Industries
Technology work for public sector organizations and contractors
Work in this sector is shaped by the contract. What your systems must do, who may touch them and what you have to be able to prove are written down before the project starts.
What makes this sector different
Contract clauses decide the technical requirements. Flow-down clauses in a prime contract or subcontract set security requirements, personnel requirements and reporting duties. The first job on any engagement here is reading what your contract actually requires, because that decides the scope.
CMMC is now a contract term rather than a plan. The Department of Defense rule amending the DFARS took effect on November 10, 2025, phasing CMMC requirements into solicitations through to November 10, 2028. For contractors handling controlled unclassified information, readiness work has a date attached to it.
Personnel requirements are part of delivery. Some roles require US citizenship and a favorable Public Trust determination. We recruit for those, and we are precise about what Public Trust is: a suitability determination for a position of trust under 5 CFR 731.106, not a security clearance.
Where the work usually is
-
Unclear CUI boundary
No agreed definition of which systems handle controlled unclassified information, which makes scope impossible to fix.
-
Documentation behind practice
Controls implemented but not described, or described but not implemented.
-
Shared services in scope
Email, identity and file sharing used by both in-scope and out-of-scope work.
-
Subcontractor flow-down
Requirements passed down with no way to confirm they are met.
-
Personnel requirements
Roles needing US citizens or a Public Trust determination, with a hiring timeline that ignores the process.
-
Legacy systems in scope
Systems that cannot meet a control, needing a documented alternative or a plan with a date.
Systems and platforms we work in
Platform names describe where our consultants have worked. They do not imply a vendor partnership or certification.
How we help
-
CMMC readiness
Scope definition, gap assessment against the practices, remediation plan and evidence preparation.
-
Security engineering
Implementing the controls: identity, logging, configuration baselines, segmentation and monitoring.
-
Penetration testing
Testing required by a contract, with authorization, scope and a retest.
-
Cloud and identity hardening
Account structure, access control, guardrails and logging that survives an incident.
-
Public Trust staffing
US citizens for federal contract roles designated Public Trust.
-
Specialist staffing
Engineers, analysts and project managers for contract-funded work.
Regulatory and contractual context
- The DFARS rule phasing in CMMC requirements took effect on November 10, 2025, with phased application through November 10, 2028.
- NIST SP 800-171 practices underpin the protection of controlled unclassified information in non-federal systems.
- FedRAMP authorization applies to cloud services used by federal agencies; using an authorized service is not the same as being authorized yourself.
- FAR and DFARS clauses in your contract, including flow-down to subcontractors, set the actual requirements.
- Section 508 accessibility requirements apply to information technology delivered to federal agencies.
- Public Trust positions are suitability determinations under 5 CFR 731.106; they are not security clearances.
Roles we recruit for this sector
Contract, contract-to-hire and direct hire. We do not sponsor visas: candidates must already be authorized to work in the United States.
Illustrative engagement
Illustrative scenario. Not a real client engagement. No outcomes are claimed.
A defense supplier has been told that CMMC requirements will appear in its next recompete and does not know which of its systems are in scope.
- Starting point
- Microsoft 365, a file server, an engineering environment and no agreed definition of where controlled unclassified information lives.
- Scope
- Define the boundary with the contracts team, assess the in-scope systems against the practices, and produce a remediation plan with owners, dates and the evidence each item will produce.
- Team
- A security consultant, an identity engineer and an analyst, working with the supplier’s IT lead and contracts manager.
- Deliverables
- A documented boundary, a gap assessment, a prioritized plan, and the system security plan and policy updates the plan depends on.
- What is not claimed
- We are not a CMMC third-party assessment organization and this is not an assessment. The scenario is illustrative.
Questions people ask
Are you a CMMC assessor?
No. We do readiness and engineering work: scope, gap assessment, remediation and evidence. A certified third-party assessment organization performs the assessment itself.
What is a Public Trust position?
A federal position of trust where the person must be a US citizen and pass a suitability determination made under 5 CFR 731.106. It is not a security clearance. See our Public Trust staffing page.
Do you sponsor visas for these roles?
No. We do not sponsor visas for any role. For roles that require it, we recruit US citizens.
Can you work as a subcontractor to a prime?
Yes. We work with primes under their contract and process. See partners for how that is set up.
Related
-
CMMC readiness
Help defense contractors scope CUI environments, close NIST SP 800-171 gaps and prepare evidence for a CMMC assessment.
-
Public Trust roles
We recruit and screen U.S. citizens for federal contract roles designated Public Trust.
-
Security engineering and implementation
Hands-on delivery of security controls and platforms: design, deploy, integrate, migrate, test and hand over.
-
Partners
Staffing suppliers, delivery firms, consulting partners, offshore teams and technology vendors: five ways to work with us.
Tell us which of these is you
I need a technology project delivered
Describe the system, the change and the timeline. A technical lead replies to talk about scope.
Discuss a projectI need to hire technical talent
Send the role, headcount and start date. A recruiter confirms the details before sourcing starts.
Request talentMy systems may be at risk
Ask for an assessment, a penetration test or help fixing findings. Under attack now? Call.
Speak with a security expert