Not a vendor. One of you. Since 2005 I have stood with community agencies and growing organizations, helping them get secure, modernize and adopt AI without adding risk.
San Francisco Bay Area and California · remote and on site
He is more than just a consultant, he has become an extension of our team. He treats our organization’s resources and budget as though they were his own, always looking for opportunities to maximize value without compromising quality.
I have worked with Akrom Zakhidov for over 10 years. He is very responsive and thorough. We have 6 locations and all the staff know who to contact to keep their systems up & running so that we may focus on helping those in need.
We recently had to call on ZTA to help us with an issue with one of our computers. ZTA was very quick to remove the file and to make sure our organization was not affected overall. ZTA is fast, professional and a pleasure to work with.
When we started, our business ran on paper. Akrom moved us to iPads and barcodes, set up our servers and network, and built a website connected to QuickBooks. When money was tight, he lowered his price but never the service.
Akrom has helped my business for many years with our website and all our IT needs. He is honest, he explains everything simply, and he really cares about our business like it is his own.
Akrom set up our whole Ubiquiti network, Wi-Fi, firewall and security cameras inside and out in one weekend. More than five years later it all still runs without problems.
Known for three things. Underneath each one is the full stack, because most problems start in the network, in access and in how systems trust each other.
MFA, Zero Trust, backups and incident response, sized for lean teams and for the insurers and funders who check.
IncludesNetwork and Microsoft 365, device management, continuity and recovery, incident response, cyber insurance readiness, staff training, physical security design
Cybersecurity for nonprofits → 02A Fractional CIO or consulting Head of IT who owns strategy, budget and vendors, and answers to your board.
IncludesIT strategy and roadmap, risk, compliance and audit, system and vendor selection, IT operations, websites and custom apps
Fractional CIO → 03Real value from AI without putting client, patient or donor data at risk, with governance sized for small teams.
IncludesAI policy and governance, Copilot readiness, tool intake and approval, staff training
AI for nonprofits →Ways to work together
No surprises. Every project has a fixed scope agreed up front, ongoing work is billed monthly, and I never resell equipment: you get the full list and buy it directly, with no markup.
Akrom always keeps our budget limitations in mind when making suggestions for upgrades and takes the time to research the best equipment at the best price. I never receive a surprise bill from him and he understands the procurement requirements we must follow.
Every engagement follows the same logic as a well designed network: get the lower layers right and everything above them works better. Here is exactly how that works.
Learn how you really work before changing anything.
You getA clear picture of what you have and who depends on it
Find the real risks, not a generic checklist.
You getA prioritized findings report in plain language
Design the fix and prove it will work before work starts.
You getA roadmap leadership can approve with confidence
Deliver in small, reversible steps.
You getWorking systems, with no surprises on cutover day
Leave your team stronger than we found it.
You getA team that owns the result, and a partner when you need one
Every engagement: feasibility checked first · root cause, not patches · security staff will use · plain language for leadership
I know lean IT from the inside: doing a lot with very little, for people who depend on you. That is who I build this practice for: leaders who carry a lot, answer to a board or funders, and need someone senior in their corner without hiring a full time CIO.
Consulting Head of IT for the agencies where my US career began. Own technology strategy across network, security and systems. Hardened security, secured remote access, trained staff on cybersecurity and launched modern websites.
Took the business from printed inventory lists and manual QuickBooks entry to iPad ordering, barcoded inventory and a website synced with QuickBooks. Servers, remote access and the network behind it. Now helping the owner bring AI into the business.
Helped deploy a document management platform to streamline intake and speed up application processing.
Covered a 50,000 square foot warehouse inside and out with cameras, network, Wi-Fi and a firewall in one weekend, with no markup on equipment. Later fixed end of life systems installed by others at the root, instead of patching them again. More than five years later, everything still runs without issues.
Deployed a professional Verkada video surveillance system to protect people, property and day to day operations.
Sales reps carried printed inventory lists, photographed marked pages and emailed them in. Every order was retyped into QuickBooks, and inventory was tracked by hand.
Replaced paper with iPads and barcodes, built a website that syncs inventory from QuickBooks, and set up the servers, network and remote access so the team works in one system.
Orders and inventory flow without retyping, and the business grew from a small warehouse with systems to match. Now we are bringing AI into the business.
Not sure you fit? Ping me anyway.
Founder, Zakhidov Technology Advisory
My mission: every organization doing important work deserves a technology partner who stays, from the network to AI.
