Government Contractors
Monitoring and Incident Response That Fit What NIST SP 800-171 Asks For.
Audit logging and incident response are written into NIST SP 800-171. Our 24/7 SOC watches the logs, and a plan decides who does what when something is wrong.
For contractors who hold FCI or CUI, have no security team of their own, and need monitoring they can show an assessor.
Managed Security Monitoring (MDR and SOC) for Government Contractors
Where Does Monitoring Show Up in NIST SP 800-171?
In two families. Audit and Accountability (3.3) is about creating and keeping the logs that let you trace who did what on a system. Incident Response (3.6) is about having a capability to detect, analyze, contain and report incidents, and to test it.
Our managed detection and response watches logs across your cloud, network and endpoints 24/7 from a security operations center. That is how the logging and the response both get done by people, not left as settings nobody reads.
What Does DFARS 252.204-7012 Say About Incidents?
When a contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information in it, the clause requires a review for evidence of compromise and rapid reporting to DoD at dibnet.dod.mil. The clause defines rapidly report as within 72 hours of discovery. It also requires preserving images of affected systems and relevant monitoring and packet capture data for at least 90 days from the report. Read the current clause at ecfr.gov and confirm what applies to your contract with your counsel.
A 72 hour clock only works if someone sees the incident. Round the clock monitoring is how discovery happens at night and on weekends, and a written plan means the report is not the first time anyone has thought about it.
What Happens in the First Hours of an Incident?
You hear from us and the response has already started. Your incident response plan is formalized ahead of time, so everyone knows who decides what, who contacts the prime and who files the report. We contain the threat, preserve the evidence and keep a record of what was done.
Is Monitoring Enough for CMMC?
No, and we do not sell it that way. Monitoring works on top of multi-factor authentication, endpoint detection and response, patching, backups and trained staff. How monitoring and logging are scoped inside your assessment is decided in your SSP, which our Compliance Division writes.
What Is Included
5 PARTS24/7 SOC Monitoring
Logs and alerts from cloud, network and endpoints watched around the clock.
Managed Detection and Response
Analysts who investigate and act, not just forward an alert.
Incident Response
A formal plan, and a team that runs it with you.
Threat Detection on Accounts
Suspicious sign-ins and mailbox rules flagged and acted on.
Reporting
What we saw and what we did, in plain language.
How Managed Security Monitoring (MDR and SOC) Works for Every Client
Frequently Asked Questions
4 QUESTIONSIs the monitoring really 24/7?
Yes. The SOC monitoring is 24/7, including nights, weekends and holidays.
What does DFARS 252.204-7012 require after an incident?
A review for evidence of compromise and rapid reporting to DoD at dibnet.dod.mil, where rapidly report means within 72 hours of discovery, plus preservation of affected system images and monitoring data for at least 90 days from the report. Read the clause at ecfr.gov and confirm what applies to you with your counsel.
Do government contractors need MDR for CMMC?
CMMC Level 2 has requirements for monitoring, audit logging and incident response. How they are met in your environment is scoped by our Compliance Division, Capital Cyber Compliance, and our monitoring is one way to meet them.
Does monitoring make us compliant?
No. It supports the technical safeguards. Neither of us certifies anyone, and only an Authorized C3PAO can.
More for Government Contractors
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Government Contractors
IT support, managed security and CMMC experience for defense and federal suppliers.
Talk Through Your Monitoring.
Pick a time. Tell us what you protect and who in your company would take the call at 3 a.m.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.