01
Scope
We identify the requirements in your contracts and the systems, people, and facilities they apply to.
Services
Compliance and security services for federal contractors.
CMMC is at the center of our practice. Around it, we support the frameworks and testing that defense and federal contractors rely on to win and keep government work.
01 — What we do
Four services, one federal focus.
Each service stands on its own, and they share controls, evidence, and documentation, so work in one carries into the others.
Defense contractors
CMMC readiness
Working with Cyber AB Registered Practitioners, we take you from initial scoping to assessment-ready: gap assessment, remediation, system security plan, POA&M, and SPRS support.
Learn more
Controlled Unclassified Information
NIST SP 800-171 and DFARS
Implementation of the 110 security requirements for protecting CUI, DoD Assessment Methodology scoring, and DFARS 252.204-7012 obligations such as incident reporting.
Learn more
Prime contractors
RMF and ATO support
Subcontract RMF services for primes on federal awards: categorization, NIST SP 800-53 controls, assessment support, authorization packages, and continuous monitoring.
Learn more
Validation
Penetration testing
Controlled attacks against your external network, internal network, and web applications to find exploitable weaknesses before an adversary does, with a prioritized report and retest.
Learn more02 — Where to start
Match the requirement to the service.
Your contract language usually tells you which engagement you need. These are the most common starting points.
DFARS 7021
The solicitation names a CMMC level
CMMC readiness, scoped to Level 1, Level 2, or Level 3 preparation, with SPRS affirmation support.
DFARS 7019A prime or contracting officer asks for your SPRS score
NIST SP 800-171 gap assessment and DoD Assessment Methodology scoring you can defend.
DFARS 7012You handle CUI and need to meet safeguarding and reporting rules
Implementation of the 110 requirements, cloud provider review, and 72-hour incident reporting readiness.
NIST 800-37An agency system on your award needs an ATO
RMF and ATO support delivered by HARDAC as your subcontractor, across all seven steps.
CA-8You need evidence that your controls hold up
External, internal, or web application penetration testing, scoped to the compliance evidence you need.
03 — Methodology
How an engagement runs.
The same four stages apply whether you are preparing for CMMC, an SPRS submission, or an authorization decision.
02
Gap assessment
We measure your controls against the framework and deliver a prioritized remediation roadmap.
03
Remediation
We work alongside your team to implement controls and write the documentation behind them.
04
Assessment readiness
We review your evidence before an assessor does and support you through assessment and affirmation.
Not sure where to start?
Tell us what your contracts require.
We will recommend the right engagement and scope it before you commit.