Cybersecurity Programs

Our program identifies weaknesses in your system with regard to system access requirements, controlling internal access, and limiting data access to authorized users and processes. Based upon your actual risk assessment results, we detail exact mitigation steps required to bring you into full compliance with the CMMC.

You cannot protect it unless you know what needs protecting and where it is. Most DoD contractors are responsible for protecting Controlled Unclassified Information (CUI). We teach you what this is and how to identify and label it. We provide step-by-step instructions that help you get it done according to CMMC requirements.

Audit and accountability is about putting systems in place that continuously monitor your IT infrastructure and report back to you when they see problems. We help you define your audit requirements, choose, and manage the correct system, protect audit data, and correctly respond to alerts.

Security awareness training is critical. We supply you with a wide range of professional training materials, including on-demand videos and webinars covering many subjects including phishing, ransomware, insider threats and more. If you must meet CMMC Level 2 or higher requirements, we provide you with the best phishing simulator available as part of your training program. You also get access to Mitch's nationally recognized blog and weekly newsletter to keep your staff informed on breaking cybersecurity news.

No matter what size your company is, the IT infrastructure must be professionally hardened and protected against attack. We help you inventory your assets then go through a process of methodically and carefully configuring those assets so they are much more difficult to compromise--including the right kind of encryption for your environment. Additionally, we make sure you identify your critical data and back it up in a professional and correct manner. This hardening process is monitored and supported by one of our technical engineers.

We help you set up the systems required to make sure only approved people are allowed to see your data. You'll gain and maintain control of passwords, encryption, and multi-factor authentication processes and procedures.

If you have an incident or a breach, you must know what to do--IMMEDIATELY. There can be no response delay while you try to figure things out. The DFARs require that you notify the Pentagon within 72 hours of a breach. We help you set up and test your incident response program designed to detect and report events. If an event occurs, you log into our shared Google Drive and follow the response steps as directed and practiced by your team.

All IT infrastructure hardware and software must be inventoried, updated and maintained at all times. The people who maintain these systems and who have access to those systems and that data must also be controlled. It is likely that, at some time, people without approved access to CUI will need access to systems, copiers and other equipment. We provide detailed steps for organizing and driving this effort.

The CMMC requires your company to protect CUI data no matter what kind of media it resides on within your IT infrastructure. We help you physically control and securely store all system data that includes CUI - whether it is stored on paper or digitally.

We provide you with CMMC compliant policies, procedures, and processes to on-board, train, and off-board personnel in a manner that reduces risk and exposure. This includes processes for protecting CUI at alternative work locations such as work from home.

A foundational piece of any cybersecurity program is physical security. Our program helps you control physical access to your facilities, IT infrastructure equipment, and physical access devices in full compliance with CMMC requirements.

The key to any IT disaster recovery program is complete and reliable backups of your data. This requires careful planning and execution to make sure your backups are available when needed the most, and also that they can be recovered in a time-effective and cost-effective manner. .

Cybersecurity is a business risk. CMMC requires that you actively test for, manage and remediate all aspects of organizational risk. Our CMMC program supports you in this process.

You can't fix it unless you know what is broken. We work with your team directly to perform the required network and/or application assessments Additionally, we will perform automated and other testing of your IT infrastructure as required.When the risk assessment is completed, we provide you with a written report (SSP - System Security Plan) including prioritized recommendations for fixing problems and risks (Plan of Action - PoAM) and other reports.

As per CMMC requirements, we'll help you set up systems that keep you and your decision-makers and other responsible parties informed on the ever-changing threat environment.

CMMC requires you to think holistically about and better understand the boundaries of your IT and communication systems. With this knowledge, we can help you better engineer your environment so as to reduce exposure and attack vectors.

System and information integrity is maintained by the performance of scans of the systems and in-bound and out-bound email and other communications. It also requires an aggressive patching program for all devices, including mobile, in a timely fashion. Our program helps you integrate and document these on-going activities into your overall CMMC compliant cybersecurity program.