Government Contractors
A Help Desk That Knows Which Systems Touch CUI and Which Do Not.
Your staff need fast answers, and your assessor needs to see who has access to what. We run the help desk so both are true on the same day. Capital Cyber, based in Leesburg, Virginia, provides Managed IT and Help Desk for government contractors and works on-site across Northern Virginia.
For defense and federal suppliers that handle FCI or CUI and want one accountable team running the IT around it.
Managed IT and Help Desk for Government Contractors
Why Does a Help Desk Matter to a CMMC Scope?
Because your MSP is inside your assessment. A team that administers your computers, accounts and tools holds Security Protection Data, so the services it provides fall inside your CMMC scope, and your System Security Plan (SSP) has to describe who does what between you and us.
A help desk that treats every ticket the same way cannot show that. We keep the line clear between systems that touch CUI and systems that do not, and we work from it.
What Is Security Protection Data, and Why Should Our MSP Handle It Carefully?
Security Protection Data is the information about how your security works: configurations, logs, account lists, scan results. It is not CUI itself, but anyone who holds it can see how your protections are built. Our administrators work from individual accounts, not shared logins, and nobody does daily work from an administrator account.
That is the same least-privilege habit NIST SP 800-171 asks of your own staff, applied to the people who support them.
How Do You Support Staff Without Pulling CUI Into the Wrong Place?
Remote support is unlimited and remote first, so most fixes happen without anyone touching a file. When a ticket involves a machine or an enclave that holds CUI, we handle it inside that boundary and do not copy data out to get a problem solved.
Where your contract calls for a CUI enclave, such as Microsoft GCC High with Azure Virtual Desktop, our Compliance Division designs and documents it. We run the IT around it.
What Do You Maintain Day to Day?
Workstations, laptops and servers, with round the clock monitoring and routine maintenance. Approved updates and patches install automatically, and password policy is enforced across user and device accounts. Patching, configuration and account control are the everyday parts of NIST SP 800-171, and they only count if they ran every time.
When a problem needs hands, we come on-site. We are based in Leesburg, Virginia, and work on-site across Northern Virginia.
Who Handles the CMMC Paperwork?
Our Compliance Division, Capital Cyber Compliance, runs the gap assessment, the SSP and the program. We are not an Authorized C3PAO and we do not certify anyone. We keep the day to day controls running and keep the evidence that they ran.
What Is Included
6 PARTSUnlimited Remote Support
Help desk support for every user, by ticket or by phone, without a cap on requests.
Remote Monitoring
Round the clock monitoring of your systems, so issues are caught before they reach your team.
Maintenance and Patching
Automatic installation of tested and approved updates across PCs, laptops and servers.
Password Policy Enforcement
Default credentials replaced and strong password standards applied to every account and device.
Backup and Recovery
Your critical data backed up and restorable after loss, corruption or an attack.
On-Site When Needed
Remote first, with on-site work in Northern Virginia when a problem needs hands.
Frequently Asked Questions
4 QUESTIONSDoes your help desk have to be inside our CMMC scope?
In practice, yes. An MSP that runs your tools holds Security Protection Data, so the services it provides fall inside your CMMC scope and your SSP has to describe who does what. We work with that, and our Compliance Division writes the SSP.
Do you handle our CUI when you fix a ticket?
We work remote first and keep CUI inside the boundary where it lives. We do not copy it out to solve a problem. Where an enclave is called for, our Compliance Division designs it.
Are you a C3PAO or a CMMC certifier?
No. Only an Authorized C3PAO can certify a contractor, and only the Department of Defense accepts a score. We run the IT and security, and our Compliance Division prepares you for the assessment.
How is managed IT priced?
As a fixed monthly cost scoped to your firm, given on the call after we know what you run.
More for Government Contractors
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Government Contractors
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Government Contractors
IT support, managed security and CMMC experience for defense and federal suppliers.
Talk Through Your IT and Your Scope.
Pick a time. Tell us whether you handle FCI or CUI and who runs your IT today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.