CMMC Level 2 program leadership for defense research and development firms
Run the CMMC program without stopping the experiments.
We run the CMMC Level 2 program for small defense research firms from first assessment through to whichever assessment your contract requires, so the researchers keep researching. Capital Cyber, based in Leesburg, Virginia, provides CMMC Level 2 program leadership for defense research and development firms and works on-site across Northern Virginia.
For small R&D firms with a Level 2 requirement and no one whose job it is to run the program.
Where does a research firm's program usually stall?
At scoping. A lab has instruments, rigs, data acquisition machines, shared analysis servers, laptops that travel to test sites and a file share that holds every project at once. Until someone decides which of those are CUI Assets, which are Specialized Assets and which are out, nobody can say how big the job is.
What gets fixed first in a lab?
The things that shrink scope: separating controlled projects from fundamental research and internal work, deciding where controlled test data lands after capture, and settling how a university or partner receives it. Configuration work on each machine comes after the boundary, so it is only done once.
How do you keep remediation from interrupting tests?
Changes to a data acquisition machine or an instrument's network connection are planned with the person who runs the rig and scheduled between test campaigns. A rig that has been validated for a test is not reconfigured the week before it runs.
What does the evidence package look like for a lab?
Organized control by control: the asset inventory with each instrument's category, the SSP sections that describe how Specialized Assets are managed, account lists showing separate privileged accounts, removable media records, calibration and maintenance records for equipment that left the building, and the flow-down documents for partners.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.6
Non-Privileged Account Use
The researcher who is also the administrator runs experiments and reads email from an ordinary account. Evidence is the account list and a sign-in log showing the split.
MP.L2-3.8.7
Removable Media
USB drives that carry captures off an isolated rig are controlled and issued, not personal. Evidence is the policy, the device control setting and the media log.
CM.L2-3.4.1
System Baselining
An inventory that includes instruments and data acquisition machines, each with a category and a baseline. Evidence is the inventory and a recorded baseline for each machine.
CA.L2-3.12.2
Plan of Action
Open items such as rig workstation patching or partner flow-down, tracked with owners and target dates so the program has a visible order.
What do you receive?
SCOPED PER CLIENTA written CUI boundary
Which instruments, machines and shares handle controlled test data, written down.
A remediation sequence
In the order that protects your test schedule, with evidence collection started early.
An evidence package
Organized control by control for your assessment, including the Specialized Asset documentation.
Support through the assessment
Preparation for whichever assessment your contract requires. We do not perform the assessment itself.
A gap assessment to start
The program starts with a gap assessment, or from the findings of a recent one if you have it.
What does this service not include?
We prepare you for the assessment; we do not perform it, and a self-assessment does not produce a certification. Whether we attend a C3PAO assessment is between you and the C3PAO, and we are not an Authorized C3PAO ourselves.
The full service, for any industry: CMMC Level 2 program leadership. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Will CMMC remediation interrupt our test campaigns?
It should not. In a research firm, changes to rigs, instruments and data acquisition machines are planned with the people who run them and scheduled between test campaigns.
Do you perform our CMMC assessment?
No. Program leadership prepares a research firm for whichever assessment its contract requires, self-assessment or certification. We are not an Authorized C3PAO and do not perform certification assessments.
How does a program for an R&D firm start?
With a gap assessment of the lab and office systems that hold controlled data, which is $5,000 one time for most small and mid-sized contractors. If you already have a recent gap assessment, the program starts from its findings.
Does every project in the lab have to be in scope?
No. Controlled projects bring NIST SP 800-171 with them. Projects with a written fundamental research determination and purely internal work can be kept apart, and keeping them apart is part of the scoping work.
More for defense research and development firms
CMMC Level 2 program leadership in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.