Sixteen solutions. One production line. Every assurance lane.
Each solution below runs on the same Federal CUI Security Factory runbook we ran on our own environment — the same sequence, the same evidence standard, the same validation gate. Pick the entry point that matches where you are; the output aims at whichever assurance outcome your contracts require — CMMC certification, an 800-171 self-assessment, agency authorization, or independent review.
Federal CUI & NIST 800-171
The flagship program: applicability analysis, CUI discovery and boundary definition, SSP & POA&M, Microsoft architecture, objective-level evidence, and assessment readiness — for Rev. 2, Rev. 3, CMMC, and agency-specific requirements.
Explore Federal CUI →NIST 800-171 Rev. 3 Transition
Contractual baseline inventory, Rev. 2-to-Rev. 3 crosswalk, ODP decision register, new-family implementation, SSP conversion, evidence remapping, and dual-baseline operation.
Explore NIST 800-171 Rev. 3 Transition →CMMC Readiness & Certification Support
The DoD assurance lane: gap assessments scored to the DoD Assessment Methodology, SSP and POA&M production, remediation execution, evidence collection, and mock assessment ahead of your C3PAO.
Explore CMMC Readiness →M365 GCC High Migration
Tenant provisioning, identity and mail migration, and CUI boundary configuration — engineered for the federal cloud, not a commercial-tenant retrofit.
Explore M365 GCC High Migration →Azure & Azure Government
Landing-zone architecture, enclave design for CUI workloads, network segmentation, and infrastructure hardening aligned to NIST SP 800-171 Rev. 2.
Explore Azure →Cybersecurity & Risk Advisory
Entra ID governance, Intune baselines, Purview CUI labeling and DLP, Defender, WDAC application control, and zero-trust design for CUI.
Explore Cybersecurity →Managed IT & Managed Compliance
Ongoing operation of the compliant environment: patching, monitoring, evidence refresh, control validation, and POA&M burn-down between assessments.
Explore Managed IT →Compliant AI Implementation
Secure, auditable AI projects inside your CUI boundary — CUI-safe RAG, explainable models, GCC High and Azure Government native, evidence-ready by design.
Explore Compliant AI Implementation →EASA Part-IS · ISO 27001 · ITAR/EAR
One control implementation extended across every framework aerospace and defense contractors actually carry — shared evidence, not duplicated programs.
Explore EASA Part-IS →The other frameworks you carry.
Defense and aerospace companies rarely answer to one regime. These programs extend the same control implementation and evidence base to AI governance, your supply chain, export control, European aviation and privacy law, and ISO certification — mapped once, reused everywhere.
AI Governance Programs
Policy, inventory, and oversight for AI use, aligned to the NIST AI RMF and ISO/IEC 42001, on the same evidence base as your CUI program.
Explore AI Governance Programs →Supply Chain Risk Management
Supplier tiering, CMMC flowdown, prohibited-source screening, and a C-SCRM plan aligned to NIST SP 800-161 and the Rev. 3 SCRM family.
Explore Supply Chain Risk Management →Export Control (ITAR & EAR)
ITAR and EAR programs with technology control plans, deemed-export screening, and access enforced in the tenant, built alongside your export counsel.
Explore Export Control (ITAR & EAR) →EASA Part-IS
Aviation information security management for EASA-approved organisations, with the ISMS, risk assessment, and reporting built on your existing control set.
Explore EASA Part-IS →GDPR
Data mapping, DPIAs, transfer mechanisms, and a breach process that meets both the GDPR and DFARS 7012 72-hour clocks.
Explore GDPR →ISO/IEC 27001
ISMS implementation and certification support mapped to your NIST SP 800-171 controls, so CMMC and ISO share one evidence base.
Explore ISO/IEC 27001 →ISO/IEC 27002
Control implementation and maturity assessment against the 93 ISO/IEC 27002 controls, crosswalked to NIST SP 800-171.
Explore ISO/IEC 27002 →Not sure which you need first? That's the point of a strategy call — thirty minutes with a practitioner, not a sales rep. Bring your contract clauses; leave with a straight answer on scope, sequence, and budget.
Tell us where you are. We'll tell you what it takes.
Every inquiry is reviewed by a practitioner. Expect a substantive reply — scope questions, not a drip campaign. Or email rj@indirectit.com directly.