Managed IT Services for Defense Contractors and CMMC

01Why defense suppliers choose managed IT

The Department of Defense is adding CMMC requirements to contracts in phases. Suppliers that handle controlled unclassified information (CUI) will generally need Level 2, which follows the 110 requirements in NIST SP 800-171.

Small suppliers rarely have the staff to put those controls in place and keep them running. That is the gap managed IT fills.

02What we manage for defense suppliers

• A gap review against CMMC Level 1 or Level 2
• Policies and documentation, including a system security plan
• Security controls: MFA, encryption, logging and access control
• Secure email and file storage for CUI
• Ongoing management and evidence after you are ready
• Coordination with your outside assessor

03Working with your software vendors

We keep the systems behind your secure email and file storage for CUI, CAD and ERP systems running, and we work directly with your vendors when a problem sits between their software and your systems.

04Security and compliance

We help defense suppliers prepare for CMMC Level 1 and Level 2 with a gap review, policies and the security controls. The formal assessment is done by an outside assessor (a C3PAO). We do not certify companies and cannot guarantee an assessment result, but we can make sure the controls you show the assessor are real and running.

05Onboarding

We map your secure email and file storage for CUI, CAD and ERP systems, the computers that run it and the vendors behind it. Old access is removed, multi-factor sign-in is turned on and documentation is written before we take over the help desk.

How onboarding works

06Pricing

For defense suppliers, each person with an account is one user fee, each computer we manage is one workstation fee, and servers and the network are priced on their own lines. Busy offices with shared computers do not pay for seats nobody uses. Terms are longer than a month, because the first weeks are spent securing and documenting your systems.