A Capital Cyber practiceLeesburg, Virginia

Cybersecurity ConsultingTalk to an expert
MenuClose
Services
Industries
LocationsInsightsAboutFAQContact
Talk to an expert+1 571 410 3066

CMMC · NIST SP 800-171 · ITAR · RMF

One accountable lead.One written scope.One record your assessor can follow.

CISO level leadership for CMMC, NIST SP 800-171 and federal authorization, with a program for ITAR technical data.

Talk to an expertWatch the 30 second film
  • 110security requirements inNIST SP 800-171 Rev 2
  • 320assessment objectives inNIST SP 800-171A
  • 14requirement families inNIST SP 800-171 Rev 2
  • 3 yearsmaximum age of an assessment posted in SPRS underDFARS 252.204-7019

The practice

What does this practice do?

We lead the security programs defense contractors and federal programs are measured on: CMMC Level 2 certification runs, SSP and POA&M reviews, CUI enclaves, a program for ITAR technical data, RMF authorizations, insider threat and audit programs, and incident response readiness.

Senior security leadership for defense contractors and federal programs, scoped to your company and delivered by the Capital Cyber team.

CMMC · NIST SP 800-171

Certification readiness

CMMC Level 2 certification runs, SSP and POA&M reviews and CUI enclaves, led from the first assessment to the C3PAO visit.

  • CMMC Level 2 program leadership

    One accountable leader who owns the plan, the scope, the evidence and the vendor decisions.

  • SSP and POA&M review

    Every implementation statement checked against the NIST SP 800-171A assessment objectives.

  • Mock assessment

    Assessed the way a C3PAO will, objective by objective, with your real evidence and your real people.

  • CUI enclave design

    A segregated environment with its own identities, data flows and a defined authorization boundary.

RMF · NIST SP 800-53 · CNSS 1253

Federal authorization and audit

RMF authorizations, continuous authorization, insider threat and enterprise audit programs for federal programs and integrators.

  • RMF and ATO

    Categorization, control selection, the System Security Plan and an authorization package for the authorizing official.

  • Continuous authorization

    Continuous monitoring, vulnerability management and STIG management, so the authorization stays current.

  • Insider threat

    Insider threat program design and governance, aligned with personnel security.

  • Enterprise audit

    What must be logged, who reviews it and what triggers action, built into policy and architecture.

ITAR · NIST SP 800-61

Protection and response

A program for ITAR technical data, incident response readiness and CISO level leadership.

What CMMC Level 2 requires in 2026

Engagements

What does each engagement cover?

Plan reviews, mock assessments, program leadership, enclave design and authorization work, with one written scope and one accountable lead for each engagement.

All services

  • CMMC Level 2 · NIST SP 800-171

    CMMC Level 2 program leadership

    Fractional CISO leadership for a CMMC Level 2 certification run, from the first assessment to the C3PAO visit.

  • NIST SP 800-171A · SPRS

    SSP and POA&M review and assessor readiness

    Review of your System Security Plan and POA&M against NIST SP 800-171A, so both documents are assessor ready for CMMC Level 2.

  • CUI · GCC High · Azure

    CUI enclave design

    CUI enclave design in Microsoft Azure and M365 GCC High, with a defined authorization boundary, for defense contractors.

  • CMMC Level 2 · C3PAO

    C3PAO readiness and mock assessment

    CMMC Level 2 mock assessment and C3PAO readiness, including C3PAO selection, for defense contractors preparing for certification.

  • NIST SP 800-30 · SP 800-39

    vCISO and security program leadership

    Virtual CISO and security program leadership for defense contractors and federal integrators, including supplier cyber readiness.

  • RMF · NIST SP 800-53 · CNSS 1253

    RMF, ATO and continuous authorization

    RMF, ATO and continuous authorization leadership for federal programs and integrators, across NIST SP 800-53 and CNSS 1253.

  • NIST SP 800-171 · NIST SP 800-53

    Insider threat and enterprise audit

    Insider threat, enterprise audit and user activity monitoring program design for federal programs and defense contractors.

  • NIST SP 800-61 · DFARS 252.204-7012

    Incident response and tabletop exercises

    Incident response planning and tabletop exercises for defense contractors, including DFARS 252.204-7012 reporting readiness.

