Security Control Assessment (SCA) & RMF Support

A security control assessment (SCA) is the federal term for going through your security controls one at a time and determining whether each one is in place and operating as described. Our founder led this work inside federal civil service as a lead security control assessor — writing the assessment plans, sitting in the interviews, verifying onsite what had to be seen in person, and standing behind what the findings said. You get an assessment run to that standard, by people who know what an authorizing official expects to read.

We write the assessment plan, then assess each control against the requirement: we examine the documentation, interview the people who operate the control, and review the evidence it produces. Where something has to be seen in person — facility access, physical and environmental protection, media handling, equipment disposal — we come onsite and walk it through, which is scoped with travel in the proposal.

For federal systems under the Risk Management Framework, we assess NIST SP 800-53 controls using the NIST SP 800-53A assessment procedures and produce the assessment results, the security assessment report, and the Plan of Action and Milestones that feed the authorization package. For contractor systems holding Controlled Unclassified Information, the same work runs against NIST SP 800-171 and feeds your CMMC self-assessment score, your System Security Plan, and your remediation plan.

Who it's for

• Federal agencies, integrators, and primes that need control assessments and authorization package support
• Defense contractors and subcontractors that need their NIST SP 800-171 controls assessed and scored
• Organizations that need an independent, documented assessment before an official signs anything

Call (888) 753-6725. Calls answered 24/7, 365 days a year.