Fortinetics Book a call →
Menu
Services

The hardest certification bars
in the industry.

Six service pillars. From classified network accreditation to turnkey CUI-ready IT infrastructure to commercial SOC 2 Type II. Each pillar is delivered end-to-end (design, implementation, documentation, evidence, assessment support) by a team with authorship-level knowledge of the standards.

01 · Greenfield IT & Security

Turnkey compliant infrastructure.

You won a contract with a security clause and you do not have an IT department yet. We build the whole thing (laptops, accounts, network, cloud, monitoring, and a walled-off environment for the government’s sensitive data) so it passes an assessment the first time instead of being rebuilt in six months. For startups taking their first federal work, and for firms opening a facility that will handle controlled data.

Greenfield IT and security buildout stack Six-layer stack diagram showing the full greenfield IT and security infrastructure deployed during a CUI-ready buildout engagement: physical, network, identity, endpoint, cloud and productivity, observability. CUI enclave boundary and CMMC Level 2 readiness milestones are annotated. PLATE 02 · GREENFIELD IT & SECURITY BUILDOUT CMMC L2 · NIST 800-171 Rev 2 L6 Apps & Productivity CUI LICENSING M365 GCC HIGH TEAMS · OUTLOOK SHAREPOINT CUI PURVIEW · DLP L5 Observability EVIDENCE PIPELINE SIEM · 3-YR LOG EDR · MDR BACKUP · DR VULN MGMT L4 Endpoint STIG-HARDENED INTUNE MDM JAMF (MAC) BITLOCKER / FV2 APP ALLOWLIST L3 Identity LEAST-PRIVILEGE ENTRA ID · AD SSO · SAML MFA · FIDO2 PAM · CONDITIONAL L2 Network CUI-SEGMENTED CUI VLAN NGFW · IDS SD-WAN · VPN WIFI WPA3-ENT L1 Physical VIA SUBCONTRACTOR LOW-V CABLING RACK · UPS ACCESS CTRL CCTV · BADGES CUI ENCLAVE L6 L5 L4 L3 L2 L1 DELIVERY TIMELINE KICKOFF CABLE · CORE UP USER CUTOVER CMMC-READY

Greenfield IT and security buildout stack

Greenfield IT is the moment where most compliance programs are made or broken. A startup that wires up its infrastructure without CMMC or SOC 2 in mind spends the next six months retrofitting. A commercial firm that opens a new facility without CUI segmentation designed in ends up with a scope-sprawl problem that the first assessor flags immediately. Getting the foundation right is cheaper than fixing it, usually by a wide margin.

We handle the full stack. Network architecture (wired, wireless, VPN, CUI-segmented VLANs). Identity and access management (Active Directory, Entra ID, SSO, MFA, privileged access). Endpoint deployment (Intune, JAMF, EDR/MDR across all workstations). Cloud tenant setup in Azure GovCloud, GCC High, or AWS US Gov depending on workload class. Email and productivity with compliance licensing. Centralized SIEM with retention tuned to 800-171 and CMMC expectations. Backup and DR. Physical security integration (badges, cameras, access control) via trusted subcontractors. Low-voltage cabling and rack install. Optional help desk and L1 support.

We don't vanish after cable-pulling. Typical engagements include a three-to-six-month operating period where we run the environment while your internal IT and security team comes online, then hand off with full documentation and runbooks, or continue as a managed retainer if that is the better fit.

Frameworks & standards
NIST 800-171 Rev 2 NIST 800-53 Rev 5 DFARS 252.204-7012 CMMC Assessment Guide v2.13 CIS Benchmarks DISA STIGs
Typical duration
3–9 months buildout + optional managed retainer
Client profile
Seed-to-Series-B startups winning first defense contracts; commercial firms opening CUI-handling facilities
What this engagement involves →
02 · CMMC 2.0

Level 1, 2, and 3 Certification

End-to-end support for defense contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Our team worked on the CMMC standard at the Department of Defense in 2019.