My career in the US started in 2005 at Central Coast Energy Services, a community energy assistance agency, as the data and network analyst and then IT manager. I left for biotech, where I was the lead IT for the site behind the California newborn and prenatal screening programs. The agency tried several replacements, then brought me back as a consultant, and I never left again. Today I am consulting Head of IT for Central Coast and North Coast Energy Services, and I also serve as a healthcare CIO responsible for technology, security, data and AI governance.
Through funding cuts, lean years and good years, I stayed. When money was tight, I lowered my costs, never the service, because the mission mattered more than the invoice. I treat every organization as if it were my own, and I tell you the truth, even when it is not what you want to hear.
I work fast, and my word is a promise I keep. That is why clients trust me.
Having worked at every level of IT, from hands on engineering to the executive team, I bring both technical depth and executive judgment. ZTA began as RA Networking, providing remote access and networking expertise, and has grown into full technology advisory, from the network to AI.
I do not walk away when the budget does. There is always a way I can help: a free first look, a pro bono checkup, or a plan sized to what you have.
Career highlights
From my full time roles in biotech and healthcare. My consulting work is under Clients.
Designed and led an organizational AI program: policy, AI Council, and tool intake and approval process, taken through outside legal review to board approval.
CIO and designated HIPAA Security Official for a multi site healthcare organization running Epic. Implemented enterprise wide SSO and MFA, runs regular penetration testing, and led a governed rollout of ambient AI documentation.
Twelve years as a senior network engineer, then Head of IT for the PerkinElmer Richmond site, running the infrastructure behind the California newborn and prenatal screening programs.
Built a 14 person IT organization across three functions, migrated core systems to Microsoft 365, Salesforce and the cloud, and eliminated paper workflows.
Speaking
Practical security in plain language for nonprofit and community service leaders. No jargon, no product pitch.
On stage 2 talks
Egyptian priests found true north by Meskhetyu, the Big Dipper. Its two pointer stars lead straight to the North Star. My career has followed the same line: seven eras of technology, each one leading to the next, and all of them pointing to AI.
Egyptians called the Big Dipper Meskhetyu and sighted it to line up new temples with true north. Every great structure started from a fixed point of reference.
The last two stars of the bowl point to the North Star. On this map they are the cloud and the network, the two foundations that make safe, useful AI possible.
Anubis guided travelers through the unknown, and the jackal god Wepwawet was called the Opener of the Ways. That is the job: open the way and guide you safely to where you need to go.
From the network to AI, A to Z.
Short guides, checklists and templates for nonprofits and small teams. Pick your situation and get the steps and the right tools in one place.
Straight answers on working together, MFA, scams, AI and staying up when things go wrong. Search or pick a topic.
33 questions
One conversation and a straight answer about where your organization stands on security, MFA and day to day IT. No cost, no commitment, no pitch. Request one here.
Because I am not here to sell you a product. My US career started in 2005 at a community energy agency, and I am still their IT partner today. I stay through lean years and good years, I treat your organization as my own, and I tell you the truth even when it is not what you want to hear.
Nonprofits, community action and energy assistance agencies, healthcare and clinics, public health, small and midsize businesses, and executive teams and boards. Most are lean teams without a full time CIO.
Yes. I do not replace your team. I offer another perspective, a second opinion on big decisions, and what has worked for other organizations like yours.
Three ways: a free first look, an assessment or project with a fixed scope and a clear deliverable, or ongoing leadership as a fractional CIO or consulting Head of IT on a monthly basis.
The first look is free. After that, price depends on scope. Projects have a fixed scope agreed up front, and ongoing leadership is monthly, so there are no surprises.
No. I have no product to sell. When a project needs equipment, I give you the full list and you buy it directly, with no markup. My recommendations are based only on what fits your organization, your staff and your budget.
Both. I am based in the San Francisco Bay Area and serve organizations across California. Remote help can often start the same day, and on site work is scheduled around your team.
Within hours, not days. Use the contact form or email akrom@zakhidov.ai.
Yes. Client names appear on this site only with permission. Please never send passwords or client data by email or through the contact form.
Partly. Microsoft still donates up to 300 Business Basic licenses to eligible nonprofits. The free Business Premium and Office 365 E1 grants were retired starting July 1, 2025, and replaced with discounts of up to 75 percent on annual terms. Check your renewal date so a license change does not catch you by surprise.
