Scope before scale
The first conversation is almost always about narrowing scope, because scope governs the cost of everything downstream. We will tell you when a smaller engagement is the right answer, including when that means less work for us.
About
Who we are
A cybersecurity consultancy in Boulder, Colorado, working mostly with organizations that have to prove their security posture to somebody else.
Most of our clients come to us because of an obligation rather than a worry. A contract clause, a prime's flow-down requirement, a customer questionnaire, an upcoming assessment. Somebody needs to see evidence, and the evidence does not exist yet.
That shapes how we work. Security advice that is technically correct but produces nothing an assessor will accept is not much use in this situation, and neither is documentation that satisfies an auditor while leaving the environment genuinely exposed. The work has to do both jobs, and the people doing it need to understand the regulatory context as well as the technology.
We are a small team by design. Engagements are staffed by the people you meet during scoping, not handed to whoever is available once the contract is signed.
- Location
- Boulder, CO
- Registry
- Registered Provider Organization, The Cyber AB. RPO-3217
- Compliance leads
- Certified CMMC Professional and Certified CMMC Assessor credentials
- Sectors
- Defense, space, research, healthcare, commercial
Recent engagements
What the work has looked like
Described by sector rather than by name. We do not publish a client's identity without their agreement in writing.
-
CMMC
Native Alaskan conglomerate
Multiple subsidiaries supporting DoD and NASA contracts, each needing to adopt NIST SP 800-171 without duplicating the work across every operating company.
-
CMMC
Multi-national engineering firm
Approached by DIBCAC for a non-voluntary DFARS 252.204-7012 and NIST SP 800-171 conformity assessment, with no say in the timing.
-
CMMC
Research university
Preparing ahead of the CMMC requirement reaching its contracts, across a decentralised environment where scope was the first problem to solve.
-
CMMC
Mid-sized space business
Preparing ahead of the CMMC requirement reaching its contracts, while continuing to deliver on existing programs.
How we operate
Four things we do differently enough to mention
Current information, sourced
Regulatory guidance on this site carries a review date and links to primary sources. The rules governing our clients have changed materially several times in the past two years, and confidently stated stale advice is worse than none.
Independent of your assessor
We get you ready and we have no stake in the result, which means nothing we advise is shaped by wanting the assessment work as well. Several frameworks restrict firms from doing both for exactly that reason. When you are ready to be assessed, we can point you at assessors we trust.
Evidence, not assurance
Every engagement produces artifacts (findings, documentation, evidence packages) that you can hand to an assessor, a prime, or a customer directly. A verbal assurance that things look fine is not a deliverable.
Want to talk to someone who does the work?
Scoping conversations are with practitioners, not account managers.