Every DCG engagement starts with an honest conversation about where your program stands. No proposal until you've heard the real picture. Fill in the details below and we’ll open a pre-filled email in your mail app — you send it, and we reply within one business day. Prefer to write to us directly? [email protected].
Nothing is sent until you press send in your own mail app. If it does not open, email [email protected] directly. We respond within one business day, and all information you share is confidential.
Within one business day. We look at your situation before we get on the phone so the conversation is substantive.
Typically 30-60 minutes. We ask questions. You ask questions. We tell you what we see from the outside and what it would realistically take to get where you need to go.
If the conversation warrants it, we will put together a scoped engagement -- CUI Discovery, Midwatch demo, or full consulting engagement. No proposal until the conversation is complete.
"We are real cyber experts, not salespeople. If the call tells us you don't need what we sell, we will tell you that."
From a standing start, the journey to certification is approximately eighteen months. Anyone who promises thirty days is selling a product that does not exist. The timeline depends on where your program starts, how quickly you can dedicate resources to documentation and remediation, and when C3PAO assessment slots are available.
That depends on your environment. Midwatch handles the technical controls for the portion of your operations that touches CUI. You still need a documentation program -- policies, procedures, an SSP -- regardless of whether you use Midwatch. Many clients use both. Some use only consulting. Some start with Midwatch and engage consulting for the documentation program.
The real question is whether you can afford not to be certified. The cost of failing the next contract is higher than the cost of the compliance program. That said, DCG is specifically built to serve DIB contractors who are not Fortune 500 companies. We work with $5M machine shops and we work with multi-hundred-million-dollar manufacturers. Scope and pricing are set to match your situation.
Yes. We start with CUI discovery and scoping regardless of how far along you are. If your existing work is sound, we build on it. If there are gaps that will cause you to fail your assessment, we tell you that immediately -- before you invest more in the wrong direction.
It is the Defense Federal Acquisition Regulation Supplement clause that requires defense contractors handling Controlled Unclassified Information to implement the security requirements in NIST SP 800-171. If this clause is in any active contract, you are likely already obligated to comply -- and may be in violation of the False Claims Act if you have not implemented the required controls.
Yes. DCG is listed on the NASPO contract vehicle covering 27 institutions across 25 states. Research universities with DoD research funding face the same CMMC requirements as commercial defense contractors, with some additional complexity around academic operations. We have experience with this specific environment.