One control set. Every framework your customers ask for.
CMMC for the DoD. SSPA for Microsoft. SOC 2 for the commercial side. HIPAA because one client handles health data. They are largely the same controls, described in different languages, and rebuilding your evidence for each one is how contractors your size lose entire quarters.
We implement the controls once in your environment and maintain crosswalks into each framework’s format — so adding a framework is a mapping exercise, not another project.
Implement once. Attest many.
Frameworks disagree about wording, numbering, and evidence format. They agree almost entirely about what you should actually be doing. So we build to the controls, not to the questionnaire — and keep the crosswalks that translate one into the other.
First
Scope it honestly
What data you hold, where it lives, and which obligations genuinely apply. Most over-spend starts with a scope nobody questioned.
Then
Implement the controls
Built into how the environment runs, so evidence accumulates on its own instead of being assembled the month before an assessment.
After that
Project into each framework
Crosswalks map your single implementation into whichever format is being asked for. The second framework is a fraction of the first.
What each one is, and what we actually do about it.
Grouped by what drives the requirement, because that’s usually how it reaches you — a contract clause, the nature of the data, or a customer asking.
Federal contracting
Driven by your contracts, your primes, and the agency you sell to.
CMMC
DoD contractors handling FCI or CUI
The DoD’s assessment program layering verification on top of NIST SP 800-171. We handle scoping, gap assessment, implementation, SPRS scoring, and assessment readiness across Levels 1 and 2.
NIST SP 800-171
Anyone holding CUI on a federal contract
The underlying control set that most of the rest of this page inherits from, required by DFARS 252.204-7012. We implement it, write the SSP, run the POA&M, and keep the evidence current.
FAR CUI Rule
Federal contractors beyond DoD
Rulemaking that extends CUI handling requirements government-wide rather than leaving them to DoD clauses. We scope you against it early so it arrives as an update, not an emergency.
JCP
Contractors needing militarily critical technical data
The Joint Certification Program and DD Form 2345, which gates access to controlled technical data. We handle the application and the safeguarding obligations that follow certification.
Export control
Driven by the data itself, regardless of who your customer is.
ITAR
Defense articles and technical data on the USML
State Department jurisdiction, with hard limits on foreign-person access. We build the technology control plan, the access controls, and the segregation that make compliance demonstrable.
EAR
Dual-use items and technology
Commerce Department jurisdiction. We work through classification, deemed-export exposure in your own workforce, and the environment controls that keep restricted data where it belongs.
10 CFR 810
Nuclear technology and assistance
Department of Energy authorization for transfers of nuclear technology. We handle scoping, dual-jurisdiction scenarios where 810 and export control overlap, and the controls that follow.
Customer and commercial
Driven by who you sell to and what data you touch.
Microsoft SSPA
Microsoft suppliers and partners
Supplier Security and Privacy Assurance, including the Data Protection Requirements review. We scope your obligations, prepare the submission, and handle the remediation cycle.
SOC 2
Anyone whose customers ask for an attestation
AICPA Trust Services Criteria, Type I and Type II. We implement and evidence the controls, then prepare you for the CPA firm that performs the actual examination.
FedRAMP
Cloud services sold to federal agencies
Readiness and advisory work — scoping, control implementation, and documentation ahead of a 3PAO assessment. We prepare; we don’t authorize.
GovRAMP
Cloud services sold to state and local government
The state and local counterpart, formerly StateRAMP. Same readiness and advisory posture, mapped from the same control set you already maintain.
HIPAA
Anyone handling protected health information
The Security and Privacy Rules, risk analysis, and the safeguards behind them — including business associate obligations if you sit downstream of a covered entity.
PCI DSS
Anyone storing or processing cardholder data
Scoping first, because most PCI cost comes from a cardholder data environment that was never contained. We implement the controls and prepare you for the QSA.
We implement and prepare. We don’t grade.
“We do CMMC” means very different things depending on who’s saying it. Here’s exactly where our work ends and someone else’s begins — because the separation is what makes your evidence hold up.
What we do
The build and the maintenance — everything up to the point someone independent checks it.
What we’re not
Roles that have to stay independent of the party doing the work.
What stays yours
Responsibilities that sit with your company and can’t be transferred to a vendor.
Why we hold that line. A firm that implements your controls and then assesses them has graded its own homework, and an assessor will treat it that way. We’d rather build something that survives someone else’s scrutiny — and tell you honestly when you’re not ready for it yet.
The frameworks are the output. The work is upstream.
Nobody buys a crosswalk. What makes any of this cheap is having real controls, a contained environment, and someone owning the decisions — the attestations then fall out of work you were doing anyway.
Compliance
The practice that builds and maintains the control set, the documentation, and the evidence behind every framework on this page.
ComplianceSecure Enclave
Scope is the multiplier on all of it. Contain the regulated data and most of your business drops out of every boundary at once.
Secure EnclaveCybersecurity
Monitoring, testing, and training generate a large share of the evidence these frameworks ask for — as a by-product of actually being secure.
CybersecurityStart here
Find out which of these actually apply to you.
Start with a scoping session. We’ll work out which frameworks your contracts and customers genuinely require, how much they overlap, and how much of the work you’ve already done without realizing it. No obligation.
Veteran-founded · Cyber AB RPA-led · Government contractors only
