Fractional CISO for defense research and development firms
A security lead for the lab that cannot hire one.
A part-time CISO working from inside your research firm: keeping the plan and POA&M current as projects open and close, and speaking to the program when a prime or the program office asks. Capital Cyber, based in Leesburg, Virginia, provides fractional CISO services for defense research and development firms and works on-site across Northern Virginia.
For research firms where the principal investigator is also the IT department.
Why does a research firm drift after its assessment?
Projects open and close on award cycles, a new instrument arrives, a rig goes out for calibration, a collaborator joins for one test campaign and leaves. Each of those changes what the SSP describes. In a team where everyone is doing the science, nobody notices until the next assessment.
What does a fractional CISO review in a lab?
Who holds accounts on the controlled project and whether they still should, new instruments and how they were categorized, equipment that left the building and how it was sanitized, which POA&M items moved, and what partners received. Each review is recorded: what was decided, by whom, and what changed.
Who answers the security questions from a prime or program office?
Someone who knows the program from the inside and has the documents to hand. That saves the principal investigator from rebuilding the answer between experiments.
Who signs the annual affirmation?
A senior official from your firm, under 32 CFR 170.22, affirming continuing compliance every year. A fractional CISO does not sign it for you. The role exists so that when your official signs, the program behind the signature has been actively run.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.3
Security Control Monitoring
Controls are checked on an ongoing basis across projects, instruments and partners. Evidence is the recorded review history.
PS.L2-3.9.2
Personnel Actions
When a researcher or collaborator leaves, their accounts and copies of controlled data are dealt with. Evidence is a completed leaver record for a real departure.
CM.L2-3.4.4
Security Impact Analysis
A new instrument, analysis tool or cloud service is assessed for security impact before it joins the environment. Evidence is the change record with the analysis.
RA.L2-3.11.1
Risk Assessments
Risk to the systems holding controlled data is reassessed as projects start and end. Evidence is a dated risk assessment that names the current projects.
What do you receive?
SCOPED PER CLIENTA security lead inside the firm
A part-time security and compliance lead working from inside your research firm.
Recorded reviews
What was decided, by whom, and what changed, for each review.
A current plan and POA&M
Kept current between assessments as projects, instruments and people change.
Someone to speak to the program
When a prime or an assessor asks about it.
What does this service not include?
We are not an Authorized C3PAO and we do not certify anyone. A fractional CISO is a part-time role we provide, not a full-time hire, and what we can commit to is our own accountability rather than what a third party will do.
The full service, for any industry: Fractional CISO. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Is a fractional CISO a full-time hire for our research firm?
No. It is a part-time role we provide, scoped per client: which reviews, how often, and what is already in place.
Does the fractional CISO sign our CMMC affirmation?
No. Under 32 CFR 170.22 the affirmation is made by a senior official from your own organization. The fractional CISO keeps the program behind that signature current.
What if our research firm has never had a gap assessment?
Then the role starts with one, so the plan the fractional CISO owns rests on a checked picture of the lab, instruments and partners rather than an assumption.
Are you a certifying body?
No. We are not an Authorized C3PAO and we do not certify anyone. What we commit to is our own accountability inside the role.
More for defense research and development firms
Fractional CISO in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.