The Challenge: Compliance at Scale Doesn't Work in Spreadsheets
Robert Duchesne III didn't set out to build a compliance firm. After years working in cybersecurity, including service in the U.S. Air Force, he launched RD3 Technologies in 2023 as a side consulting project.
While he didn’t expect to quit his full-time job (spoiler: he went full-time with RD3 in October 2025), he knew he wanted to build a program that could scale as his new business grew. “Traditionally, I was managing compliance using SharePoint sites, Excel sheets, Word documents, and PDFs,” he says. “It just becomes very cumbersome—especially when you get a dozen clients, and then two dozen, and then three dozen.”
Without a system, Robert knew that compliance data would end up living in disconnected folders, siloed documents, and whatever inbox held the latest version of the risk assessment. One of the most acute pain points was cross-mapping: different compliance standards (like ISO 27001, CMMC, or NIST 800-171) often require the same underlying controls, but describe them in entirely different language. Reconciling them manually is tedious and error-prone.
That’s why Robert knew he needed a centralized platform from day one.
The Solution: A Platform Built for GRC Practitioners
“The way to streamline compliance is to have a singular platform that everybody can access,” he says. That led him to adopt ControlMap right when he started his business. Over time, Robert's MSP clients would come in using their own GRC tools, but his conclusion has been consistent: "ControlMap is where we end up pushing everyone back to, because it's very malleable for the practitioner."
The breadth of features Robert's team leans on is wide. Executive dashboards give C-suite clients a real-time health summary of their compliance program, including charts, percentages, and SPRS (Supplier Performance Risk System) scores that translate dense technical progress into something a CFO can grasp at a glance. The framework cross-mapping engine solves what was once a manual headache: when a client needs to satisfy both CMMC and ISO 27001, ControlMap automatically identifies overlapping controls, so practitioners aren't reconciling requirements line by line.
The platform's AI Copilot has added another layer of efficiency. When Robert's team uploads a policy document, ControlMap automatically maps it to relevant controls and frameworks, and confirms before applying. For system security plan (SSP) implementation statements, the AI drafts a working paragraph for the team to review and refine. "It allows us to save a ton of time in writing," Robert says.
What's kept RD3 loyal isn't feature breadth alone, though. It's the relationship. "ControlMap is one of the few GRC tools that actually listens to the people that use it," Robert says. “I’ve seen the team make changes based on complaints we have—I’ve even gotten emails from the founder. And the tool has just gotten continuously better over time.”
Results: Faster Assessments, Rapid Team Growth, and a $2M Revenue Milestone
Since going full-time in October 2025, RD3 Technologies has grown quickly, and ControlMap has been at the center of that growth.
- 5x revenue growth. When Robert took RD3 full-time in October 2025, the business was tracking toward approximately $400,000 in annual revenue. Less than a year later, it's on track for $2 million. "We've really leaned on ControlMap and its integrations to be able to scale," Robert says.
- Faster, more efficient assessments. "Original assessments were taking from 32 to 40 hours," Robert says. "Now we've gotten those down to a day or two." All client data, documentation, and evidence lives in ControlMap, so assessments are spent reviewing—not rebuilding from scratch.
- A shift from one-time projects to continuous managed compliance. “People often expect compliance to be a one-off project—something that you’re going to build and be done,” says Robert. “ControlMap has enabled us to show clients that there is a reason to perform continuous monitoring.” That change in framing is the foundation of RD3's recurring revenue model.
- Rapid team growth. Since going full-time in October 2025, RD3 has scaled from a solo operation to a team of five employees and six contractors—and the pace hasn't let up. The shift away from project-based work toward a monthly recurring revenue model, made possible by ControlMap's managed compliance capabilities, is what's fueling it.
For Robert, ControlMap has been foundational to building a managed compliance practice that's sustainable and growing. “When you use a centralized platform like ControlMap, you don’t have to work in new Excel sheets and redo every security assessment from scratch,” he says. “It’s like building a house—you do the hard work once and then you just have to maintain it.”
For RD3, that foundation has supported something remarkable: a company that went from side consulting to a growing, recurring-revenue managed compliance practice in under two years, with ControlMap at the center of every client conversation, audit, and sale.