Cyber governance, risk & compliance consulting
Security and compliance programs that hold up under assessment.
Boxwood Assurance Partners helps organizations turn complicated security and compliance requirements into clear programs with real owners, honest risk reporting and evidence an assessor can follow.
Services
Where we help
Engagements are scoped to what you need, from a focused readiness review to interim leadership of a program that has stalled.
Assessment readiness
Prepare for PCI DSS, CMMC / NIST SP 800-171 and NIST CSF assessments: scoping, gap analysis, remediation plans and evidence that tells a clear story.
Governance & controls
Governance models, control ownership and performance expectations, so every control has a named owner and a way to show it is working.
Risk management
Risk registers, risk acceptance and exception processes, and executive reporting that gives leaders an honest view of program health.
Data governance & privacy
Data mapping, privacy impact assessments and GDPR / CCPA program support, built into how data actually moves through your systems.
Program recovery
Interim leadership for compliance and technical programs that need a reset: scope, schedule, decision rights and change control.
AI in compliance
Practical evaluation of AI agents and tools for compliance work: where they save real effort, where they need human review and how to govern them.
About
Dr. Penelope Salaria
Penelope founded Boxwood Assurance Partners to bring a rare combination of discipline, strategic thinking and plain-spoken clarity to cybersecurity governance, risk and compliance. Her career has been built on making complicated things simple: understanding what an organization actually needs, cutting through complexity and delivering results leaders can count on.
Most recently she was a Senior Director at Capital One, where she led the enterprise Payment Card Industry (PCI) compliance program. She reset its scope, governance and delivery model, achieved several company firsts within six months, prepared the program for an external assessment that Capital One passed, and led it through Capital One's acquisition of Discover. Earlier at Capital One she built the cyber data governance model that became the company-wide standard, led a one-year migration of more than 100 data sources to the cloud, and served as the cybersecurity department's point person for GDPR and CCPA.
Before that, Penelope led delivery at a cybersecurity startup, led engineering and test teams on government programs, and supported a $40M Defense Advanced Research Projects Agency (DARPA) research portfolio. She began her career as a communications and computer officer in the U.S. Air Force, leading operations, policy and training across 18 countries. She has also taught graduate courses in cybersecurity policy, risk management and secure enterprise architecture.
She holds a Ph.D. in Computer Science and brings the same rigor to every engagement: clear owners, honest status and programs built to pass the test that matters.
Apps
Building with AI
Penelope has started building apps with Claude Code, Anthropic's AI coding tool. The hands-on work keeps our advice on AI grounded in what these tools can and can't do in practice.
TripDown
Count down to your next trip, or anything else worth waiting for. TripDown turns any date into a Home Screen or Lock Screen widget with hand-drawn themes. No account, no ads, no tracking.
Contact
Let's talk about your program
Tell us what you're preparing for and where it's stuck. We'll reply within two business days.