The questions people ask
before they trust us with this.

We run the security and compliance function for government contractors. Three practices — cybersecurity, compliance, and AI — plus two ways to deliver them: a Secure Enclave we build in your own cloud account, and a vCISO who owns the outcome. Technology and AI carry the repetitive volume; credentialed practitioners make the calls that need judgment.

Government contractors, exclusively — defense and civilian, typically 10 to 200 people. Companies carrying prime-level security obligations without prime-level staff. If you have no federal contracts and no regulated data, we’re not the right fit and we’ll say so.

No. We’re not a C3PAO, a CPA firm, a QSA, or a 3PAO. We implement and prepare; we don’t grade. A firm that builds your controls and then assesses them has marked its own homework, and an assessor will treat it that way. That separation is deliberate.

Greypike is a veteran-founded, SBA-certified Veteran-Owned Small Business (CAGE 9WVS6, SAM UEI N6CJNGDARFM5). Our work is led by a Cyber AB Registered Practitioner Advanced. We deploy Microsoft 365 GCC High as an AOS-G partner through Pax8. We hold ourselves to the same NIST SP 800-171 standard we deliver for clients, self-assessed.

No. We don’t run a helpdesk and we’d rather say so than do it badly. Most clients keep their existing IT provider or MSP and we work alongside them — and we’ll document the boundary between the two firms in writing so nothing lands in the gap.

Managed EDR on every endpoint, a managed SIEM collecting and correlating your logs, vulnerability management with findings prioritised by real reachability, and security awareness training with phishing simulation. We tune the rules so alerts mean something — and we’re the ones who look at them.

Defined in your agreement, not implied on a web page. Coverage hours, response targets, and escalation paths are written into the SOW and we’ll tell you exactly what we commit to before you sign. We’d rather scope that honestly than publish a number we can’t hold on your worst day.

Yes, scoped per project. You get findings ranked by real impact, proof of what we actually reached, and remediation guidance your team or ours can act on. It’s separate from monitoring because it’s a point-in-time engagement, not a subscription.

A named practitioner runs it — containment, investigation, recovery, and the written record you’ll owe your prime, your insurer, and possibly your contracting officer. Not a ticket in a queue. Incident response is retained or billed through Expert Blocks depending on your agreement.

CMMC, NIST SP 800-171, export control (ITAR, EAR, 10 CFR 810), the Joint Certification Program, Microsoft SSPA, SOC 2, FedRAMP, GovRAMP, HIPAA, and PCI DSS. See what each one is →

Frameworks disagree about wording, numbering, and evidence format. They agree almost entirely about what you should be doing. So we build one canonical control set in your environment and maintain crosswalks that project it into each framework’s language — which is why your second framework costs a fraction of your first.

The suspension paused mandatory third-party C3PAO assessments. It did not pause DFARS 252.204-7012, your NIST SP 800-171 obligations, your SPRS score, or your annual affirmation. The plain-English breakdown →

No, and neither can any other vendor. Your senior official signs it — that responsibility sits with your company and can’t be outsourced. What we do is make sure the evidence behind that signature actually holds, and that whoever signs understands exactly what they’re attesting to.

Readiness and advisory work — scoping, control implementation, and documentation ahead of a 3PAO assessment. We prepare; we don’t authorize. Same posture for GovRAMP.

No — that’s the second way to get this wrong. Block everything and your people use their phones instead, or stop entirely, and you’ve paid for a tool nobody opens. The target is a sanctioned path that’s better than the unsanctioned one. We measure it by whether people are still using it in month six.

We’re not tied to one vendor. Microsoft Copilot, Google Gemini, Claude, ChatGPT Enterprise, Azure OpenAI, Amazon Bedrock, or open-weight models on your own infrastructure. We help you pick what actually fits the work, then deploy it in your tenant with the data boundary and access controls set.

No. When we enable AI it runs inside your own accredited environment, under your controls — never on Greypike systems, and never on your controlled data from the outside. We build and govern it; your environment runs it.

Neither is law. Both are voluntary frameworks that buyers increasingly expect to see, and we align you to them for that reason. We don’t certify against either — nobody can self-certify ISO 42001, and AI RMF has no certification at all.

No. It’s a delivery vehicle, not a prerequisite for anything else we do. Plenty of clients buy monitoring, compliance, or a vCISO without one. It just makes everything else cheaper and easier, because there’s less ground to cover.

You do. We build it in your own cloud account and operate it on your behalf. If you ever leave, the tenant, the data, and the documentation all stay with you. No lock-in, and your data never sits alongside another client’s.

Most people work inside the boundary through a virtual desktop, which keeps their laptop out of scope. When the work genuinely needs local hardware — CAD, instrumentation, a machine on the shop floor — we bring that endpoint into the boundary instead: enrolled, hardened, and managed. It’s in scope when we do, and we’ll tell you what that costs first.

Not always, and over-buying a government cloud you don’t need is a real and expensive mistake. GCC High and Google Assured Workloads are for CUI and export-controlled data. If your driver is SOC 2, HIPAA, or a prime’s security requirements, a commercial enclave does the same containment for less. We scope the data before recommending a platform.

Yes. Because we operate the environment on your behalf, we act as an External Service Provider and appear in your boundary description. That’s normal, it’s manageable, and we’ll walk you through exactly what it means for your assessment before you sign anything.

Small Business ($500/month) is tracking and a regular conversation — CIS control tracking, a weekly check-in, a quarterly risk assessment. Standard (from $2,250/month) is ten hours of a named practitioner who owns strategy, risk decisions, policy, questionnaires, incident command, and board reporting.

No — they’re separate services. A vCISO decides what should happen; the Cybersecurity practice is what runs it. Buying both from one team means direction and delivery don’t sit with two different vendors, but you can buy either on its own.

Overage is billed at the same hourly rate, with no rollover of unused hours. Larger pieces of work — incident response, document production, third-party risk reviews — route to Expert Blocks so they’re scoped and quoted rather than quietly consuming your retainer.

A scoping session. We map what data you handle, what your customers require, where you’re exposed, and what’s worth doing first. You leave with a straight answer — including if the answer is that you don’t need us yet. No obligation and no charge.

The technical build is fast — automation does most of it. What sets the timeline is scoping, data migration, and getting your people working in the new environment. We’ll give you a real schedule at scoping rather than a marketing number.

Yes. We don’t backdate evidence and we don’t fabricate artifacts. If your posture won’t survive an assessment, the useful thing we can do is say so early, while there’s still time to fix it — not after someone independent finds it.

Regularly. We document the responsibility split in writing — who owns security configuration, who owns hardware and end-user support, how gaps get reported between firms, and what happens when one goes unremediated. Both firms end up in your assessment scope, so that clarity matters.