Yes. I sign a Business Associate Agreement with every healthcare client before I start.

My EHR is HIPAA compliant. Doesn't that cover me?

It covers the EHR company's servers. Your risk analysis, devices, passwords, policies and staff training are still on you.

What does HHS ask for first after a complaint or breach?

Your security risk analysis. A missing or outdated one is the most common gap HHS cites.

U.S. Capitol building in Washington, D.C. under a cloudy sky

Cybersecurity for government contractors

To win and keep federal and defense contracts, you have to prove you protect government information. I get you ready for CMMC, write your System Security Plan, train your staff, and serve as your Security Officer, so you can focus on the work.

The rules you face

FAR 52.204-21: any federal contract with Federal Contract Information requires 15 basic safeguards, such as access control, passwords, malware protection and visitor control.
DFARS 252.204-7012: if you handle Controlled Unclassified Information (CUI), you must meet the 110 controls in NIST SP 800-171 and report cyber incidents to DoD within 72 hours.
CMMC (32 CFR 170): Level 1 requires an annual self-assessment and a senior official’s affirmation in SPRS. Level 2 requires all 110 controls, assessed by you or a certified third party, as your contract requires.
False Claims Act: the Justice Department pursues contractors who misrepresent their security, and an inflated SPRS score is a common target.

Learn more: Cybersecurity Maturity Model Certification · Which rules apply to you?

See Pricing

Machinist working at a lathe in a manufacturing shop

Person sitting on a beige couch wearing a blue plaid shirt, holding a white electronic tablet, and wearing dark green pants.

What you get

A System Security Plan and Plan of Action: written for your company, mapped to NIST 800-171, and ready for an assessor.
Your SPRS score: calculated honestly, with a plan to close the gaps.
A named Security Officer: I take that role by contract, track what’s due, and keep the paperwork current. You keep every decision.
Vendor and subcontractor management: a simple process to check the security of every vendor and sub that touches your contract data, with requirements flowed down where the contract says so.
Monitored protection: 24/7 protection on your devices and email, set up with you.
Staff training: everyone who touches contract data completes it, with records kept.
An incident response plan: including the 72-hour DoD report and evidence preservation.
A yearly review: including your annual CMMC affirmation.

Want to see the full process? See How It Works.

Take Free Assessment

What clients say

“Todd is a cybersecurity expert, especially in the government space. He just shared some really important news with me today that will greatly affect my clients, so I appreciate you Todd! Highly recommend!”

Nikki Gianni, The Gov Con Architect
“Todd is very passionate about helping small businesses protect themselves from cyber threats. If you run a micro business, you need to talk to Todd.”

William McBorrough, CISO, MCGlobalTech

Common questions

I only handle FCI, not CUI. What do I need?

CMMC Level 1: the 15 safeguards in FAR 52.204-21, an annual self-assessment, and an affirmation in SPRS.

Can’t I just self-assess and enter a score?

You can for Level 1, and for some Level 2 contracts. But a score you can’t back up with a real System Security Plan is a False Claims Act risk.

I’m a subcontractor. Does this apply to me?

Yes. Primes flow the same requirements down to you, and many won’t award work without your SPRS score.

Didn’t DoD pause CMMC?

Only the third-party assessment rollout. The rule, DFARS 7012, FAR 52.204-21 and self-assessments still apply, and your prime can still require certification.