GUARDIANSHIELDManaged IT and security, built for CMMC readiness
Day-to-day I-T care for small defense suppliers: users, devices, updates, backups, and security settings, run to a documented baseline so it supports your system security plan.
What you get
- Business-hours user support and user setup and removal
- Microsoft 365 or Google Workspace administration with multi-factor authentication enforced
- Device management, patching, endpoint protection, and tested backups
- A monthly service report and a change log you can use as evidence
- Hardening, vulnerability scanning, access reviews, and NIST SP 800-171 evidence collection (Plus tier)
Who it’s for
Defense suppliers with about 5 to 100 users that handle FCI or CUI and need their I-T done right and documented, often without an in-house security lead.
Two tiers
Essentials
Keeps your I-T running with core protections in place. A good fit for FCI-only (CMMC Level 1) companies.
Plus
Everything in Essentials, plus hardening, vulnerability scanning, quarterly access reviews, and evidence mapped to NIST SP 800-171, for companies handling CUI and working toward CMMC Level 2.
Both tiers are scoped on a free consultation and quoted by written estimate. We don’t publish prices for this service.
Three ways to work with us
In-house
Guardianshield runs your I-T and security day to day.
Through a vetted partner
A vetted partner delivers the hands-on work, and Guardianshield sets the baseline, coordinates the work, and keeps the documentation.
Co-managed
We work alongside your existing I-T provider, taking on the security and documentation pieces you agree on.
We’ll recommend a model on your discovery call. Whichever you choose, it counts as managed services under our independence rule.
Start with a one-time baseline
Many companies start with a one-time engagement, such as a baseline review or an SSP and POA&M write-up, before monthly service begins. It gives you a clear picture of where you stand and a plan you keep either way. We set the scope with you on a free consultation and quote it by written estimate.
Incentives you may qualify for
- Buy Maryland Cybersecurity tax credit. Guardianshield Cybersecurity, LLC is a Qualified Maryland Cybersecurity Seller, so eligible Maryland buyers may qualify for a credit of 50% of the net purchase price, up to $50,000 per tax year. Credits are subject to state funding limits: the program is first-come, first-served and funds can run out. You may qualify; check with your tax advisor. How the credit works · Maryland Commerce program page ↗
- Free government contracting counseling. The Maryland APEX Accelerator offers no-cost counseling to Maryland businesses on government contracting, from finding opportunities to bid preparation and DoD cybersecurity requirements. The APEX Accelerator sets its own eligibility criteria. Maryland APEX Accelerator ↗
How it works
- Discovery call. We learn your size, platforms, contracts, and current provider, and agree on a delivery model. You’ll get a written estimate and scope.
- Kickoff and baseline assessment. We set up secure admin access, take inventory, and report on gaps and risks.
- Onboarding plan. A written plan for bringing devices and accounts under management, which you approve before we change anything.
- Monthly cadence. Ongoing support and maintenance, plus a monthly service report.
- Quarterly reviews. Trends, risks, upcoming changes, and whether the tier still fits.
- Renew or offboard. Renew, change tiers, or leave with your credentials, documentation, and inventory handed back securely.
Good to know
- Support runs during business hours. We don’t offer 24/7 monitoring, a security operations center, or response-time guarantees.
- If something happens, we provide business-hours incident coordination alongside your incident response provider. Urgent incident calls to our main line are routed to Carlos 24/7 on a best-effort basis. That is not a service-level agreement or a response-time promise; regular support stays within business hours.
- Your tenant, data, and licenses stay yours.
- Your company enters its own SPRS score and makes its own CMMC affirmation.
- Because we’d be your provider, our separate C3PAO practice won’t do your certification assessment. You’d choose a different authorized C3PAO.
Independence: why we’ll never assess our own clients
Guardianshield runs two separate practices: a consulting and managed services practice, and an authorized C3PAO assessment practice. Our C3PAO authorization is current. To keep certification assessments truly independent, our assessment practice won’t do a CMMC certification assessment for any company we’ve given consulting, implementation, or managed services to in the past three years. That includes vCISO and Managed IT & Security clients. If you work with us on your security program, you’ll choose a different authorized C3PAO from the Cyber AB Marketplace for your certification, and we’ll help you get ready for it. If you’d rather have us as your assessor, talk to us before you start any consulting work.
Independence FAQ
Can Guardianshield be our vCISO or I-T provider and also do our CMMC assessment?
No. A company can’t have the same firm get it ready and certify it. If we provide vCISO, managed I-T, or other consulting services, you’ll use a different authorized C3PAO for your certification.
How long does that last?
Three years from the consulting or managed services we provide. If you’re still a client, it still applies.
Is your C3PAO authorization current?
Yes. Guardianshield holds a current C3PAO authorization, and its assessment practice is separate from its consulting and managed services practice.
Will you help us prepare for an assessment by another C3PAO?
Yes. With vCISO Plus, we help organize your evidence, prepare your people, and coordinate with the assessor you choose. The assessor makes its own independent decision.
How do we find another C3PAO?
Authorized C3PAOs are listed on the Cyber AB Marketplace. We don’t steer you to a specific one.
Does Essentials count, even though it’s lighter?
Yes. Any consulting, implementation, or managed services work counts, at any tier.
Can you guarantee we’ll pass?
No one can honestly guarantee an assessment outcome. We help you prepare and tell you plainly where you stand.
Do you sign our SPRS score or our CMMC affirmation?
No. Your company enters its own SPRS score, and your affirming official makes your affirmation. We help you get both right.
Book a free consultation
A short call with Carlos. No obligation, and you’ll get a written estimate afterward.
Schedule a Free Consultation301-453-2983