CMMC Level 2 — 14 control families, 110 controls Grid of the fourteen NIST 800-171 Rev 2 control families that define CMMC Level 2 assessment scope, with control counts for each family totaling 110. Fortinetics track record is perfect score across all engagements. PLATE 03 · CMMC L2 CONTROL MAP NIST 800-171 REV 2 · 14 FAMILIES · 110 CONTROLS AC 22 CTL +12 ACCESS ▪ ASSESSED AT 3 CTL AWARENESS ▪ ASSESSED AU 9 CTL AUDIT ▪ ASSESSED CA 4 CTL ASSESSMENT ▪ ASSESSED CM 9 CTL CONFIG ▪ ASSESSED IA 11 CTL +1 IDENTITY ▪ ASSESSED IR 3 CTL RESPONSE ▪ ASSESSED MA 6 CTL MAINTENANCE ▪ ASSESSED MP 9 CTL MEDIA ▪ ASSESSED PE 6 CTL PHYSICAL ▪ ASSESSED PS 2 CTL PERSONNEL ▪ ASSESSED RA 3 CTL RISK ▪ ASSESSED SC 16 CTL +6 COMMS ▪ ASSESSED SI 7 CTL INTEGRITY ▪ ASSESSED PERFECT ASSESSOR SCORE · TYPICAL 6–9 MO. ENGAGEMENT 110 / 110 MULTIPLE CLIENTS · CMMC L2 CERT. C3PAO-ASSESSED · NO REOPENED ITEMS

CMMC Level 2 — 14 control families, 110 controls

On July 13, 2026 the Department of War CIO suspended the CMMC Phase 2 transition and held all pending CMMC implementation milestones in abeyance pending a 60-day review. During the suspension, program managers may designate only Level 1 (Self) or Level 2 (Self) assessments, not Level 2 (C3PAO) or Level 3 (DIBCAC), and solicitations carrying those requirements are being amended to remove them.

What did not change is the part that carries actual legal exposure. DFARS 252.204-7012 safeguarding and 72-hour incident reporting remain explicitly in effect. NIST SP 800-171 Rev 2 is still enforced through self-assessment. And False Claims Act liability still attaches to the SPRS score you affirmed — no breach required, no assessor needed. The certification event paused; the obligations did not.

That makes this an unusually good window. The deadline pressure is off, C3PAO scarcity is no longer the binding constraint, and the work can be done properly rather than compressed. We design the compliance architecture, build the technical controls, author the policy library, produce assessor-grade evidence, and train the internal team, so that whatever the reform review produces, you are ready for it rather than reacting to it.

Frameworks & standards
NIST 800-171 Rev 2 NIST 800-172 FAR 52.204-21 DFARS 252.204-7012 / 7019 / 7020 / 7021 / 7025 CMMC Assessment Guide v2.13
Typical duration
6–9 months (Level 2 readiness)
Client profile
Defense subcontractors handling FCI or CUI, small to mid-sized primes
What this engagement involves →
03 · FedRAMP & DoD CC SRG

Cloud Authorization

For cloud service providers serving federal agencies and the Department of Defense. FedRAMP is the federal-wide baseline; the DoD Cloud Computing SRG layers DoD-specific controls on top for workloads handling CUI and mission-critical data.

FedRAMP and DoD Cloud Computing SRG authorization ladder Ascending tier chart from FedRAMP Moderate through FedRAMP High, then DoD Impact Levels 4, 5, and 6. Each tier shows the new requirement introduced at that level in a delta annotation row below. PLATE 04 · AUTHORIZATION LADDER FEDRAMP REV 5 · DoD CSP SRG V1R7 DATA SENSITIVITY → FR · MOD FedRAMP Moderate CUI · MOST FEDERAL WORKLOADS TIER 01 BASELINE FR · HIGH FedRAMP High HIGH-IMPACT CUI TIER 02 + HIGH-IMPACT CONTROLS IL4 DoD Impact L4 DOD CUI WORKLOADS TIER 03 + DoD OVERLAY · GOVCLOUD IL5 DoD Impact L5 MISSION-CRITICAL CUI TIER 04 + US-CITIZEN · FIPS 140 IL6 DoD Impact L6 CLASSIFIED SECRET TIER 05 + SIPRNet · CLASSIFIED FORTINETICS SCOPE BOUNDARY · SSP · CONMON 3PAO COORDINATION SPONSOR / JAB · DISA PA

FedRAMP and DoD Cloud Computing SRG authorization ladder

FedRAMP changed more in 2026 than in the prior five years. On May 4, 2026 'Authorization' became 'Certification', and CR26 introduced Certification Classes A through D. The classes are not the impact levels renamed. FedRAMP says so directly: agencies should not treat them as one-for-one replacements for Low, Moderate, or High, and there is no direct correlation between the two. A class describes how much assurance information you commit to supplying; FIPS 199 categorization still describes the data, agencies are still required to perform it, and FedRAMP is emphatic that a class is not a statement about how secure a service is. The classes also arrive on their own schedule — the Class A pipeline opened August 3, 2026, Classes B and C on August 31, and Class D is piloting late in the year for formal availability in early 2027.

CR26 itself landed on June 24, 2026: one versioned, machine-readable ruleset that governs how every submission is reviewed, and it becomes mandatory for all stakeholders on January 1, 2027. New Rev 5 applications stop being accepted June 11, 2027.

