Home/Services/Regulatory and Legal Compliance/Government Contractor Compliance
Regulatory and Legal Compliance
Government Contractor Compliance
Readiness for CMMC, NIST SP 800-171, DFARS, FedRAMP, StateRAMP, and TX-RAMP, including system security plans, POA&Ms, and authorization packages.
Frameworks and standards
- NIST SP 800-171
- CMMC
- FedRAMP
What it covers
The engagement in detail
Readiness and assessment services for organizations selling to government, including Cybersecurity Maturity Model Certification, NIST Special Publication 800-171 with system security plan and plan of action development, Defense Federal Acquisition Regulation Supplement obligations, FedRAMP, StateRAMP, and TX-RAMP authorization preparation and package development.
Who it is for
Designed for growth-stage and venture-backed companies building the security program enterprise customers require, and established organizations measuring and maturing an existing security program.
What you receive
Deliverables from this engagement
- System security plan
- Plan of action and milestones
- Gap assessment
- Authorization package
- Assessor preparation
Terms
How an engagement works
Every engagement is scoped individually and conducted under a nondisclosure agreement and a master services agreement, beginning with a scoping conversation and a written statement of work that defines scope, deliverables, and sequence. The four steps this practice follows are set out in full on the Regulatory and Legal Compliance page.
- Meet a regulation or supervisory expectation
- Growth-Stage & Startup Companies
- Established Enterprises
Regulatory and Legal Compliance
Other services in this practice
Technical assessment behind privacy, healthcare, financial, and government obligations, often under counsel.
- Regulatory Technical Control AssessmentTechnical controls assessed requirement by requirement against a named statute or regulation, producing findings counsel can rely on with regulators.Regulatory
- Privacy Program Development and AssessmentBuild or assess your privacy program: data mapping, records of processing, DPIAs, consent, data subject request workflows, retention, and vendor oversight.Regulatory
- Privacy Regulatory ReadinessGap assessment against GDPR, the Texas Data Privacy and Security Act, CCPA and CPRA, and other state privacy laws, focused on the differences that matter.Regulatory
- Financial Services Regulatory AssessmentControl assessments for GLBA and the FTC Safeguards Rule, NYDFS Part 500, FINRA, SEC cybersecurity rules, and SOX IT general controls.Regulatory
- Healthcare Regulatory AssessmentHIPAA Security Rule risk analysis and safeguard assessment, business associate review, and a remediation plan focused on the issues regulators cite most.Regulatory
- Regulatory Inquiry and Examination SupportTechnical support under counsel for inquiries and examinations by state attorneys general, the FTC, HHS OCR, the SEC, and banking regulators.Regulatory
Start with a confidential conversation
Thirty minutes on whether this is the right engagement for the question you have been asked, and what it would take to answer it.