05 / WORK WITH US
Who does the work, and how to reach them.
This site is published by Capital Cyber, a Leesburg, Virginia firm. The compliance practice takes small and mid-sized defense contractors through CMMC Level 2 from the first scope call to the posted score. This is what we do, and what to have ready before you call.
The practice behind this site.
Scope and gap assessment.
We draw the line around your CUI with you, then check all 110 requirements against it, objective by objective, and hand you the score and the report.
System Security Plan, policies and plan of action.
We write the SSP from your real environment, the policies and procedures your people will follow, and a plan of action with owners and dates.
Evidence and program leadership.
We collect the evidence as it accrues, keep the plan moving, and act as the person who owns the program when your shop has no one to give it to.
Enclave design.
When CUI can be kept to a small set of machines and accounts, we design that set so the rest of your shop stays out of scope.
Capital Cyber is not an Authorized C3PAO. We prepare you for an assessment and stand beside you during one. We do not certify, and no firm that prepared you should.
Before you call.
- Have the contract, purchase order or supplier survey that raised CMMC. The clause number tells us the level.
- Know roughly where drawings and technical data arrive and where they are kept. A guess is fine; the scope call fixes it.
- Know who at your company would sign the affirmation. That person should hear the first conversation.
- If you have 10 to 50 employees and need help, check out in-kind grants.
BOOK A CALL
Book a 30-minute call.
Pick a time. We will read the clause with you and tell you which level it names and what the first step is.