators on complex bids and practitioners closing a knowledge gap. An independent technical voice on a project already in progress.
CCTV and access control
Vendor-agnostic design and review across Avigilon, Axis, Bosch, C-CURE, Genetec, Hanwha, Hirsch, Milestone, and Suprema. The system and the network it runs on, treated as one problem.
Genetec
Independent Genetec consulting. Architecture review, sizing, federation, deployment oversight, and troubleshooting. Not a reseller, not an integrator. No license revenue.
Sectors
Where this work usually lands.
Different sectors fail in different ways. What an airport needs from a security network is not what a water utility needs, and neither looks like a defence supplier under audit. These are the environments the practice works in most.
About Hans Study
Technical depth across multiple disciplines.
I started the way a lot of people in this field do. Fixing computers for friends and family, then picking up work installing small business networks and CCTV systems. By 2010 that had grown into independent network and security work full time. The 15+ years since are where the depth comes from.
01
Technical depth across 3 disciplines
Enterprise networks, cybersecurity, and physical security. Each understood well enough to advise on, and to see how decisions in one affect the others.
02
15+ years of real experience
Across sectors and project types, including the ones that went sideways before Hans helped fix them. That is how the risks get caught early.
03
The read is candid
Recommendations do not change based on who is selling. Where a vendor got something right, that gets said; where they did not, that gets said too.
04
Advice that follows through
A recommendation that ends at the design phase is a document, not advice. Engagements are scoped to carry through delivery and the first weeks of real-world operation.
Genetec Security Center
Independent Genetec Security Center work, in depth.
Architecture review, sizing, federation, hardening, and post-deployment troubleshooting on Security Center. Not a Genetec partner. No license revenue. Start with a structured Health Check, or read the field writing first.
StudyByt3s
Recent technical writing
compliance
Does my camera system need to be CPCSC compliant?
Your VMS doesn't hold blueprints, but it watches the factory floor. How to tell whether a camera system falls inside CPC...
compliance
Physical security and CPCSC: getting access control and CCTV ready
What the ITSP.10.171 physical protection requirements ask of card access and camera systems, the configuration that hold...
compliance
Security integrators and CPCSC: what changes, and how to get ahead
CPCSC reaches security integrators through project files, remote support, and the devices they install. Where integrator...
- IndependentNo resale
- OntarioCanada
- RemoteCanada and US
// Next step
Bring the problem. Start with a conversation.
A scoping call first, then a written scope and quote before any billable work.
Start a conversation Contact
Most engagements start with a conversation about what the organization is trying to accomplish.
If you have a project coming up, a system that is not performing the way it should, or an upcoming procurement that needs independent technical input, reach out directly. Project work is scoped and quoted up front. Managed care and fractional CISO run monthly.
- Emailcontact@hans.study
- Based inOntario, Canada
What does Hans Study do?
Hans Study is an independent network and security consultant based in Ontario, Canada. The work is boutique: enterprise networks, OT and ICS, controls and security systems, and the infrastructure underneath them. Hardening and tuning specialist. Primary stacks are Microsoft Windows, Cisco, Aruba, and Genetec Security Center, with regular work across Axis, Bosch, Milestone, Avigilon, C-CURE, Fortinet, Palo Alto, Juniper, and Alcatel-Lucent. Vendor agnostic. No equipment sales, no margin on what is specified, and no commission tied to platform selection.
What does "independent" actually mean here?
No commissions. No product margin. No financial stake in what gets specified. No margin on equipment. If Cisco is the right answer for the environment, that is the recommendation. If the right answer is Aruba, ALE, or Juniper, that is the recommendation. Hans has direct hands-on experience across the major platforms in each category and selects on fit for the deployment, not on which vendor pays a commission.
What is the minimum project size?
Engagements range from a half-day technical second opinion on a vendor proposal to multi-month owner's representative engagements on complex builds. Project work is scoped and quoted per engagement; managed care and fractional CISO run on monthly retainers. Reach out with what the project looks like and the right scope of involvement gets worked out from there.