Cybersecurity for Government Contractors
Defense and federal contracting now comes with a security condition attached to the award. CMMC 2.0 Phase I is in contracts, controlled unclassified information has to be handled inside a defined boundary, and a self-assessment score submitted years ago may not survive a government-led assessment. On July 13, 2026 the Department of War suspended Phase II, so third-party certification is on hold, but Phase I self-assessments and DFARS 252.204-7012 still apply. The rules are written for large primes and land on small subcontractors with one IT person or none. NetSys provides IT services for government contractors that implement the NIST SP 800-171 controls inside an enclave you can defend, with the system security plan and evidence a reviewer will read.
The short answer
NetSys provides cybersecurity for government contractors and subcontractors: NIST SP 800-171 controls built into a defined CUI enclave, a system security plan written from what is actually running, and evidence for the self-assessments CMMC Phase 1 requires. DFARS 252.204-7012 incident reporting is planned in advance. We are not a C3PAO, and agreements run month to month.
Sound familiar?
- A self-assessment score submitted from memory that would not survive an assessor's questions
- Controlled unclassified information in email, on home laptops and in a file share the whole company can reach
- A prime contractor's flow-down letter with a deadline and no one assigned to it
- Uncertainty about whether the company needs GCC High, and vendors happy to sell it either way
- A system security plan copied from a template that describes a company other than yours
- No logs, no retention and no way to show what happened when an assessor asks
What we deliver for government contractors
Scope First: The CUI Enclave
- A data flow exercise that finds where CUI arrives, lives and leaves
- An enclave in Microsoft 365 built for CUI, in GCC High where export-controlled data or contract terms require it
- The rest of the business kept outside the boundary so the assessment covers what it must and no more
- Devices, accounts and network segments assigned to the enclave and documented
NIST SP 800-171 Controls, Implemented
- Multifactor authentication, conditional access and device management on every account and device touching CUI
- Privileged access management so administrator rights are granted per task and logged
- Endpoint detection, encryption and media controls applied inside the boundary
- Logging and audit records retained and reviewed, with monitoring around the clock
The Documents an Assessor Reads
- System security plan written for your environment, control by control
- Plan of action and milestones with owners and dates, closed out as work lands
- Policies and procedures that match what the systems do
- Evidence organized for a Level 2 self-assessment, a government-led assessment or a prime's review
Incident Reporting and Continuity
- Incident response procedures aligned to DFARS reporting timelines and your prime's requirements
- Immutable backups inside the boundary, with restores performed and timed
- Disaster recovery planning that keeps CUI protected during recovery
- Help desk and monitoring for the whole company, enclave and not
Contractor cybersecurity rules and where CMMC stands
The duties come from the clauses in your contracts. As of September 2026 CMMC is paused in Phase 1, so self-assessment is what contracts can require, while the underlying safeguarding and reporting clauses apply in full. Your contracts manager or counsel reads the clauses; we implement and evidence the controls.
CMMC status (32 CFR Part 170)
On July 13, 2026 the Department of War (DoD) suspended CMMC Phase II, which had been due November 10, 2026, and kept all Phase I self-assessment requirements. Level 1 is an annual self-assessment and affirmation against FAR 52.204-21; Level 2 is a self-assessment every three years, with annual affirmation, against the 110 requirements of NIST SP 800-171 Rev 2.
Federal contract information (FAR 52.204-21)
Any contractor whose systems hold federal contract information applies 15 basic safeguarding requirements, including access limited to authorized users, malware protection kept current and scans of files from outside sources, and flows the clause to its subcontractors.
CUI and incident reporting (DFARS 252.204-7012)
Covered defense information is protected with NIST SP 800-171, cyber incidents are reported to DoD at dibnet.dod.mil within 72 hours of discovery using a DoD-approved medium assurance certificate, and images of affected systems are preserved for at least 90 days. The CMMC pause changes none of this.
SPRS assessment score (DFARS 252.204-7019 and 7020)
To be considered for award where NIST SP 800-171 applies, a contractor needs a current assessment, not more than three years old, with its summary score posted in the Supplier Performance Risk System. The score should describe systems that exist.
This is general information, not legal advice. Confirm your obligations with counsel.
Contractor platforms we support around
Defense and federal contractors typically combine a government cloud tenant, a project-accounting ERP and secure exchange tools for controlled information. We manage the devices, identities, enclave boundaries and logs around them and coordinate with each vendor.
- Microsoft 365 GCC High
- Deltek Costpoint
- Unanet
- PreVeil
- Exostar
Product names are their owners’ trademarks. We manage the devices, accounts and access around these applications and work with each vendor’s support. A listing here doesn’t mean we resell an application or partner with its maker.
IT services for a government contractor facing a CMMC Level 2 flow-down
The specific engagements behind this profile are under NDA, so it is written as a generalization rather than a named client. Our published, client-approved outcomes are in case studies.
An engineering services subcontractor with a few dozen employees had submitted a self-assessment score years earlier based on a quick reading of the requirements. A prime's letter arrived stating that CMMC Level 2 would be required at the next option period. Drawings marked as controlled arrived by email and were saved to a company-wide file share. Several engineers worked from personal laptops. The system security plan was a template with the company name replaced.
