Alexandria, Virginia
Your people badge in. Your laptops go home.
Capital Cyber takes small and mid-sized defense contractors in Alexandria through CMMC Level 2, on-site. Staff who work inside a government building still send email, save files and carry laptops on company systems, and company systems that handle CUI are what Level 2 assesses.
The Mark Center is, in the words of its own visitor sheet, a Department of Defense facility secured by the Pentagon Force Protection Agency
. The same sheet says a sponsor for visitors can be a DoD employee or contractor with an active DoD Common Access Card
. Contractors work inside the building, which raises the question this page answers.
Does working on a government site put you out of scope?
Not for your own systems. Work done on government-run systems inside the building is the government's to protect. Everything on your side is yours: the draft deliverable on a company laptop, the report sent from company email, the shared drive back at the office, the phone that syncs all three. If any of those stores, processes or transmits CUI, it is inside your Level 2 boundary, and drawing that line is the first real work of a gap assessment.
Whether Level 2 applies at all is decided by your contract, not by us and not by your zip code. If a clause flows Controlled Unclassified Information down to you, the 110 controls follow. If it does not, we will say so.
What we do and do not touch
We assess CMMC Level 2 against NIST SP 800-171, on unclassified systems that handle Controlled Unclassified Information. That is the work. We are not an Authorized C3PAO, we do not certify anyone, and nothing on this site should be read as a claim about classified environments or about any relationship with an agency named here.
Case Study: Iron Lift
IRON LIFTIron Lift, our named CMMC Level 2 case study, is a construction company in Massachusetts. Read it on Case Studies, or see the managed program on CMMC In A Container™. Also nearby: Loudoun County, Fairfax County, Chantilly, Arlington, Prince William County, Stafford County and Dahlgren, or the full list on Locations.
Already know you want to talk?
BOOK A CALLSkip the form. Pick a time and talk to us directly.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 controls against your real environment, on-site in Alexandria when it matters. You keep the findings, your SPRS score and a broad POA&M, written for your environment, whether or not you carry on with us.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.