Fractional CISO for engineering and design firms
Someone owns security while the engineers engineer.
A part-time CISO working from inside your engineering firm: keeping the plan and POA&M current as programs, CAD tools and people change, and speaking to the program when a prime asks. Capital Cyber, based in Leesburg, Virginia, provides fractional CISO services for engineering and design firms and works on-site across Northern Virginia.
For engineering firms whose principals are billing design hours and cannot also own the program.
Why does an engineering firm drift after its assessment?
Projects start and close, a new CAD add-in arrives, the plotter gets replaced, a remote engineer joins, a prime switches portals. Each one changes the environment the SSP describes. Without someone whose job it is to notice, the plan stops matching the office within a few programs.
What does a fractional CISO review in a design office?
Who has access to which controlled programs in the vault, whether that still matches who is working on them, what changed on the workstations and why, which open POA&M items moved, and anything a prime asked. Each review is recorded: what was decided, by whom, and what changed.
Who answers when a prime sends a security questionnaire?
Someone who knows the program from the inside. A fractional CISO can speak to how controlled drawings are handled, what is met and what is open, with the documents behind each answer, instead of a principal guessing between design reviews.
Who signs the annual affirmation?
A senior official from your firm, under 32 CFR 170.22, affirming continuing compliance every year. A fractional CISO does not sign it for you. The point of the role is that when your official signs, the program behind the signature has been actively run.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.3
Security Control Monitoring
Controls on the vault, workstations and transfer channels are checked on an ongoing basis. Evidence is the recorded review history.
CM.L2-3.4.4
Security Impact Analysis
A new CAD add-in, plotter or cloud tool is assessed for security impact before it goes in. Evidence is the change record with the analysis attached.
RA.L2-3.11.1
Risk Assessments
Risk to the systems holding controlled drawings is reassessed as programs and tools change. Evidence is a dated risk assessment that names the vault and workstations.
AC.L2-3.1.5
Least Privilege
Vault and workstation access matches who is on each controlled program now. Evidence is a periodic access review with removals recorded.
What do you receive?
SCOPED PER CLIENTA security lead inside the firm
A part-time security and compliance lead working from inside your engineering firm.
Recorded reviews
What was decided, by whom, and what changed, for each review.
A current plan and POA&M
Kept current between assessments as programs, tools and engineers change.
Someone to speak to the program
When a prime or an assessor asks about it.
What does this service not include?
We are not an Authorized C3PAO and we do not certify anyone. A fractional CISO is a part-time role we provide, not a full-time hire, and what we can commit to is our own accountability rather than what a third party will do.
The full service, for any industry: Fractional CISO. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Is a fractional CISO a full-time hire for our engineering firm?
No. It is a part-time role we provide, scoped per client: which reviews, how often, and what is already in place.
Does the fractional CISO sign our CMMC affirmation?
No. Under 32 CFR 170.22 the affirmation is made by a senior official from your own organization. The fractional CISO keeps the program behind that signature current.
What if our engineering firm has never had a gap assessment?
Then the role starts with one, so the plan the fractional CISO owns is built on a checked picture of the vault, workstations and transfer methods rather than an assumption.
Are you a certifying body?
No. We are not an Authorized C3PAO and we do not certify anyone. What we commit to is our own accountability inside the role.
More for engineering and design firms
Fractional CISO in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.