Multi-factor authentication adds a second step after your password, such as an app approval or a security key. Most account takeovers start with a stolen password, and MFA stops a stolen password from being enough.
Strongest first: a security key or passkey, then an authenticator app with number match, then an app code, then a text or call code. CISA recommends phishing-resistant MFA and advises moving away from text message codes where you can. Keep text codes as a backup, not the main method. The MFA checklist compares them.
Plan for them early. A security key or a call code usually works. Ask each vendor which methods it supports before the deadline, not on the day.
Deny it. Never share or type the code for anyone, change the password and tell IT right away. An unexpected prompt means someone else has the password.
In January. Start now so every person has completed a test login before then. The MFA readiness checklist walks through it.
No. NIST updated its password guidance in August 2025: require a change only when there is a sign the password was exposed. Long passphrases beat complex short ones, new passwords should be checked against lists of known breached passwords, and MFA plus a password manager matter far more than forced resets.
Yes. Windows 10 reached end of support on October 14, 2025. Business managed computers only get security fixes through paid Extended Security Updates, which cost more each year and run for three years at most. The free extension Microsoft announced for home users does not cover managed work devices. Plan replacements now and check which machines can run Windows 11.
Often because SPF, DKIM and DMARC are missing or wrong. Gmail and Yahoo started requiring them for bulk senders in 2024, and Microsoft Outlook followed in 2025. The same records also make it harder for scammers to send email that pretends to be you.
HHS proposed a major Security Rule update in January 2025 that would make MFA, encryption and more explicit requirements. As of fall 2026 it is still not final, and HHS now targets 2027. The current rule still requires a documented risk analysis, the most common gap OCR cites in enforcement. Many clinics adopt MFA and encryption now anyway, and insurers expect them. Confirm with your compliance lead.
Insurers usually ask about MFA, endpoint protection, backups and an incident plan. The cyber insurance readiness checklist lists the common controls. Answer honestly, and note dates for anything still in progress.
Yes. Most attacks are automated and look for weak passwords and missing MFA, not for big names. Small organizations often have fewer defenses, which makes them easier targets.
A scammer takes over or imitates an email account, then asks for a payment, a bank detail change or gift cards. The FBI 2025 Internet Crime Report counted about $3 billion in reported losses from it in one year. The best defenses are cheap: MFA on email, DMARC, two people to approve payments, and a phone call to a known number before any bank change.
Yes. The FBI has warned that criminals use AI to clone voices and create video to impersonate people staff trust. For any urgent request for money or data, hang up and call back on a number you already have, and agree on a code phrase for emergencies.
Stop. Real IT staff never need your code. Hang up and call IT back on a known number. Attackers also call help desks pretending to be staff, so whoever resets passwords or MFA should confirm identity through a second channel first.
Treat a QR code like a link from a stranger. Be careful with codes in emails, texts and on stickers placed over real ones, such as on parking meters. If a code asks you to sign in or pay, go to the site yourself instead.
Yes, with a simple policy first: which tools are approved, what data must never be pasted into them, and a person who reviews anything that goes out. Without a policy, staff will use AI anyway, just without guardrails.
Copilot can only show people what they already have access to. The risk is that many organizations share more than they realize. Clean up oversharing and permissions first, then pilot with a small group.
Only with tools approved through your governance process and covered by the right agreements, such as a BAA for health data. That decision belongs with your compliance lead and legal counsel. I help build the process that gets you there.
Be careful. California generally requires everyone on a call to agree before it is recorded, so announce it every time. Use an approved tool, know where transcripts are stored, and keep notetakers out of meetings about clients or patients unless that use has been approved.
Disconnect the affected device from the network without shutting it down, disable the account, call your incident lead and then your insurer hotline. Do not pay or reply to the attacker. The incident response plan lays it out on one page.
It is how you keep serving clients when systems, power or the building are down: what matters most, the workarounds, and who gets told what. Every organization that people depend on needs one. Start with the free template.
Test a restore at least every quarter and after any big change. A backup you have never restored is a hope, not a plan.
No match yet. Ask me directly.
Ask a questionLow latency, high availability. Tell me what you are working on and expect a reply within hours, not days. Remote help can often start the same day, and on site work is scheduled around your team.
Not sure where you stand? Start with a free first look: one conversation and a straight answer on security, MFA and day to day IT. No cost, no commitment, no pitch.