Government Contractors
Security Leadership for a Contractor, With CMMC Program Work Kept Where It Belongs.
Primes, insurers and agencies ask security questions only a leader can answer. Our vCISO owns the security program, and our Compliance Division leads the CMMC work. Capital Cyber, based in Leesburg, Virginia, provides Virtual CISO (vCISO) for government contractors and works on-site across Northern Virginia.
For contractors that need security leadership and governance but not a full-time executive.
Virtual CISO (vCISO) for Government Contractors
What Does a vCISO Do for a Government Contractor?
An experienced security professional learns your goals and builds a Technology Roadmap. They develop the security policy and the procedures under it, write the incident response plan, oversee the program and report risk to leadership in plain language.
They also help with the supplier security questionnaires primes send, so the answers match what you actually run.
Is a vCISO the Same as a Fractional CISO for CMMC?
No, and we say so plainly. The CMMC program leadership belongs to our Compliance Division, Capital Cyber Compliance: the gap assessment, the System Security Plan, POA&M development and its fractional CISO service. Our vCISO owns the wider security program around it.
Same company, so the plan and the people carrying it out do not drift apart. But the CMMC work is CCC's, and you buy it from CCC.
How Does the vCISO Work With the Compliance Division?
The vCISO sets security priorities and checks that controls are running. The Compliance Division turns the requirements of DFARS 252.204-7012 and NIST SP 800-171 into the SSP and the assessment plan. When one finds a gap, the other helps close it.
Neither of us is an Authorized C3PAO, so neither of us certifies you. We help you get ready for the assessment your contract calls for.
When Is the Right Time to Bring One In?
When a prime sends a questionnaire you cannot answer with confidence, when an insurer asks for documentation, or when you are not sure whether your contract means FCI or CUI. It is also the right time when leadership wants a straight answer on risk and nobody inside owns it.
What Is Included
6 PARTSTechnology Roadmap
Your goals lined up with the right technology, in order.
Governance and Policy
A cybersecurity policy and the procedures under it.
Incident Response Planning
A written plan, tested so people know their part.
Program Oversight
Security program management and regulatory oversight.
Questionnaires and Reviews
Help with client, supplier and insurer security questionnaires.
Leadership Reporting
Risk explained in plain language to the people who decide.
Frequently Asked Questions
4 QUESTIONSDo you offer a fractional CISO for CMMC?
Yes, through our Compliance Division, Capital Cyber Compliance. Its fractional CISO service is on the Capital Cyber Compliance site. Our vCISO covers the wider security program.
Who leads our CMMC program?
Our Compliance Division. It runs the gap assessment, the System Security Plan, POA&M development and the managed program. We run the IT and security those controls depend on.
Can a vCISO certify us for CMMC?
No. Only an Authorized C3PAO can certify a contractor, and only the Department of Defense accepts a score. We prepare you for the assessment.
How much time does a vCISO spend with us?
It is scoped to what you need, from a regular cadence of meetings to deeper involvement during an assessment or an incident. We set it on the call.
More for Government Contractors
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Government Contractors
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Government Contractors
IT support, managed security and CMMC experience for defense and federal suppliers.
Talk Through Security Leadership.
Pick a time. Tell us who asks you security questions today and what your contract requires.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.