Who we serve
CMMC compliance for environmental & hazmat services
We help environmental & hazmat services businesses in the defense supply chain protect the CUI their contracts depend on and meet the CMMC level those contracts require.
Environmental Engineering for Federal Sites
Environmental engineering firms supporting federal sites deliver permitting, compliance, and remediation services. Site data, permit files, and compliance records are CUI.
CMMC for environmental engineering for federal sitesBase Cleanup Contractors
Base cleanup contractors remediate DoD installations and FUDS sites. Site data, sampling results, and facility maps tied to installations are CUI.
CMMC for base cleanup contractorsHazardous Waste Transporters
Hazardous waste transporters moving waste from DoD facilities handle manifests, routing, and cargo data that are CUI under DFARS.
CMMC for hazardous waste transportersWaste Disposal Contractors for Defense Facilities
Waste disposal contractors serving defense facilities handle manifests, profiles, and transport data that tie directly to DoD installations. Much of that record set is CUI.
CMMC for waste disposal contractors for defense facilitiesIndustrial Hygiene Providers
Industrial hygiene providers performing surveys on DoD installations produce sampling data, site plans, and reports that are CUI when tied to federal facilities.
CMMC for industrial hygiene providersHazmat Remediation Firms
Hazmat remediation firms handle asbestos, lead, PFAS, and MEC on DoD installations. Site data and remediation plans are CUI under DFARS.
CMMC for hazmat remediation firmsWhat CMMC services do we provide for environmental & hazmat services?
End-to-end CMMC consulting, fixed-price. See how CMMC compliance works.
Gap assessment
A full review against all 110 NIST SP 800-171 controls, with a documented SPRS score and a clear picture of where your CUI lives.
Readiness assessment
A mock assessment that mirrors the official methodology, with objective evidence collection and interview coaching.
Policy and documentation
SSP, POA&M, incident response plan and the supporting policy set, written in plain English for how you operate.
Technical controls
Network segmentation, FIPS-validated encryption, MFA, audit logging, vulnerability management and endpoint hardening.
Managed compliance
Log review, vulnerability scanning, quarterly evidence refresh and annual SSP updates between assessments.
Assessment support
Scoping, scheduling, interview coaching and on-site support during your formal assessment.
When was the last time you ran a cyber risk assessment?
Tell us about your environment and your contracts. We will tell you where you stand and what to fix first.