Fractional CISO for government IT and services contractors
A part-time CISO for a services firm.
Services firms are often asked about security by primes and government customers long before they have someone whose job it is to answer. A fractional CISO is that person, part-time, from inside the business. Capital Cyber, based in Leesburg, Virginia, provides fractional CISO services for government IT and services contractors and works on-site across Northern Virginia.
For IT and services contractors whose security questions currently land on the CEO or the IT lead by default.
Who answers when the prime asks about your security program?
In most small services firms, the CEO or whoever runs IT. Neither has time to keep the SSP current, follow every new task order's clauses, and run the reviews that keep a program honest. So the answers drift, and the annual affirmation gets signed on trust.
A fractional CISO owns that work part-time. The role keeps the plan and the POA&M current, chairs recorded reviews where decisions get made, and speaks to the program when a prime, a government customer or an assessor asks.
What does the role review in a services firm?
The things that change most: new task orders and what they bring, staff joining and leaving contracts, new teaming partners and shared workspaces, devices added for remote staff, and changes in the Microsoft 365 tenant. Each one can move the boundary, and the review is where someone decides whether it did.
Each review is recorded: what was decided, by whom, and what changed. That record is useful evidence on its own, and it is what lets the person signing the affirmation sign it on something more than memory.
How does this fit with an MSP that already runs our IT?
Your MSP runs the systems. The fractional CISO owns the program those systems are part of. That includes knowing what the MSP's tools and people contribute to the boundary, since they count as Security Protection Assets, and making sure the SSP says so.
The two roles work together, but they are not the same job. An MSP can tell you a patch was applied; the program owner decides whether the patch cadence meets what your SSP says.
What does a typical month look like?
Picture a twenty-person engineering services firm that just won a new task order with marked deliverables. The fractional CISO reads the clauses, checks whether the people on it are already inside the boundary, updates the SSP and the CUI flow, adds anything new to the POA&M, and records the decision in that month's review. When the prime asks for an update, the answer already exists.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.3
Security Control Monitoring
Ongoing monitoring of whether controls still work as task orders, staff and systems change. Evidence is the recorded reviews and the follow-up actions that came out of them.
RA.L2-3.11.1
Risk Assessments
A periodic risk assessment covering remote staff, teaming partners and the systems holding CUI. Evidence is the dated assessment and what changed because of it.
CA.L2-3.12.1
Security Control Assessment
Checking periodically whether the controls in the SSP are effective, not just present. Evidence is the assessment record and the POA&M entries it produced.
PS.L2-3.9.2
Personnel Actions
Consultants rolling off a contract or leaving the firm lose access to CUI promptly. Evidence is offboarding records matched against account disable dates.
What do you receive?
SCOPED PER CLIENTA security and compliance lead inside the business
Part-time, owning the CMMC program across your task orders.
Recorded reviews
What was decided, by whom, and what changed, as contracts, people and systems change.
The plan and POA&M kept current
Between assessments, not just before them.
Someone to speak to the program
When a prime, a government customer or an assessor asks about it.
What does this service not include?
We are not an Authorized C3PAO and we do not certify anyone. A fractional CISO is a part-time role we provide, not a full-time hire, and what we can commit to is our own accountability rather than what a third party will do.
The full service, for any industry: Fractional CISO. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Is a fractional CISO a full-time hire?
No. It is a part-time role we provide. The shape of the role, which reviews and how often, is agreed on a scoping call and scoped per client.
Will the fractional CISO sign our annual affirmation?
No. The affirmation is signed by your own senior official. The role keeps the program current and the reviews recorded so that the person signing has something real to rely on.
We have never had a gap assessment. Can we start here?
Yes. If there is no recent gap assessment, the role starts with one, so the program is built on what is actually in place.
Will our prime accept the answers the fractional CISO gives?
No. What we commit to is our own accountability for the program and accurate answers about it. What a prime decides is up to the prime.
More for government IT and services contractors
Fractional CISO in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.