CMMC Level 2 program leadership for government IT and services contractors
One CMMC program across every task order.
Services firms collect contracts one task order at a time, each with its own data. We run the program that sorts out which ones bring CUI, scopes the boundary around them, and prepares you for whichever assessment your contract requires. Capital Cyber, based in Leesburg, Virginia, provides CMMC Level 2 program leadership for government IT and services contractors and works on-site across Northern Virginia.
For IT and services contractors with a Level 2 requirement and nobody whose job it is to run the program.
Why does the program start with a contract inventory?
A services firm rarely has one contract. It has a prime contract, several task orders under it, a couple of subcontracts with other primes, and teaming agreements on proposals. Each one says something different about FCI and CUI, and some say nothing at all until a marked document arrives.
So the first job after the gap assessment is a list: every active vehicle, what information it brings, which clauses it carries, and which of your people work on it. That list decides the boundary. Without it, the boundary is a guess, and guesses in this industry usually end up as the whole company.
What gets fixed first?
The things that move CUI outside any boundary you could defend. In services firms that is usually email forwarding to personal accounts, Teams and OneDrive on unmanaged phones, external sharing left open on SharePoint, and laptops without full disk encryption. Those come before policy polish because every day they stay open, more CUI spreads to places you will have to account for.
After that, the sequence follows the requirements that need history before an assessor will accept them: audit logging and its review, vulnerability scanning, training records and access reviews. Those start early because they cannot be produced the week before.
How do remote staff change the evidence?
When consultants work from home and from customer sites, the evidence has to cover them too. Assessors look for how remote sessions are controlled and encrypted, how alternate work sites are protected, and how you know a laptop that left the office is still configured the way your baseline says.
That evidence comes from device management and identity logs rather than from walking a server room, so it has to be collected and kept on purpose. We organize it control by control so it is ready when the assessment comes.
What happens with teaming partners during the program?
A shared workspace with a teaming partner is a CUI flow, and it needs a decision: whose environment hosts it, who can reach it, and how that is evidenced. The program handles that as part of the boundary rather than leaving it to whoever created the Teams channel.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
Shows up as mail flow rules, external sharing settings in SharePoint and OneDrive, and data loss prevention policies that stop marked files leaving the tenant. Evidence is the configured rules plus a test showing a marked file being blocked or flagged.
AC.L2-3.1.12
Control Remote Access
Consultants connecting from home and customer sites. Evidence is the remote access method, the policy that governs it, and session logs showing remote connections are monitored, not just allowed.
AU.L2-3.3.1
System Auditing
Sign-in and audit logs from your identity platform and endpoints, retained long enough to investigate an incident. Assessors want to see the retention setting and a sample of logs from weeks ago, not today.
AT.L2-3.2.1
Role-Based Risk Awareness
Training that covers how CUI arrives from the government customer and the prime, how to recognize markings, and what to do with a marked file sent to the wrong person. Evidence is training records per person, with dates.
What do you receive?
SCOPED PER CLIENTA scoped CUI boundary, written down
Built from your contract and task order list: which work brings CUI, which people and systems handle it, and what stays outside.
A remediation sequence
In the order that protects your calendar, starting with the paths CUI is already leaking through and the requirements that need history.
Evidence collection started early
Logging, scanning, training and access review records gathered from the start, including for remote staff.
An evidence package organized control by control
Ready for whichever assessment your contract requires.
Support through the assessment
We prepare you for it and support you through it. We do not perform it.
What does this service not include?
We prepare you for the assessment; we do not perform it, and a self-assessment does not produce a certification. Whether we attend a C3PAO assessment is between you and the C3PAO, and we are not an Authorized C3PAO ourselves.
The full service, for any industry: CMMC Level 2 program leadership. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Where does program leadership start for a services firm?
With a gap assessment, the $5,000 published one if you do not have a recent one. If you already have recent findings, the program starts from them, beginning with an inventory of your contracts and task orders and what information each brings.
Can the program cover only the task orders that bring CUI?
That is often the aim. If CUI can be kept to a defined set of people and systems, the boundary is drawn around them and the rest of the business is documented as outside it, with the reasoning written down.
Will you conduct our CMMC assessment?
No. We are not an Authorized C3PAO. Program leadership prepares you for whichever assessment your contract requires and supports you through it. A self-assessment does not produce a certification.
What if we win a new task order halfway through the program?
It goes through the same check: what information it brings, which clauses it carries, and whether it changes the boundary. If it stays inside the existing boundary, the documents are updated. If it does not, the scope is revisited before the work starts.
More for government IT and services contractors
CMMC Level 2 program leadership in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.