DEFENSE AND GOVERNMENT
Ten years executing cybersecurity compliance inside the intelligence community, with ATOs achieved across unclassified, Secret and Top Secret networks.
Government program offices and defense contractors have different problems. Pick the one that describes you.
GOVERNMENT PROGRAM OFFICES
RMF support across Impact Levels 1 through 6, evidence capture for the authorising official, and continuous compliance so the next cycle is a review rather than a rebuild. Buyable directly through our GSA Schedule.
DEFENSE CONTRACTORS
CMMC Level 2 readiness, NIST SP 800-171 self assessment and SPRS scoring, STIG conduct, and the System Security Plan that carries a C3PAO assessment.
FOR GOVERNMENT PROGRAM OFFICES
We work with internal government teams and outside agencies to identify control requirements, produce the documentation, and capture the evidence an authorising official needs to sign.
Testing and remediation against the standards an assessor will actually use, delivered as checklists rather than narrative.
An ATO is a start date, not a finish line. Our support services help mission owners hold authorisation on an ongoing basis rather than rebuilding the package each cycle.
Ten years inside the intelligence community, with applications safeguarded across traditional server, virtual and cloud environments.
| Customer | Scope |
|---|---|
| NAVSEA STR | Application security support, RMF, and ATO support |
| Navy SSP | Application security support, RMF, and ATO support |
ATOs achieved on unclassified, Secret and Top Secret networks. Detailed past performance available on request.
FOR DEFENSE CONTRACTORS
No assessment, no award. We scope the enclave, close the practices that reliably fail, and author the System Security Plan that carries the C3PAO assessment.
The obligation exists whether or not a CMMC assessment has been scheduled. If a DFARS clause applies, you owe a current self assessment score in SPRS.
Where the goal is to host on a DoD system, the penetration test is one artifact in a much larger package. We prepare the whole thing at the impact level you actually need.
CMMC engagements · NIST SP 800-171 · Application security and STIG
Assessments are scoped as a single fixed price deliverable with a two to four week period of performance, no option years and no follow on obligation. That shape fits inside simplified acquisition procedures, and at the low end within the government purchase card threshold.
We hold a GSA Schedule contract, so agencies can buy directly without running a new competition.
For contracting and sources sought enquiries, email govcon@bluesteelcyber.com directly. For a scoping conversation, the calendar is below.
