GUARDIANSHIELDA part-time security leader for defense suppliers
Guardianshield’s vCISO service gives small Defense Industrial Base companies a security leader who owns the plan, keeps your SSP and POA&M current, and keeps your CMMC readiness on track, without a full-time hire.
What you get
- A written security roadmap, prioritized and updated every quarter
- Your system security plan (SSP) and plan of action (POA&M), kept current
- Monthly working sessions and a one-page status report for leadership
- Help preparing your SPRS score and briefing your affirming official before each annual affirmation
- Assessment preparation and evidence reviews (Plus tier)
Who it’s for
Defense suppliers with about 5 to 100 users that handle FCI or CUI, are working toward CMMC Level 1 or Level 2, and don’t have an in-house security lead.
Two tiers
Essentials
A security owner, a maintained plan, monthly sessions, and quarterly reviews.
Plus
Everything in Essentials, plus quarterly evidence reviews, assessment preparation, an annual incident response tabletop, vendor reviews, questionnaire support, and incident coordination during business hours.
Both tiers are scoped on a free consultation and quoted by written estimate. We don’t publish prices for this service.
Start with a one-time baseline
Many companies start with a one-time engagement, such as a baseline review or an SSP and POA&M write-up, before monthly service begins. It gives you a clear picture of where you stand and a plan you keep either way. We set the scope with you on a free consultation and quote it by written estimate.
Incentives you may qualify for
- Buy Maryland Cybersecurity tax credit. Guardianshield Cybersecurity, LLC is a Qualified Maryland Cybersecurity Seller, so eligible Maryland buyers may qualify for a Maryland income tax credit on eligible purchases. Credits are subject to state funding limits: the program is first-come, first-served and funds can run out. Credit amounts and limits are set by Maryland Commerce; check with your tax advisor. How the credit works · Maryland Commerce program page ↗
- Free government contracting counseling. The Maryland APEX Accelerator offers no-cost counseling to Maryland businesses on government contracting, from finding opportunities to bid preparation and DoD cybersecurity requirements. The APEX Accelerator sets its own eligibility criteria. Maryland APEX Accelerator ↗
How it works
- Discovery call. Tell us about your contracts, your data, and your current I-T. You’ll get a written estimate and scope.
- Kickoff and baseline review. We meet your team, gather your documents, and write up where you stand today.
- Onboarding plan. A written plan with priorities, owners, and cadence that you approve before we start.
- Monthly cadence. Working sessions, SSP and POA&M upkeep, and a monthly status report.
- Quarterly reviews. We check progress, re-prioritize, and confirm the tier still fits.
- Renew or hand over. Renew, change tiers, or leave with a complete handover package. Everything we produce is yours.
Good to know
- This is a leadership and program service delivered during business hours. It is not a monitoring service.
- Your company enters its own SPRS score and makes its own CMMC affirmation.
- No one can guarantee an assessment outcome.
- Incident help is business-hours incident coordination: your vCISO helps you follow your plan and line up your incident response provider and counsel. All support, including incident coordination, is provided during business hours. That is not a service-level agreement or a response-time promise.
- Because we’d be your consultant, our separate C3PAO practice won’t do your certification assessment. You’d choose a different authorized C3PAO.
Independence: why we’ll never assess our own clients
Guardianshield runs two separate practices: a consulting and managed services practice, and an authorized C3PAO assessment practice. Our C3PAO authorization is current. To keep certification assessments truly independent, our assessment practice won’t do a CMMC certification assessment for any company we’ve given consulting, implementation, or managed services to in the past three years. That includes vCISO and Managed IT & Security clients. If you work with us on your security program, you’ll choose a different authorized C3PAO from the Cyber AB Marketplace for your certification, and we’ll help you get ready for it. If you’d rather have us as your assessor, talk to us before you start any consulting work.
Independence FAQ
Can Guardianshield be our vCISO or I-T provider and also do our CMMC assessment?
No. A company can’t have the same firm get it ready and certify it. If we provide vCISO, managed I-T, or other consulting services, you’ll use a different authorized C3PAO for your certification.
How long does that last?
Three years from the consulting or managed services we provide. If you’re still a client, it still applies.
Is your C3PAO authorization current?
Yes. Guardianshield holds a current C3PAO authorization, and its assessment practice is separate from its consulting and managed services practice.
Will you help us prepare for an assessment by another C3PAO?
Yes. With vCISO Plus, we help organize your evidence, prepare your people, and coordinate with the assessor you choose. The assessor makes its own independent decision.
How do we find another C3PAO?
Authorized C3PAOs are listed on the Cyber AB Marketplace. We don’t steer you to a specific one.
Does Essentials count, even though it’s lighter?
Yes. Any consulting, implementation, or managed services work counts, at any tier.
Can you guarantee we’ll pass?
No one can honestly guarantee an assessment outcome. We help you prepare and tell you plainly where you stand.
Do you sign our SPRS score or our CMMC affirmation?
No. Your company enters its own SPRS score, and your affirming official makes your affirmation. We help you get both right.
Book a free consultation
A short call with Carlos. No obligation, and you’ll get a written estimate afterward.
Schedule a Free Consultation301-453-2983