Underneath CR26 sit three changes with their own clocks: the Rev 5 baselines were rebuilt so providers now set and justify their own control parameters (NTC-0013); vulnerability management moved off flat monthly scanning to an exposure- and threat-based model that is mandatory December 7, 2026 with certifications revoked after March 7, 2027 (NTC-0014); and incident communications were rebuilt with reporting windows as tight as 15 minutes (NTC-0012).

We prepare the certification package, work with a 3PAO for independent assessment, coordinate the agency relationship, and design continuous monitoring up front rather than retrofitting it. For DoD work we sequence FedRAMP so it directly accelerates the CC SRG authorization (IL4, IL5, and IL6) with no duplicated effort.

Frameworks & standards
FedRAMP Consolidated Rules for 2026 (CR26) FedRAMP Rev 5 baselines NIST 800-53 Rev 5 DoD CSP SRG V1R7 (30 June 2026) OMB Memo M-24-15 (Modernizing FedRAMP)
Typical duration
9–18 months
Client profile
Cloud service providers pursuing the federal or DoD market
What this engagement involves →
04 · SOC 2

Type I and Type II Attestation

For commercial SaaS and service providers proving security posture to enterprise buyers, without handing the outcome to a dashboard.

SOC 2 Trust Services Criteria map Map of the AICPA Trust Services Criteria showing Security as the required Common Criteria hub and four optional categories (Availability, Confidentiality, Processing Integrity, and Privacy) as satellites. Type I and Type II assessment periods shown below. PLATE 05 · SOC 2 TRUST SERVICES CRITERIA AICPA TSP-100 · 2017 / 2022 REVISIONS CC · COMMON Security REQUIRED ALL ENGAGEMENTS C · OPTIONAL Confidentiality CUI · TRADE SECRETS · IP PI · OPTIONAL Processing Integrity COMPLETE · ACCURATE · TIMELY A · OPTIONAL Availability UPTIME · SLA · DR P · OPTIONAL Privacy PII · GDPR · CCPA ADJACENT ASSESSMENT TYPE TYPE I POINT-IN-TIME · DESIGN OF CONTROLS TYPE II 3–12 MO. WINDOW · OPERATING EFFECTIVENESS

SOC 2 Trust Services Criteria map

SOC 2 is attested against the AICPA Trust Services Criteria: Security (required), Availability, Confidentiality, Processing Integrity, and Privacy. The scope is chosen based on what your enterprise customers actually require. Most companies start with Security and Confidentiality.

Type I covers the design of controls at a point in time, useful to signal commitment and unblock a deal. Type II covers operating effectiveness over a period, usually six to twelve months, and is what enterprise customers actually want to see. Most clients sequence Type I first, then roll straight into the Type II observation window.

Compliance platforms handle evidence collection and auditor workflow well; they do not handle control design, architecture decisions, or gap remediation. We design the control framework, author the policy library, implement the technical controls, produce evidence for the observation period, manage the CPA firm relationship, and deliver a clean report, using platform tooling alongside the engagement where it genuinely helps.

Frameworks & standards
AICPA Trust Services Criteria SOC 2 Type I & Type II AICPA SOC reporting framework ISO 27001 ↔ SOC 2 control mapping
Typical duration
3 months (Type I) + 6–12 months observation (Type II)
Client profile
Series A–C SaaS, FinTech, HealthTech with lean security functions
What this engagement involves →
05 · ISO 27001

Global ISMS Certification

For organizations with global operations or enterprise customers that specifically require ISO 27001. The management-system framework that pairs cleanly with SOC 2. It also carries into FedRAMP, but only the governance half: our overlap tool scores ISO 27001 against FedRAMP Moderate at about 40 percent, because the federal control architecture is new work either way.

ISO/IEC 27001:2022 Annex A control map Four Annex A themes of ISO/IEC 27001:2022: Organizational (37 controls), People (8), Physical (14), Technological (34), totaling 93 controls. Extensions 27017 for cloud services and 27018 for PII in public cloud shown as appended modules. PLATE 06 · ISO 27001:2022 ANNEX A 4 THEMES · 93 CONTROLS · ISMS CLAUSES 4–10 ISMS ENVELOPE · CLAUSES 4–10 A.5 37 CTL Organizational POLICIES · ROLES · SUPPLIERS · INCIDENT MGMT +17 A.6 8 CTL People SCREENING · TRAINING · DISCIPLINE · EXITS A.7 14 CTL Physical PERIMETERS · EQUIPMENT · SECURE DISPOSAL A.8 34 CTL Technological ACCESS · CRYPTO · LOGGING · VULN MGMT +14 ANNEX A TOTAL 93 controls EXTENSIONS ISO/IEC 27017 · CLOUD SERVICES CONTROLS (+7 CSC, +28 IMP.) ISO/IEC 27018 · PII IN PUBLIC CLOUD (PROCESSOR ROLE)

ISO/IEC 27001:2022 Annex A control map

ISO 27001 certification requires an operational ISMS: risk assessment methodology, Statement of Applicability, Annex A control selection, internal audit program, management review cadence, and a continuous improvement loop. It is not a point-in-time checklist; it is a management system, and certification bodies can tell the difference immediately.

