CMMC Level 2 program leadership
Run the CMMC program without stopping the experiments.
Defense research and development firms
CMMC for the lab that runs on a small team.
Your CUI is the test data, the technical report and the specification you are working toward. We help small defense research firms scope the lab honestly and document it for whichever assessment your contract requires. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for defense research and development firms and works on-site across Northern Virginia.
For small R&D, test and evaluation, and SBIR or STTR firms doing DoD-funded work.
Where does CUI show up?
CUI AND FCITest and measurement data
Raw captures from instruments, processed results, calibration runs and the scripts that produced them. The DFARS clause lists research and engineering data and data sets as examples of technical information.
Technical reports and deliverables
Interim and final reports, test plans and test reports, briefing slides for program reviews. If the government marks them or identifies them as controlled in the contract, or you develop them in performance of it, they can be covered defense information.
Specifications and interface documents
The requirement documents, interface control documents and threat or environment descriptions a program office sends you so you know what to build or test against.
Design files and source code
Prototype hardware designs, firmware, analysis code and simulation models. The DFARS definition of technical information includes computer software executable code and source code.
Contract information
The award itself, statements of work, schedules and correspondence with the program office. That is Federal Contract Information at minimum, even on a project that carries no CUI.
Where does scoping get hard?
SCOPINGInstruments and test equipment
Oscilloscopes, spectrum analyzers, power meters and special test equipment are a named Specialized Asset type in the CMMC scoping rule. They go in the inventory, the SSP and the diagram, and are reviewed through the SSP rather than assessed against every requirement.
The data acquisition PC
The workstation bolted to the test rig is often an ordinary Windows machine that also holds the results. Whether you treat it as part of the test equipment or as a CUI Asset is a decision you write down and can defend.
Funded and unfunded work on one network
A firm with one controlled program, one fundamental research project and its own internal work often runs all three on the same file share. Separating them is what keeps the assessment scope proportionate.
University and partner collaborators
A professor's lab or a partner firm that receives your test data is part of the CUI flow. The clauses flow to them, or the controlled data does not.
Everyone is an administrator
In a team of a handful of researchers, the principal investigator often installs software, manages accounts and runs experiments from one login. Several requirements expect those roles to be separated.
Is fundamental research outside of all this?
Only if it has been determined to be fundamental research, and only for that project. Where DFARS 252.204-7000 is in your contract, the exception for fundamental research applies to a project that involves no covered defense information and that the contracting officer has determined, in writing, to be fundamental research. The clause says that by definition fundamental research cannot involve covered defense information.
So the answer is project by project, and it comes from the contract, not from how the work feels. Keep the written determination with the project file. If you have one controlled project and one fundamental research project, the controlled one still brings NIST SP 800-171 with it.
Can you publish results from a defense contract?
Read DFARS 252.204-7000 if it is in your contract. It says you may not release unclassified information about the contract outside your organization unless the contracting officer has given prior written approval, the information is already public, or the fundamental research exception above applies. Requests go to the contracting officer at least 10 business days before the planned release, and subcontractors route theirs through the prime.
For a research firm that means papers, conference talks and posters need a step in the plan. That is a contract question for your counsel and the contracting officer, not a security control, but it sits next to the security program because both decide where your results can go.
How does a small team meet controls written for bigger ones?
By being honest in the SSP about who does what, and by using separate accounts even when one person holds several roles. A researcher who is also the administrator uses an ordinary account for experiments and email and a separate privileged account for installs and account changes. The requirements are about the accounts and the logs, not about headcount.
What does an assessor look at in a lab?
The inventory of instruments and how each is categorized, the data acquisition machines and where their results go, the USB sticks that carry captures from an isolated rig, what happens to an instrument's storage when it goes out for calibration, and how test data reaches a university partner. They will read the SSP closely for the Specialized Assets, because that is how those assets are assessed.
Which clauses will you see?
DFARS AND FARDFARS 252.204-7012
Protect covered defense information, including test data, reports and source code, with NIST SP 800-171, report cyber incidents within 72 hours, use cloud services that meet FedRAMP Moderate equivalent requirements, and flow the clause to partners whose work involves that information.
DFARS 252.204-7000
Get the contracting officer's prior written approval before releasing unclassified information about the contract outside your organization, unless an exception applies, including a written fundamental research determination for a project with no covered defense information.
DFARS 252.204-7019 and 252.204-7020
Have a current NIST SP 800-171 assessment for each system relevant to the award, posted in SPRS, and give DoD access if it decides to run a Medium or High assessment.
DFARS 252.204-7021
Meet the CMMC status the contract names, keep it current, and flow it to subcontractors and partners who will process, store or transmit FCI or CUI.
FAR 52.204-21
Basic safeguards for Federal Contract Information on the systems that hold your award, statements of work and program correspondence.
What can we do for defense research and development firms?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
An SSP that tells the truth about a small lab.
CUI enclave design
Keep the controlled project apart from the rest of the lab.
Supply Chain Risk Management
Your university partner is part of your CUI flow.
Fractional CISO
A security lead for the lab that cannot hire one.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Is test data from a DoD-funded project CUI?
It can be. DFARS 252.204-7012 covers controlled technical information that is marked or identified in the contract, or developed in support of performing it, and lists research and engineering data and data sets as examples of technical information. Check the contract and the markings, and ask the contracting officer in writing where it is unclear.
Do our lab instruments need to meet all 110 requirements?
Not if they are Specialized Assets. Test equipment such as oscilloscopes and spectrum analyzers is a named Specialized Asset type. It must be in the asset inventory, the SSP and the network diagram, and is reviewed through the SSP rather than assessed against the other requirements.
Does a fundamental research project need NIST SP 800-171?
Under DFARS 252.204-7000, fundamental research is a written determination by the contracting officer for a project involving no covered defense information. A project with that determination is treated differently. A project without one is handled under its contract clauses.
Can a university partner receive our controlled test data?
Only if the clauses flow to them and their systems meet NIST SP 800-171 for that data. Otherwise, keep the controlled data in your environment and share only what is not controlled. Your counsel should review the agreement.
Do you work with small research firms in Northern Virginia?
Yes. Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia. We are not an Authorized C3PAO and do not perform certification assessments.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.