CMMC and NIST 800-171 readiness, managed detection and response, and incident response, for contractors whose next award depends on their posture.
WHAT'S COVERED
Gap assessment and a plan of action to reach the level your contracts require.
All 110 controls mapped, implemented, and documented against your systems.
24/7 threat monitoring and response across endpoints and networks.
A plan before you need it, and a team on the line when you do.
The written policies and audit evidence assessors actually ask for.
Practical training for your people — the control auditors can't automate.
LEVEL 1 VS LEVEL 2
CMMC LEVEL 1 · FOUNDATIONAL
For contractors who handle Federal Contract Information but not CUI. Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21, verified by an annual self-assessment and executive affirmation.
CMMC LEVEL 2 · ADVANCED
For contractors who store, process, or transmit Controlled Unclassified Information. All 110 NIST 800-171 requirements across 14 control families, with a System Security Plan, POA&M, and — for most contracts — a triennial third-party (C3PAO) assessment.
THE STACK
Most of the controls live in tools you already license. We configure, monitor, and evidence them.
MICROSOFT 365 · EMAIL & COLLABORATION
Phishing and malware protection where attacks actually start: Safe Links, Safe Attachments, spoof and impersonation protection across Exchange, Teams, and SharePoint.
ENDPOINTS · EDR
The engine behind our managed detection: behavioral EDR on every workstation and server, feeding 24/7 alerting, isolation, and response. The 'Defender for Enterprise' tier question is really a licensing question — we map the right SKU to your contract level.
IDENTITY · MFA
Unique identities, phishing-resistant MFA, and conditional access policies that block legacy auth and risky sign-ins — the identity controls both levels lean on hardest.
DEVICES · CONFIGURATION
Device enrollment, hardening baselines, encryption enforcement, and app control — configuration management with evidence you can export for an assessor.
CUI · LABELING & DLP
Sensitivity labels that mark CUI where it lives, plus data loss prevention that keeps it inside the enclave. For CUI-heavy contracts this often means GCC or GCC High tenancy — we scope that early, because migrating later is expensive.
CLOUD · LOGGING & SIEM
Centralized audit logging, retention, and correlation — the Audit & Accountability family made practical, with alerts routed into the same MDR watch floor.
CLOUD · WORKLOADS
For AWS workloads: CloudTrail for audit, GuardDuty for detection, and GovCloud regions where contract or ITAR requirements demand US-person handling and FedRAMP High boundaries.
WEB · BOUNDARY
Web application firewalls (Akamai, AWS WAF) in front of the sites and portals we build and host — boundary protection for the web layer, plus DDoS absorption and bot filtering.
CONTROL DOMAINS
Level 1 touches six families. Level 2 covers all fourteen.
Who can touch what: least privilege, session control, remote access rules.
People know the threats their role attracts, with evidence of training.
Logs exist, are protected, and can answer 'who did what, when.'
Hardened baselines, change control, and no drift you didn't approve.
Unique accounts, MFA, and no shared logins anywhere.
A tested plan, defined roles, and reporting that meets DFARS timelines.
Controlled, logged system maintenance — including who serviced what.
CUI on drives, USBs, and paper is marked, controlled, and destroyed properly.
Screening before access, and access removed the day someone leaves.
Locked doors, visitor logs, and controlled physical access to systems.
Vulnerabilities scanned, risks ranked, and remediation prioritized.
Controls reviewed on a schedule; the SSP and POA&M stay living documents.
Boundary defense: firewalls, WAF, encryption in transit and at rest.
Patching, anti-malware, EDR, and alerts someone actually watches.
Not sure which level your contracts require? The free assessment answers that in the first call.