We design the ISMS, select Annex A controls based on your actual risk posture, produce the required documentation, train your team to operate it, support internal audits, and manage the Stage 1 and Stage 2 audits with an accredited certification body.

Where relevant we extend into ISO 27017 (cloud-specific controls) and ISO 27018 (personal data in cloud). Clients running multi-framework programs often find ISO 27001 provides the management-system backbone that SOC 2 artifacts plug into directly. FedRAMP inherits the governance layer from that backbone — the policy patterns, the risk methodology, the operational cadences — but the NIST 800-53 baseline, the SSP format, and the 3PAO pathway are separate work, and we scope them as such.

Frameworks & standards
ISO/IEC 27001:2022 ISO/IEC 27002:2022 ISO/IEC 27017 (cloud) ISO/IEC 27018 (PII in cloud) ISO 31000 (risk)
Typical duration
6–9 months to initial certification
Client profile
Global SaaS, European customers, enterprise buyers requiring ISO
What this engagement involves →
06 · Classified Networks

SCIF & SAPF Accreditation

The most specialized work we do. Design, engineering, and accreditation support for classified network enclaves and secure facilities operating under U.S. Government control.

Multi-enclave SAPF network topology Plan-view plate showing three classified network enclaves (JWICS at Top Secret with Sensitive Compartmented Information, SIPRNet at Secret, and a Space Force network at TS/SI/SAR) separated under ICD 705 within a Special Access Program Facility envelope. Perimeter treatments and Authorizing Official accreditation flow are annotated. PLATE 01 · SAPF MULTI-ENCLAVE TOPOLOGY ICD 705 · CNSSI 1253 · NISPOM SAPF ENVELOPE ICD 705 ICD 705 TOP SECRET / SCI JWICS NET-01 · INTEL COMMUNITY RACK WORKSTATIONS × 3 SEPARATE RUN · NO CROSS-DOMAIN SECRET SIPRNet NET-02 · DOD SECRET RACK WORKSTATIONS × 3 AIR-GAPPED · CNSSP-15 · STIG TS / SI / SAR SGN NET-03 · SPACE FORCE SAP RACK WORKSTATIONS × 3 COMPARTMENTED · READ-ON · TSCM AO AUTH. OFFICIAL RMF ATO PERIMETER · ICD 705 §3 RF SHIELDING ACOUSTIC · STC-50 ACCESS CONTROL IDS · ALARM · CCTV

Multi-enclave SAPF network topology

We advise defense primes building or retrofitting Sensitive Compartmented Information Facilities (SCIFs) and Special Access Program Facilities (SAPFs). Our technical scope includes multi-enclave classified network architectures: JWICS (TS/SCI), SIPRNet (Secret), and Space Force networks including SGN (TS/SI/SAR), operating within a single facility envelope.

Our team contributes network separation strategies, rack and cabling layouts, shielding and grounding considerations, vendor-agnostic Bill of Materials development, and draft content for accreditation packages. We coordinate with your Facility Security Officer and Information System Security Manager through Authorizing Official reviews.

Our role is advisory. Final accreditation decisions rest solely with the U.S. Government Authorizing Official. We do not handle classified information under these engagements. All classified activities are performed by appropriately cleared Client personnel.

Frameworks & standards
ICD 705 CNSSI 1253 NISPOM RMF (NIST 800-37) DoDM 5105.21
Typical duration
6–12 months
Client profile
Defense primes under Space Force, Intelligence Community, and DoD program offices
What this engagement involves →
Cross-cutting capabilities

Work that spans multiple pillars.

· CUI enclave design — isolated processing environments for controlled data
· NIST 800-171 and 800-53 gap assessments with assessor-grade evidence
· DFARS 252.204-7012 incident response readiness (72-hour DC3 reporting path)
· RMF / ATO packaging and documentation
· Continuous monitoring program design
· Third-party and supply chain risk management
· Policy library authoring
· Pre-assessment readiness reviews (dress rehearsal for the real thing)
Next step

Know which pillar fits, or need help figuring out?

Book a scoping call and we'll walk through your current posture, the target certification, and a realistic engagement shape. No commitment.