Cyber Exposure Management for Defense Contractors
01Context
Adversaries target defense suppliers to reach the programs they support, and smaller suppliers are often the easiest route in. CMMC has raised the standard contractors must meet, but certification is a point-in-time assessment; exposure changes every day.
02How it is typically done
Contractors assess their security through periodic self-assessments and audits. Prime contractors rely on supplier questionnaires and flow-down clauses to judge the security of their supply base.
03Where that breaks down
- Compromised credentials and exposed systems are visible to adversaries long before the next assessment.
- Self-assessment scores and questionnaires describe intended controls, not what is observable.
- Prime contractors have little continuous visibility into the exposure of hundreds of suppliers.
04The Acervus approach
We measure what is observable from outside the contractor and its supply base, then keep measuring as exposure changes.
05Offerings
| Offering | What it covers | Format |
|---|---|---|
| Contractor Exposure AssessmentRequest an Engagement | Outside-in review of credential exposure, internet-facing systems, email authentication, breach history, and domain hygiene | Executive summary, scored findings, technical appendix |
| Contractor Exposure MonitoringRequest an Engagement | The same indicators measured continuously, with alerts on material change | Monthly report, real-time alerts |
| Supplier Exposure MonitoringRequest an Engagement | Outside-in monitoring across a prime contractor's supply base | Supplier risk dashboard, monthly report |
06Scope and limitations
Assessments and monitoring are passive and outside-in. No systems are tested or accessed without the system owner's written authorization.
These services complement, and do not replace, CMMC assessment. Acervus is not a CMMC Third-Party Assessment Organization.
07Engagement models
- Fixed-fee assessment.
- Monthly monitoring subscription per contractor.
- Supplier portfolio subscription for prime contractors, priced by number of suppliers.
08Request an Engagement
Submit a confidential request. A principal will respond within one business day.