- A data flow review that traced every path CUI took into and out of the company, which was fewer than feared and more than anyone had listed
- A CUI enclave built in Microsoft 365 GCC High, with the engineers who handle controlled drawings moved into it on managed, encrypted devices
- Multifactor authentication, conditional access, privileged access management and endpoint detection applied inside the boundary, with logs retained
- A system security plan written control by control from what was implemented, and a plan of action with dated milestones for what was not yet
- A mock assessment against the Level 2 practices, with the findings folded back into the plan before any outside review
The intended result is a score that describes systems that exist, controlled drawings inside a boundary that can be shown on one page, a dated plan for the prime, and engineers outside the enclave who keep working the way they always have.
Work we have done for clients in related fields
- Manufacturing
Large manufacturing plant in Virginia
Password management for 125 employees, management of 160 computers, and managed EDR antivirus across production and office devices.
- Manufacturing
Precision machining company recovering from ransomware
Recovery and restoration of 3 servers and 45 workstations, followed by EDR deployment and immutable backup implementation.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
Government Contractors IT FAQs
Do you provide IT services for government contractors that are small subcontractors?
Yes. Most of this practice is subcontractors with somewhere between a handful and a hundred employees who received a flow-down requirement and have no security staff. The agreement covers the CMMC work and the ordinary IT of the whole company: help desk, monitoring, devices, backups and disaster recovery. A small firm gets a dedicated account manager rather than a ticket queue.
What is CMMC 2.0 and when does it apply?
CMMC 2.0 is the Defense Department program that checks contractors protect federal contract information and controlled unclassified information. On July 13, 2026 the Department of War suspended Phase II, so both levels use self-assessment: Level 1 annually against FAR 52.204-21, Level 2 every three years against NIST SP 800-171 Revision 2. DFARS 252.204-7012 still applies.
What is GCC High, and do we need it?
GCC High is Microsoft's version of Microsoft 365 for the defense industrial base: run in United States data centers, operated by screened United States personnel and built to meet the government's higher cloud standards. Contractors handling export-controlled data, or whose contracts specify it, generally need it. Others can meet the requirements in a properly configured commercial or government tenant. We look at your data and your contract clauses before recommending either, because moving without a reason costs money and moving too late costs a contract.
What is the difference between NIST 800-171 and CMMC?
NIST SP 800-171 is the list of security requirements for protecting controlled unclassified information in non-federal systems, and DFARS 252.204-7012 has required contractors to implement it for years. CMMC checks that the requirements are in place. While Phase II is suspended, that check is a self-assessment plus select government-led assessments. This is general information, not legal advice.
How long does it take to get ready for a CMMC Level 2 assessment?
It depends on how much of the company touches CUI and how far the environment is from the requirements. A narrow enclave shortens everything. Building it, applying the controls and writing the system security plan usually takes months, not weeks. Start when the flow-down letter arrives, so your self-assessment and affirmation describe systems that exist.
Do you require a long-term contract?
No. Government contractor agreements run month to month. CMMC readiness is scoped as a project with milestones, and the ongoing agreement keeps the controls, logs and evidence current afterward, since your annual affirmation has to stay true all year, not only on the day it is signed.
What does cybersecurity for government contractors involve?
It starts by finding where federal contract information and CUI live, then protecting that boundary. Expect multifactor authentication, encryption, device management and endpoint detection inside the enclave, logs kept and reviewed, a system security plan and plan of action, a posted SPRS score, and an incident process that meets the 72-hour DFARS reporting clock.
Is CMMC certification required right now?
Not third-party certification. On July 13, 2026 the Department of War suspended CMMC Phase II, so the program can require only Phase I self-assessments: Level 1 annually and Level 2 every three years with annual affirmation. The duty to protect CUI under DFARS 252.204-7012 still applies, and the Department may conduct select government-led assessments.
What does CMMC compliance cost a small contractor?
NetSys quotes CMMC readiness as a project and ongoing support per user per month, with no published prices. Cost depends mostly on scope: how many people, devices and systems touch CUI, whether you need GCC High, how far current controls are from NIST SP 800-171 and how much documentation exists. A narrow enclave keeps every part of that smaller.
What happens if a contractor has a cyber incident involving CUI?
It must be reported to DoD at dibnet.dod.mil within 72 hours of discovery, which requires a DoD-approved medium assurance certificate obtained in advance. Images of affected systems and relevant monitoring data are preserved for at least 90 days, and malicious software is submitted to DoD's Cyber Crime Center. Your prime may set its own notice terms too.
Is NetSys a C3PAO?
No. NetSys is not a CMMC Third-Party Assessment Organization and does not certify anyone. We implement the NIST SP 800-171 controls, write the system security plan and plan of action, prepare evidence for self-assessments and SPRS, and support a later assessment if the Department restores third-party certification.
Guides for government contractors leaders
- CMMC Compliance
- CMMC 2.0 for Small Business
- Privileged Access Management
- NIST Cybersecurity Framework 2.0 Guide
- IT services for towns, counties and state agencies
- Vulnerability scanning and patching on a schedule you can show an assessor
- Cybersecurity for defense manufacturers and machine shops
- CMMC, defined
- Cybersecurity consulting for a NIST SP 800-171 gap assessment
- CMMC Level 2 Requirements: The 110 Controls Explained
- CMMC Level 1 Checklist: The 15 Requirements Explained
Other industries we support
Services behind this work
Scope support around the way your team works.
Tell us which applications, locations and deadlines matter to your government contractors team. We will discuss support, security, backup and project responsibilities in one clear scope.