  • ITAR · DFARS 252.204-7012

    ITAR cybersecurity program

    Cybersecurity programs for ITAR controlled technical data, built on NIST SP 800-171 and DFARS 252.204-7012, from Capital Cyber.

Industries

Who is it for?

Small and mid sized defense contractors and federal integrators that need CISO level leadership for CMMC, NIST SP 800-171 and federal authorization work without a full time CISO, and federal programs that need enterprise audit, insider threat or RMF leadership.

All industries

  • Defense manufacturing and machine shops

    CMMC Level 2, NIST SP 800-171 and ITAR programs for defense manufacturers and machine shops, from enclave scoping to shop floor equipment and evidence.

    • DFARS 252.204-7012
    • CMMC, 32 CFR part 170
    • ITAR, 22 CFR parts 120 to 130

  • Aerospace and space suppliers

    NIST SP 800-171, CMMC Level 2 and ITAR technical data programs for aerospace and space suppliers on defense programs, designed as one environment.

    • ITAR, 22 CFR parts 120 to 130
    • DFARS 252.204-7012
    • DFARS 252.204-7020

  • Federal IT and systems integrators

    CMMC Level 2, NIST SP 800-171 and RMF authorization leadership for federal IT firms and systems integrators running both programs at the same time.

    • NIST SP 800-37 and NIST SP 800-53
    • CMMC, 32 CFR part 170
    • DFARS 252.204-7012

  • Research labs and universities with DoD sponsored work

    NIST SP 800-171, CMMC and export control programs for research labs and universities with DoD sponsored work, using enclaves to keep controlled work contained.

    • DFARS 252.204-7012
    • NIST SP 800-171 Rev 2
    • ITAR, 22 CFR parts 120 to 130

Based in Leesburg, VA, and on site anywhere in Northern Virginia and the wider Washington DC area.

See where we work

Frameworks

Which frameworks do we cover?

  • CMMC (32 CFR Part 170)
  • NIST SP 800-171 Rev 2
  • NIST SP 800-171A
  • NIST SP 800-53 and 53A
  • Risk Management Framework
  • CNSS 1253
  • DFARS 252.204-7012
  • Microsoft GCC High enclaves
  • ITAR technical data
  • NIST SP 800-61 incident response

The 30 second film

What is a defense contractor measured against?

The 110 requirements, 14 families and 320 assessment objectives behind a CMMC Level 2 assessment, in 30 seconds and without sound.

Play the 30 second film
Read the text in the film
  1. DFARS 252.204-7012
  2. The defense supply chain runs on trust.
  3. 110 security requirements. NIST SP 800-171 Rev 2.
  4. 14 families: AC 22, AT 3, AU 9, CM 9, IA 11, IR 3, MA 6, MP 9, PS 2, PE 6, RA 3, CA 4, SC 16, SI 7.
  5. 320 assessment objectives. NIST SP 800-171A.
  6. Each one is assessed.
  7. One accountable lead.
  8. One written scope.
  9. One record your assessor can follow.
  10. Cybersecurity Consulting, a Capital Cyber practice. CMMC · NIST SP 800-171 · ITAR · RMF. cybersecurityconsulting.ai

How it starts

How does an engagement start?

How the practice works
  1. A 30 minute call about your contracts, your deadline and where your CUI lives.
  2. A written scope that names the engagement, the deliverables and who does what.
  3. A kickoff with your leadership and your IT provider in the room.

Our position

What will we not promise?

A certification result.

The C3PAO or the authorizing official decides that, and nobody who leads this work honestly can promise it.

We promise the work:

  • A plan that covers every requirement.
  • Evidence for everything that is implemented.
  • A written record of the risks your leadership chose to accept.

Insights

What are we writing about?

All insights

Our network

Where else can we point you?

  • Under 25 people?

    Cyber Grants Alliance, a nonprofit, offers in-kind cybersecurity support to small organizations. No cost to you.

    Apply for in-kind support

  • Need a priced CMMC gap assessment?

    Capital Cyber Compliance publishes the scope and the price.

    CMMC gap assessment

  • Need a managed security team?

    Capital Cyber runs managed IT and managed security.

    Managed security

Book a call

Ready to talk it through?

Pick a time for a 30 minute call with the practice.

Talk to an expertBook a 30 minute call

Or call +1 571 410 3066 or email info@capital-cyber.com