Fairfax County, Virginia
The defense contracting hub next door.
Fairfax County is Virginia's most populous county. We work with Fairfax County defense suppliers on-site from Leesburg, one county over.
The National Geospatial-Intelligence Agency's headquarters, NGA Campus East, sits on Fort Belvoir North in Springfield, inside Fairfax County. Authorized in the 2005 BRAC round and completed in September 2011, it is described by the Army Corps of Engineers as the largest Department of Defense facility built since the Pentagon. The same DFARS clause that applies to a prime working that campus applies to the small subcontractor serving it.
Why we work in Fairfax County
A gap assessment is easier to do right in person: seeing where hardware actually sits, who actually has a badge, how a visitor is actually logged. We drive into Fairfax County for that rather than trying to reconstruct it over a call. Being one county away keeps the travel time out of what you pay for.
If a prime just sent you a clause
DFARS 252.204-7012The clause is called Safeguarding Covered Defense Information and Cyber Incident Reporting, and paragraph (m) is the part that catches people. It requires the prime to put the same clause into any subcontract whose performance involves covered defense information, in its own words without alteration, except to identify the parties
. Not a summary of it, not a lighter version for smaller firms. The obligations that landed on a company with a compliance department are the obligations that land on you.
That is usually the moment someone goes looking for help, and it is a bad moment to start from scratch, because evidence takes calendar time that a contract date does not give back. A gap assessment tells you which of the 110 controls you already meet, which you do not, and in what order to close them. If your answer is further along than you think, we will say so and the engagement is shorter.
What we do and do not touch
We assess CMMC Level 2 against NIST SP 800-171, on unclassified systems that handle Controlled Unclassified Information. That is the work. We are not an Authorized C3PAO, we do not certify anyone, and nothing on this site should be read as a claim about classified environments.
If your scope is genuinely more complicated than a gap assessment, we will tell you that in the first conversation rather than after invoicing you for one.
Case Study: Iron Lift
IRON LIFTIron Lift, our named CMMC Level 2 case study, is a construction company in Massachusetts. Read the full story on Case Studies, or see the full managed program on CMMC In A Container™. Also nearby: Chantilly, Loudoun County, Prince William County and Arlington, or the full list on Locations.
Already know you want to talk?
BOOK A CALLSkip the form. Pick a time and talk to us directly.
What happens in 30 minutes
- We read your contract's CMMC and DFARS clauses with you.
- We confirm which level applies and how it will be assessed.
- We tell you the first step, whether or not it involves us. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 controls against your real environment, on-site in Fairfax County when it matters. You keep the findings, your SPRS score and a broad POA&M, written for your environment, whether or not you carry on with us.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the gap assessment itself, not cash. It costs you nothing, and you are under no obligation to buy anything afterward, from us or from anyone.