Don Freese
➤ Cybersecurity Strategy ➤ Board Advisory ➤ Expert Witness
PRACTICE
Cybersecurity Strategy
Don Freese is a global Chief Information Security Officer (CISO) and enterprise risk executive: national security; data center, cloud, and AI infrastructure; board advisory. Among the few with command authority in both national cyber operations and global enterprise security, he was most recently SVP and CISO of Digital Realty (NYSE: DLR), among the worlds largest data center companies.
He built and led the global security operating model across 25+ countries, spanning IT/OT convergence: ICS/SCADA, building systems, physical security, trusted by the worlds largest financial institutions and utilities, including operators of nuclear generation.
As an FBI Senior Executive, he directed the National Cyber Investigative Joint Task Force and briefed the National Security Council. For fifteen years he also served as InfraGard Executive and Board Liaison for Critical Infrastructure (2001-2016), working with the boards of utilities, telecom carriers, and energy producers. As Senior Fellow for Critical Infrastructure and Cybersecurity at George Washington University, he directed industrial research for telecom and water utilities; as a PwC Partner, he advised Fortune 100 boards and audit committees across finance, pharmaceuticals, and utilities.
His range: enterprise risk, GRC, and compliance across NIST, SOX, GDPR, ISO 27001, SOC 1/2/3, NIS2, DORA, SEC, and classified environments. His risk cultures hold after he leaves the room.
Cybersecurity litigation and case consulting, expert support, incident and regulatory response at direction of counsel, defensibility assessments
Who this serves: law firms, general counsel, boards and special committees, and their clients in matters where technology, security, and investigative fact patterns decide outcomes. Foundation: three decades of FBI investigative and executive experience, partner-level consulting leadership, and operating accountability as a global CISO of a publicly traded company.
Litigation & Dispute Support
• Expert consulting and testimony support in matters involving cybersecurity failures, breach response adequacy, and standard-of-care disputes (NIST CSF, ISO 27001, SOC 2, sector regulations)
• Expert reports, declarations, and affidavit support; opinions on reasonableness of security programs and incident response
• Translation of complex technical evidence into plain language for judges, juries, arbitrators, and mediators
• Deposition and cross-examination preparation support for counsel examining technical witnesses
• Assessment of opposing expert positions; identification of technical weaknesses in adverse reports
Case Consulting
• Case theory development on technology-heavy fact patterns; early case assessment of technical merits
• Digital evidence interpretation: system logs, forensic images and reports, chain-of-custody review, timeline reconstruction
• Coordination and quality control of digital forensics vendors and e-discovery technical workstreams
• Damages contextualization: business impact of security incidents, remediation cost reasonableness
Incident & Regulatory Response Support (at Direction of Counsel)
• Privilege-aware post-incident investigation structure and execution support
• SEC cybersecurity disclosure rule readiness: materiality frameworks, disclosure controls, board oversight documentation
• Regulatory interaction preparation: SEC, DOJ/FBI, state attorneys general — informed by decades inside federal law enforcement
• Internal investigation support: scoping, evidence-handling discipline, executive interview strategy
Pre-Litigation & Preventive
• Defensibility-focused security program gap assessments (build the record before you need it)
• Whistleblower and complaint-intake program design; triage and escalation frameworks that survive scrutiny
• Board and audit committee education on cyber oversight duties (Caremark-era expectations)
Engagement models: hourly expert consulting · fixed-scope assessments · monthly retainer · fractional executive arrangements. Rates and detailed scoping on request. Conflicts checked before every engagement
Strategy and program build, fractional/interim CISO, implementation and technical guidance, OT/critical-infrastructure security, operations, compliance and assurance
Who this serves: enterprises, data center and critical infrastructure operators, private equity portfolio companies, and growth-stage technology firms. Vendor-neutral by design: RSF resells nothing and takes no platform commissions — the advice is the product. Credentials: former FBI senior executive (cyber and critical infrastructure), former North America security practice partner at PwC, former global CISO of Digital Realty (NYSE-listed data center REIT).
