CMMC Level 2 program leadership
One CMMC program across every task order.
Government IT and services contractors
CMMC for IT and services firms on DoD task orders.
Your people may spend all day inside government systems, but the proposals, drafts, deliverables and email they create on your own systems are where your obligations sit. We help you draw that line and write it down. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for government IT and services contractors and works on-site across Northern Virginia.
For small IT, engineering, professional services and staffing contractors on DoD contracts and task orders, often as a subcontractor to a larger prime.
Where does CUI show up?
CUI AND FCIDeliverables and the drafts behind them
Design documents, architecture diagrams, test reports, technical studies and the working drafts that sit in OneDrive or a SharePoint library for weeks before anything is submitted. When the contract or the government customer marks them CUI, every copy is in scope, including the draft version three that nobody deleted.
Email and Teams traffic with the prime and the customer
Statements of work with marked attachments, technical data sent by the prime for a task, and the Teams chat where someone pastes a configuration or a screenshot of a finding. Chat and email are where CUI most often lands without anyone deciding it should.
Documentation about government systems you support
Network diagrams, system configurations, vulnerability scan results and plans of action for systems you help operate. Information about how a DoD system is built and where it is weak is the kind of information that is often marked, and it tends to get copied onto your own machines for convenience.
Proposals, pricing and task order paperwork
Contract information that is not public, such as task order details, staffing plans submitted to the customer and the contract file itself, is Federal Contract Information even when nothing is marked CUI. FCI alone brings FAR 52.204-21 and its 15 basic safeguarding requirements.
Personnel information handled for the customer
Staffing and support contracts sometimes involve rosters, access requests or records about government personnel. Whether that is CUI depends on how the contract identifies it, so the first step is reading the contract, not assuming.
Where does scoping get hard?
SCOPINGGovernment systems versus your own
A government network your staff log into as users is not the same thing as your own tenant. A system you operate on behalf of the government is treated differently again under DFARS 252.204-7012. The scope gets wrong in both directions when nobody writes down which is which.
One Microsoft 365 tenant for everything
Most firms run one commercial tenant for sales, HR, finance and contract delivery. If CUI reaches that tenant, the question becomes whether the whole tenant is in scope or whether CUI moves to a separate environment, and that decision drives cost more than any other.
Remote and hybrid staff
Consultants who work from home, from a customer site and from a hotel are carrying CUI to alternate work sites. That brings PE.L2-3.10.6, plus remote access controls such as AC.L2-3.1.12, to every home office that touches the work.
Personal phones and unmanaged laptops
Outlook and Teams on a personal phone is the fastest way CUI leaves a managed boundary. AC.L2-3.1.18 asks you to control which mobile devices connect at all, and AC.L2-3.1.19 asks for encryption of CUI on the ones that do.
Teaming partners and guest access
A shared Teams channel or SharePoint site with a teaming partner is a CUI flow across company lines. Guest accounts, external sharing settings and who owns the site all need to be in the SSP, not just your own users.
Your MSP, help desk and security tools
The tools that manage and protect your endpoints, and the people who run them, are Security Protection Assets under 32 CFR 170.19 even if they never open a CUI file. They are part of the scope whether or not anyone listed them.
Does CMMC cover the government systems your staff work in every day?
Usually not in the way people expect. DFARS 252.204-7012 defines a covered contractor information system as one that is owned, or operated by or for, a contractor and that processes, stores or transmits covered defense information. When your staff simply log into a system the government owns and runs, using government accounts, that system is the government's to secure. When you operate a system on behalf of the government, paragraph (b)(1) of the clause sends you to the cloud computing clause, DFARS 252.239-7010, or to the security requirements written elsewhere in that contract, not to NIST SP 800-171.
Government Furnished Equipment you hold, such as a government-issued laptop, is a Specialized Asset under 32 CFR 170.19: it goes in your asset inventory and your SSP, and it is not assessed against all 110 requirements. Everything else, your own laptops, your own tenant, your own file shares, falls under paragraph (b)(2) of 7012 and NIST SP 800-171 the moment CUI reaches it. If a contract is unclear about which side a system sits on, that is a question for your contracting officer, in writing.
Where does CUI actually land on your own systems?
