Gap assessment
When the program needs a baseline, or a new contract brings a new framework.
Advisory servicesA virtual CISO for federal programs
A virtual CISO is a part-time security leader who works inside your organization. One named person owns your security program and reports to your leadership.
Assessments, documentation, engineering and monitoring come from us under the same retainer, in the order your lead sets.
The retainer’s calendar
| When | What happens |
|---|---|
| Every month | The risk register and POA&M reviewed with their owners; a written report to leadership on posture, open risks and the decisions needed. |
| Every quarter | The roadmap re-sequenced, each item with an owner, an effort estimate and a target quarter; a tabletop exercise on one scenario. |
| Every year | The risk assessment; policies reviewed and approved; the incident response plan tested; awareness training; the evidence for the annual assessment, and the CMMC affirmation drafted for your Affirming Official, who under 32 CFR 170.22 must be a senior person inside your company. |
Month 3
- Monthly The risk register and POA&M reviewed with their owners
- Monthly A written report to leadership on posture, open risks and the decisions needed
- Quarterly The roadmap re-sequenced, each item with an owner, an effort estimate and a target quarter
- Quarterly A tabletop exercise on one scenario
Work your lead can call on
Documentation
We keep the SSP, policies, procedures and POA&M current as your systems change.
Advisory servicesEngineering
Our engineers make the fixes on the roadmap, working alongside yours.
Engineering servicesMonitoring
For an authorized system, the monthly monitoring cycle runs under the same lead.
Continuous monitoring