The IT challenges defense suppliers face
The Department of Defense is adding CMMC requirements to contracts in phases. Small suppliers that handle Federal Contract Information or Controlled Unclassified Information need the controls in NIST SP 800-171, written evidence that they work, and the IT discipline to keep them working, usually without a large IT department.
Security and compliance
We help defense suppliers prepare for CMMC Level 1 and Level 2 (NIST SP 800-171) with a gap review, policies and security controls. The formal assessment is done by an outside assessor (C3PAO); we do not certify companies or guarantee results. What we do is make sure that when the assessor arrives, the controls exist, work and are documented.
Software we work with
We keep the systems behind secure email and file storage for controlled unclassified information (CUI), CAD and ERP systems running, along with the workstations, network and access around them. Your software vendors support their own applications. Common examples include Microsoft 365 GCC High, secure file sharing for CUI, ERP and accounting systems such as Deltek Costpoint, and engineering tools like SolidWorks.
How we help
- Scoping: deciding which people, systems and locations handle CUI, and keeping that scope small.
- Gap review against CMMC Level 1 or Level 2.
- Plan of action with priorities and owners.
- Policies and documentation, including your System Security Plan.
- Security controls: MFA, encryption, logging, access control and incident response.
- Ongoing management after you are ready, so controls stay in place between assessments.
Our CMMC Level 2 preparation guide walks through each step.
If data is exposed
Defense suppliers must report cyber incidents to the DoD under DFARS 252.204-7012, on top of the state breach laws that cover employee data. Encryption, multi-factor authentication and good logging make a breach less likely and much easier to scope. Our guide to data breach notification laws explains the deadlines and who to notify.
Getting a quote
Every quote is written for your environment after a short call about your users, devices and the systems you rely on. Agreements are longer-term rather than month to month, which gives us time to document your systems and close security gaps properly. Request a quote.