Pass the assessment. Keep the contract.
Machine shops, fabricators, coaters, calibration and test labs and other sub-tier suppliers holding a Department of Defense contract or subcontract, with nobody on staff whose job is cybersecurity.
What matters here
- Primes now send flow-down clauses and security questionnaires, and they check the answers.
- A blank or stale SPRS score, or a CMMC Level 2 clause in a new contract, can stop an award.
- Controlled unclassified information has to be marked, stored and sent in a defined way.
- DFARS 252.204-7012 gives you 72 hours to report an incident, so the plan has to exist before the incident.
What we set up in the first ninety days
Each item is written in plain words and becomes part of your documentation vault and evidence file.
Assessment and paperwork
- Gap assessment against NIST SP 800-171 for your contract’s actual level
- An SPRS score you can defend, submitted for you
- System Security Plan and Plan of Action written and kept current
- Policy set mapped to each control
Controlled data
- A defined enclave for controlled unclassified information
- Microsoft 365 GCC or GCC High when a prime requires it
- Encryption on every device that can hold contract data
- Access limited to named people, reviewed quarterly
Technical controls
- MFA everywhere, admin accounts separated
- InfraGuard on every server and workstation with retained logs
- Patch compliance reports for the evidence file
- Email and endpoint protection with alerting
Incident readiness
- Incident response plan built around the 72-hour clock
- Backups with offline copies, tested quarterly
- Yearly tabletop exercise with the owner and shop lead
- Evidence folder kept ready for a third-party assessor
Services for this industry, in order
Most start with the first three. The rest come up when the business grows or an audit does.
- Compliance & Cyber Insurance ReadinessGap assessment, SPRS score, SSP and POA&M, kept current as the rules move.
- CybersecurityThe 800-171 control set, implemented and documented.
- 24/7 Monitoring & Incident ResponseRetained logs and alerting the assessor will ask to see.
- Cloud & InfrastructureGCC High migration when a prime requires it.
- Business Continuity & Hurricane ReadinessBackups and the incident plan, exercised yearly.
- Training & WorkshopsStaff training on handling controlled data and phishing.
Where CRM-NG fits
One record per client, vendor and asset.
A CRM-NG Cloud workspace handles the business side: the people, companies, equipment, tickets and documents everyone keeps asking for. We will tell you plainly what should never go in it, and configure it so it cannot by accident.
Questions we get
Our SPRS score is blank. How fast can that change?
Two to four weeks for the assessment and a score you can stand behind. Remediation runs after that in priority order, technical controls first, paperwork alongside.
Do we have to move to GCC High?
Only if a prime or contract says so. Many sub-tier suppliers can meet Level 2 on commercial Microsoft 365 with the right configuration. We will tell you which case you are in.
Will you be there for the third-party assessment?
Yes. We prepare the evidence, sit in the assessment and answer the technical questions.
First call
Start with a 30-minute call. If it is a fit, we scope a gap assessment: two days on site, a scored result against your contract’s requirements and a plan ordered by risk.