Rarely where anyone planned. A government customer emails a marked document to a project lead. The lead saves it to OneDrive, which syncs it to a laptop, which backs up to a personal cloud account. Someone pastes part of it into a Teams chat with a teaming partner. None of that was a decision, and all of it is now in scope.
The work is tracing that path for each contract, then choosing where CUI is allowed to live and closing the other doors. A CUI flow diagram that matches what your people actually do is worth more to an assessor than one that describes the policy.
Is commercial Microsoft 365 enough, or do you need GCC High?
It depends on what you hold, and it is a decision to make on purpose rather than by default. DFARS 252.204-7012 requires any external cloud service provider that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline, and to follow the clause's incident reporting, malware, media preservation and forensic access requirements.
The factors that drive the choice are the CUI categories in your contracts, whether export-controlled technical data is involved, what your prime expects, and how many of your people actually touch CUI. Often the answer is not to move the whole company: a smaller environment for the people on CUI work, with everyone else left where they are. Whatever you choose, the reasoning belongs in writing, because an assessor will ask why.
What if your contract only brings FCI?
Then the requirement is FAR 52.204-21 and CMMC Level 1: 15 basic safeguarding requirements covering access, identification, media disposal, physical access, boundary protection, flaw remediation and malware protection. Under DFARS 252.204-7021, a Final Level 1 (Self) assessment is current for one year and carries an affirmation by a senior official, so it is an annual exercise, not a one-time one.
Many services firms hold FCI on most contracts and CUI on a few. Knowing which task orders bring which is the difference between a Level 1 program for the business and a Level 2 boundary drawn around the work that needs it.
Which clauses will you see?
DFARS AND FARFAR 52.204-21
Fifteen basic safeguarding requirements for any of your systems holding Federal Contract Information, such as task order details and non-public contract files, flowed to subcontractors who will hold FCI.
DFARS 252.204-7012
NIST SP 800-171 on your own systems that hold covered defense information, FedRAMP Moderate equivalent for cloud services that hold it, reporting of cyber incidents within 72 hours, and flow-down into subcontracts that involve it.
DFARS 252.204-7019 and 252.204-7020
A current NIST SP 800-171 assessment score in SPRS for each covered system relevant to the offer, and access for DoD if it chooses to assess you further.
DFARS 252.204-7021
The CMMC clause: names the level and assessment type the contract requires, an affirmation by a senior official, and flow-down to subcontractors who will process, store or transmit FCI or CUI.
DFARS 252.239-7010
Applies when you use cloud computing to provide IT services in performance of the contract, such as a system you host or operate on behalf of the government. It points to the DoD Cloud Computing Security Requirements Guide, a different set of rules from the ones covering your own email.
What can we do for government IT and services contractors?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
An SSP that knows whose system is whose.
CUI enclave design
A CUI enclave for the people on CUI work.
Supply Chain Risk Management
Flow-down across task orders and teaming partners.
Fractional CISO
A part-time CISO for a services firm.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Our staff only work on government laptops. Do we still need CMMC?
Possibly. A government-owned laptop on a government network is the government's system, and Government Furnished Equipment you hold is documented as a Specialized Asset rather than assessed. But if your own email, Teams, laptops or file shares ever hold CUI or FCI for the contract, those systems carry the obligation. Most firms find CUI on their own systems somewhere, usually email.
We are a subcontractor. Does our prime's assessment cover us?
No. DFARS 252.204-7012 and 252.204-7021 both flow down to subcontractors that handle the information, and each company assesses its own systems. Your prime may ask for your SPRS score or CMMC status before it shares CUI with you on a task order.
Do we have to move the whole company to GCC High?
Not necessarily. The requirement is that a cloud service holding CUI meets security requirements equivalent to FedRAMP Moderate, and that your own systems holding CUI meet NIST SP 800-171. Many firms put only the people on CUI work into a separate environment. The right answer depends on your contracts, your data and your prime, and it should be written down with the reasoning.
Are resumes and staffing plans CUI?
Not usually on their own. Staffing plans submitted under a contract are typically Federal Contract Information, which brings FAR 52.204-21. Personnel information becomes CUI when the contract identifies it that way, so read the contract and ask the contracting officer if it is unclear.
Can you assess or certify us?
No. We are not an Authorized C3PAO and we do not certify anyone. We help you scope, document and prepare for whichever assessment your contract requires, starting with a gap assessment.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.