Ernest Caravalho

About Ernest Caravalho

I specialize in guiding organizations through cybersecurity compliance and risk management, with a focus on CMMC Level 2 readiness. My work bridges regulatory requirements and practical implementation, ensuring clients meet stringent standards while optimizing security posture.Key areas of expertise include:• Gap Assessment & Remediation Planning: Conduct comprehensive evaluations of IT infrastructure, security controls, and documented policies to identify compliance gaps against frameworks such as FAR 52•••72, DFARS 25••••••••19, 7020), and NIST SP 800-171A.• System Security Planning: Develop detailed System Security Plans (SSP) outlining data flows and controls for Controlled Unclassified Information (CUI).• Actionable Compliance Strategies: Create Plan of Action & Milestones (POAM) with prioritized recommendations based on gap severity and budget considerations.• Documentation & Policy Development: Prepare and refine policies, procedures, and forms to meet CMMC Level 2 requirements, ensuring alignment with certification objectives.• Compliance Scoring & Reporting: Deliver point-in-time compliance scores using SPRS methodology, providing clear visibility into readiness status.I am passionate about helping organizations achieve compliance efficiently while strengthening their overall cybersecurity resilience. My approach combines technical expertise, regulatory knowledge, and practical solutions tailored to client needs.

Experience

1. Grc Consultant

   NetCov

   Jul 2025 — Present

   Performing gap assessments to identify compliance deficiencies and security risks.• Developing remediation plans with prioritized actions for regulatory alignment.• Creating and maintaining System Security Plans (SSP) and Plan of Action & Milestones (POAM).• Reviewing and assessing IT infrastructure, security controls, and documented policies.• Ensuring compliance with industry standards and regulatory frameworks (e.g, NIST, DFARS, CMMC).• Preparing and refining policies, procedures, and documentation packages for certification.• Providing compliance scoring and reporting using recognized methodologies.• Advising on technical and procedural improvements to strengthen cybersecurity posture.• Delivering strategic recommendations for cost-effective compliance and risk management.• Supporting clients with ongoing compliance monitoring and regulatory updates.

Education

• Stratford University

  Diploma, Computer and Information Sciences, General

  2001 — 2001

• DeVry University

  Bachelor of Applied Science (B.A.Sc.), Computer Programming

  2007 — 2010

Skills

• Dell Poweredge Servers
• Laptops
• Landesk
• System Administration
• Windows 7 Migration
• Backup Solutions
• Troubleshooting
• Help Desk Support
• Logmein
• Lync Server 2010
• Logistics
• Active Directory
• Windows Server
• Ccna
• Voice Over Ip (Voip)
• Technical Support
• Microsoft Exchange
• Comptia a+ Certification
• Microsoft Office
• Networking
• Windows 7
• Cisco
• Ghost Imaging
• Servers
• Network Administration
• Software Installation
• Cisco Systems Products
• Comptia Network+ Certified
• Windows
• Webroot
• Windows Xp
• Windows 10
• Virtualization
• Winpe
• Trend Micro
• Vmware
• Operating Systems
• Voip
• Windows Xp Pro