Cybersecurity and Compliance
Governance, risk and compliance support for Defense subcontractors and regulated organizations.
Amara Consulting and Technology LLC is a minority-owned small business. Our cybersecurity and compliance work is led by a Senior GRC Lead who holds the CISA, CMMC Certified Professional (CCP) and PMP credentials. We help you understand where you stand against a framework, close the gaps, and get your evidence ready for an assessor or auditor.
CMMC Level 2 readiness for Defense subcontractors
If you handle Controlled Unclassified Information (CUI) on Department of Defense work, CMMC Level 2 requirements are flowing down through prime contracts. Our readiness engagement prepares you for a formal assessment. Amara is not a C3PAO and does not issue certifications.
1. Scope and gap analysis
- CUI scoping and system boundary review
- Gap analysis against the 110 NIST SP 800-171 requirements
- Prioritized findings in plain language
2. Remediation planning
- System Security Plan (SSP) development or review
- Plan of Action and Milestones (POA&M) tracking
- Policy and procedure updates
3. Evidence readiness
- Control evidence collection and organization
- Mock assessment walkthroughs
- Executive status reporting
Frameworks and services
NIST SP 800-171
Gap assessments, SSP and POA&M support for contractors protecting CUI.
SOC 2
Readiness reviews, control design and audit program support for service organizations.
PCI-DSS
Audit readiness and control testing for organizations that store, process or transmit cardholder data.
HIPAA
Security Rule risk assessments and safeguard reviews for health organizations and their business associates.
ISO 27001
Information security management system gap reviews and readiness support.
IT audit
IT general controls (ITGC) testing, control assessments and risk assessments.
Vendor risk
Third-party risk management programs, vendor assessments and ongoing monitoring.
Who leads the work
Engagements are led by our Senior GRC Lead, with about 7 years in governance, risk, compliance and IT audit. Delivery is available in English and Spanish. Meet the team.
Start a conversation
Tell us which framework or contract requirement you are facing and we will reply with next steps. Scope, timeline and price are agreed per engagement.