Strategy & Program Build
• Enterprise security strategy aligned to business model, revenue protection, and risk appetite — not framework theater
• Program stand-up from zero: governance, policy architecture, organizational design, budget construction, multi-year roadmaps
• Board and audit committee reporting: metrics, risk quantification, and narratives that earn budget and trust
• Security operating model design: build/buy/partner decisions, MSSP selection and oversight
Fractional & Interim Executive Leadership
• Fractional CISO for organizations not ready for a full-time executive; interim CISO coverage during transitions
• First-CISO stand-up for companies crossing the maturity threshold; hiring, onboarding, and mentoring the permanent successor
• Executive advisor to sitting CISOs: board preparation, crisis counsel, career-grade decisions
Implementation & Technical Guidance
• Control architecture guidance: identity and access, network segmentation, monitoring, detection and response stack design
• Vendor and tool selection with genuine neutrality — requirements definition, evaluation, negotiation support
• OT / ICS / building-systems security for mission-critical facilities: BMS, EPMS, DCIM environments; IT/OT convergence
• De-risking OT security platform deployments in live, uptime-sensitive environments — the gap between buying the tool and it working
• Data center and critical infrastructure security: design-stage security for new builds, physical-cyber convergence, tenant/provider responsibility models
Board & Audit Committee Advisory
• Board preparation strategy: readying management teams and materials for board-level cyber discussions that go well
• Audit committee briefings on cybersecurity and related risk matters — delivered as a stand-in for the CISO, alongside the CISO, or in support of independent auditors
• Independent third-party briefings when the committee needs a voice with no stake in the budget being defended
• Translation of technical security posture into fiduciary and disclosure language directors can act on
• Pre-audit and pre-earnings cyber readiness reviews; oversight documentation that stands up later
Operations & Resilience
• Incident response planning, playbooks, and executive tabletop exercises; ransomware readiness and recovery governance
• SOC and detection maturity assessment; threat intelligence program design; insider risk programs
• Crisis leadership: on-call senior counsel to executives during live incidents
Compliance & Assurance
• SOC 2, ISO 27001, and NIST CSF readiness; audit preparation; independent-attestation strategy
• Federal-adjacent orientation: CMMC, DFARS, CUI handling — segment selection and certification sequencing
• Third-party and supply chain risk programs; M&A security due diligence (buy-side and sell-side)
• AI-era security: securing AI infrastructure and workloads, AI governance frameworks, security implications of AI adoption
Engagement models: hourly expert consulting · fixed-scope assessments · monthly retainer · fractional executive arrangements. Rates and detailed scoping on request. Conflicts checked before every engagement.
Fraud and misconduct analysis, cyber-enabled financial crime, board and special committee support, expert and monitorship roles
Who this serves: law firms, corporations, boards, special committees, and investors confronting complex fraud and misconduct where financial, human, and digital evidence intersect. This practice hybridizes three decades of FBI investigative methodology — including nation-state, critical infrastructure, and major financial crime casework — with executive-level cybersecurity and corporate governance experience. The distinctive value: one advisor who reads the ledger, the logs, and the people.
Complex Fraud & Misconduct Analysis
• Fraud pattern and scheme analysis: financial statement fraud, procurement and vendor fraud, kickback and corruption typologies
• Evidence chronology construction and link analysis across financial records, communications, and system data
• Investigative planning and interview strategy grounded in FBI methodology; witness sequencing and preparation support
• Assessment of investigative adequacy: whether an internal or external investigation would withstand regulator and litigation scrutiny
Cyber-Enabled Financial Crime
• Business email compromise and wire fraud reconstruction; funds-flow tracing coordination including digital assets
• Ransomware and extortion dynamics: threat actor behavior, negotiation context, payment decision frameworks
• Insider threat and trusted-insider casework: detection, investigation structure, and prevention program design
• Attribution context: distinguishing criminal, insider, and nation-state activity — and why it matters to liability and disclosure
• Digital evidence strategy: what to preserve, what it proves, and where forensic vendors overreach or underdeliver
Corporate, Board & Governance Support
• Independent assessments for boards and special committees on misconduct, security failures, and oversight questions
• Whistleblower program design, complaint triage, and investigation governance that protects both the company and the reporter
• Compliance program effectiveness reviews oriented to DOJ Evaluation of Corporate Compliance Programs expectations
• Regulator and law-enforcement interaction preparation: what the government asks, why, and how credible cooperation looks from the inside
Expert & Advisory Roles
• Expert consulting on law enforcement standards, investigative practices, and security governance standards of care
• Monitorship and remediation support: post-settlement program rebuilds with credibility to agencies and courts
• Crisis counsel to executives and boards during unfolding misconduct or breach events — decisions made in the first 72 hours
Engagement models: hourly expert consulting · fixed-scope assessments · monthly retainer · fractional executive arrangements. Rates and detailed scoping on request. Conflicts checked before every engagement.
Corporate and advisory board service; go-to-market advisory for cybersecurity companies selling into regulated enterprise and data centers; keynote and executive education
Industry Depth
· Data centers and digital infrastructure (operator-level) · critical infrastructure and OT environments · financial services · technology and AI companies · government-adjacent and regulated enterprise
Differentiators
• Vendor-neutral independence: no reseller, commission, or platform relationships behind the advice
• Tri-lingual across domains: law enforcement and regulators, the boardroom, and the machine room
• Operator credibility: has owned uptime, budgets, and board accountability — not only advised on them
• Deployment realism: specialty in the gap between purchased security tooling and working security in live environments
Engagement Models
• Hourly expert consulting · fixed-scope assessments and readiness reviews · monthly advisory retainers · fractional or interim executive arrangements · board seats · expert/testimony engagements (rates on request; conflicts checked per matter)
CONTACT
Independence & Conflicts Statement
RSF Advisors maintains no vendor resale or commission arrangements. Client engagements are subject to a conflicts check; certain matters involving specific parties may be declined without explanation. Confidential and privileged materials from any engagement are never reused across clients.