A vCISO for government contractors

For years, defense-supply-chain security ran on self-attestation: check the box in the contract file, keep a policy binder somewhere findable. That era is ending. Primes are pushing CMMC 2.0 requirements into new awards and down through their subcontract chains — the pace varies by program, but the direction doesn’t. The question has changed from “do you have a security policy” to “show us your System Security Plan and your current self-assessment.”

For a small or mid-size contractor, that’s an enterprise-grade obligation landing on a team with no security department. The requirements assume someone owns scoping, documentation, remediation, and the assessment itself — a role that’s a fraction of a job in workload but an executive’s worth of accountability. Which is exactly the shape a fractional CISO is built for.

Agency pairs the named leader with engineers who produce the artifacts assessors actually read — people who’ve internalized that in this world, the documentation isn’t paperwork about the program. It is the program.

Three regimes get conflated constantly. NIST 800-171 is the control set: it applies when Controlled Unclassified Information touches your systems under a covered contract, and it’s what you self-assess against today. CMMC 2.0 is the verification layer on top — levels tiered to the sensitivity of what you handle, with third-party assessment entering the picture as requirements phase in. If you hold CUI, this pair is your track.

FedRAMP is a different track entirely: it governs cloud services sold to federal agencies, it’s an authorization rather than a certification, and it’s a substantially heavier lift that only makes sense with agency demand in hand. Plenty of contractors eventually need both tracks — in which case running them on a common control map is the only sane approach. A vCISO’s first deliverable is often just this: which regime, which level, in what order, and what your contract clauses actually obligate you to.

Assessment-driven programs reward a specific temperament: documentation-first, evidence-always, no improvisation. The best public proof that Agency operates that way is CloudCover, an IT services company whose ISO 27001 audit closed with zero findings — a different framework, the same discipline defense assessors look for. Outcomes like that come from running the program all year, not from heroics in assessment week.

If your revenue includes federal work — prime or sub, defense or civilian — the security program has to serve the contract file first. That’s the specialty of Agency’s government practice, alongside aerospace and aviation, where the same flow-downs dominate. And if the trigger was a letter from your prime: the right time to start was before the letter, and the second-best time is this quarter.