CMMC · NIST SP 800-171 · ITAR · RMF · Insider threat+1 571 410 3066
Cybersecurity Consulting

Arlington, Arlington County, Virginia

CMMC, RMF and security leadership for Arlington defense contractors

We lead CMMC Level 2, NIST SP 800-171 and RMF authorization work for Arlington defense contractors, consultancies and federal integrators. Arlington is about 33 miles from Leesburg. We work on site anywhere in the Washington DC area, and much of the program work runs remotely between visits.

Based in Leesburg, VA · On site across the DC area

CMMC Level 2, NIST SP 800-171 and RMF authorization leadership for Arlington, VA defense contractors, from Leesburg, about 33 miles away.

Book a 30 minute call

Why does Arlington need this work?

  • Arlington is home to the Pentagon, and the Crystal City and National Landing area, Rosslyn and Ballston hold many defense contractors, consultancies and program support firms.
  • Firms that support DoD program offices often handle CUI in contract deliverables, briefings and email, which makes email and document platforms the center of the CUI scope.
  • Professional services firms here frequently have no shop floor and few systems, so a well designed enclave can keep the CMMC scope small and the effort proportionate.
  • We schedule Arlington on site work outside peak commuting hours where we can, and run much of the program remotely between visits.

Which engagements do Arlington contractors use?

CMMC Level 2 program leadership

Fractional CISO leadership for a CMMC Level 2 certification run, from the first assessment to the C3PAO visit.

CUI enclave design

CUI enclave design in Microsoft Azure and M365 GCC High, with a defined authorization boundary, for defense contractors.

RMF, ATO and continuous authorization

RMF, ATO and continuous authorization leadership for federal programs and integrators, across NIST SP 800-53 and CNSS 1253.

No consultant can promise the outcome of an assessment or authorization. The assessor or authorizing official decides it.

What do Arlington contractors ask?

Are you based in Arlington?

No. We are based in Leesburg, about 33 miles from Arlington. We travel to Arlington for on site work as the engagement requires.

We are a small consultancy. Does CMMC apply to us?

If your contracts include DFARS 252.204-7012 and you handle CUI, NIST SP 800-171 applies, and the CMMC level in your contracts sets how it is assessed. Firms that handle only FCI fall under FAR 52.204-21.

Is GCC High the right choice for a small services firm?

It is a common choice when CUI lives in email and documents, but it depends on your data flows and contracts. We decide that during scoping, not before.

Where else nearby do we work?

Cybersecurity consulting in Alexandria, VA, Cybersecurity consulting in Fairfax, VA, Cybersecurity consulting in Reston, VA. See all the places we work.

Ready to talk it through?

BOOK A CALL

Pick a time for a 30 minute call with the practice.

What happens in 30 minutes

  1. We learn about your company, the contracts you hold or are bidding on, and what is driving your timeline.
  2. We talk through where you stand and which engagement fits, if any does.
  3. If there is a fit, we follow up with a written scope. No slides.