CMMC · NIST SP 800-171 · ITAR · RMF · Insider threat+1 571 410 3066
Cybersecurity Consulting

Sterling, Loudoun County, Virginia

Security program leadership for Sterling defense and aerospace suppliers

We help Sterling defense contractors, aerospace suppliers and federal IT firms meet NIST SP 800-171, CMMC Level 2 and ITAR technical data obligations. Sterling is about 15 miles from Leesburg. We work on site anywhere in the Washington DC area, and much of the program work runs remotely between visits.

Based in Leesburg, VA · On site across the DC area

NIST SP 800-171, CMMC Level 2 and ITAR security programs for Sterling, VA defense and aerospace suppliers, from Leesburg, about 15 miles away.

Book a 30 minute call

Why does Sterling need this work?

  • Sterling borders Washington Dulles International Airport, and its Route 28 business parks mix data centers, light manufacturing, logistics and aerospace support companies.
  • Suppliers that machine, assemble or ship parts for defense programs often receive controlled drawings, which brings CUI and ITAR technical data onto shop floor systems that need careful scoping.
  • Many Sterling firms are subcontractors whose obligations arrive through a prime's flow down of DFARS 252.204-7012 and 7020, and the SPRS score DFARS 252.204-7019 expects, often with a short deadline to post an SPRS score.
  • The Route 28 corridor connects Sterling to Chantilly and Herndon, so a single on site day can often cover a client's offices and production space across the corridor.

Which engagements do Sterling contractors use?

SSP and POA&M review and assessor readiness

Review of your System Security Plan and POA&M against NIST SP 800-171A, so both documents are assessor ready for CMMC Level 2.

ITAR cybersecurity program

Cybersecurity programs for ITAR controlled technical data, built on NIST SP 800-171 and DFARS 252.204-7012, from Capital Cyber.

CUI enclave design

CUI enclave design in Microsoft Azure and M365 GCC High, with a defined authorization boundary, for defense contractors.

No consultant can promise the outcome of an assessment or authorization. The assessor or authorizing official decides it.

What do Sterling contractors ask?

Are you based in Sterling?

No. We are based in Leesburg, about 15 miles from Sterling. We work on site in Sterling whenever the engagement needs it.

Our prime sent a DFARS flow down clause. Where do we start?

Start by confirming which information you receive under the contract and where it lives, then assess against NIST SP 800-171 and post an honest score in SPRS. We can lead both steps.

Can CNC machines be part of a CMMC scope?

Yes. Machines that receive programs derived from controlled drawings are often treated as Specialized Assets, isolated on their own network segment and documented in the SSP.

Where else nearby do we work?

Cybersecurity consulting in Ashburn, VA, Cybersecurity consulting in Herndon, VA, Cybersecurity consulting in Chantilly, VA, Cybersecurity consulting in Leesburg, VA. See all the places we work.

Ready to talk it through?

BOOK A CALL

Pick a time for a 30 minute call with the practice.

What happens in 30 minutes

  1. We learn about your company, the contracts you hold or are bidding on, and what is driving your timeline.
  2. We talk through where you stand and which engagement fits, if any does.
  3. If there is a fit, we follow up with a written scope. No slides.