Arlington, Virginia
When your CUI is a document, not a part.
Controlled Unclassified Information is not always a shop drawing. When it is a technical report or a proposal, the same 110 controls still apply, and the evidence you have to produce looks different.
DARPA is headquartered at 675 North Randolph Street in Arlington. Its Small Business Programs Office exists, in its own words, to develop relationships with U.S. small businesses to help them take advantage of opportunities with DARPA
, through SBIR and STTR awards among other routes.DARPA's own words for who it is trying to reach are small businesses, which is the same population the 110 controls land on hardest.
If your CUI is a document rather than a part
A research performer usually finds its Controlled Unclassified Information in the places people forget to look: the proposal, the interim technical report, the design review deck, the email thread where a program manager asked a question and someone answered it with a drawing attached. Scoping that is the first real work of a gap assessment, and it is where a small firm most often discovers the boundary is wider than it assumed.
Whether Level 2 applies at all is decided by your contract, not by us and not by your zip code. If a clause flows Controlled Unclassified Information down to you, the 110 controls follow. If it does not, we will say so.
What we do and do not touch
We assess CMMC Level 2 against NIST SP 800-171, on unclassified systems that handle Controlled Unclassified Information. That is the work. We are not an Authorized C3PAO, we do not certify anyone, and nothing on this site should be read as a claim about classified environments or about any relationship with an agency named here.
Case Study: Iron Lift
IRON LIFTIron Lift, our named CMMC Level 2 case study, is a construction company in Massachusetts. Read it on Case Studies, or see the managed program on CMMC In A Container™. Also nearby: Chantilly, Fairfax County, Loudoun County and Prince William County, or the full list on Locations.
Already know you want to talk?
BOOK A CALLSkip the form. Pick a time and talk to us directly.
What happens in 30 minutes
- We read your contract's CMMC and DFARS clauses with you.
- We confirm which level applies and how it will be assessed.
- We tell you the first step, whether or not it involves us. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 controls against your real environment, on-site in Arlington when it matters. You keep the findings, your SPRS score and a broad POA&M, written for your environment, whether or not you carry on with us.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the gap assessment itself, not cash. It costs you nothing, and you are under no obligation to buy anything afterward, from us or from anyone.