From risk assessment to continuous compliance.
Concordant helps government organizations and businesses assess their risk, engineer secure systems, and monitor them continuously. We prepare you for the assessment or authorization in front of you, then keep you ready for the next one.
NIST SP 800-53 Experienced
CMMC Level 2 Certified
CyberAB RPO
FedCiv & DoD Experience
ISO 9001 Certified
Cybersecurity, information assurance, and data protection, end to end
Every organization is under pressure to move faster, operate leaner, and deliver more, all while protecting sensitive information and proving it to auditors. Concordant helps you identify your risks, close the gaps, and stay secure and compliant over time so your security and documentation proof move together. That is information assurance: confidentiality, integrity, and availability of your information, protected end to end.
What we do
Three connected areas of work, delivered by one team.
What you get
The standards we work in
NIST RMF
NIST 800-53
NIST 800-171
FISMA
FedRAMP
Zero Trust
Concordant is an ExtraHop value-added reseller and implementer. We make ExtraHop easy to acquire, with procurement and licensing suited to your project, then deploy, configure, and integrate it cleanly into your systems with minimal disruption.
Why work with Concordant
Proof point
Frequently Asked Questions
The common questions about federal cybersecurity and information assurance, answered in one place.
What is NIST 800-171, and what does my contract actually require?
NIST SP 800-171 is the standard for protecting Controlled Unclassified Information (CUI) on nonfederal systems, and its 110 requirements are the basis of CMMC Level 2. The obligation itself does not come from CMMC. It comes from the clauses already in your contract. DFARS 252.204-7012 requires Department of War (DoW) contractors that handle covered defense information to implement all 110 requirements of NIST SP 800-171 Revision 2, report cyber incidents within 72 hours, and flow the requirement down to subcontractors. DFARS 252.204-7019 and 252.204-7020 require a current self-assessment score posted in the Supplier Performance Risk System (SPRS). Those clauses have been in force for years, they are unchanged today, and they apply whether or not you ever pursue a CMMC certificate. We assess you against all 110 requirements, help you close the gaps, and build the environment that holds up. For the CMMC path specifically, see our CMMC services page.
What is going on with CMMC right now, and do I still have to do something?
Yes, you still have work to do. As of July 2026, the Department of War has suspended Phase 2 of the CMMC rollout, including the transition that had been set for November 2026. While the suspension is in effect, contracting officers may still require CMMC Level 1 or Level 2 self-assessments, but they may not require a third-party (C3PAO) Level 2 assessment or a Level 3 assessment, and solicitations and contracts that already carry one are being amended to remove it. There is no announced end date. What did not change is the security work itself. DFARS 252.204-7012 and NIST SP 800-171 Revision 2 remain in force, FAR 52.204-21 still sets the floor for Federal Contract Information, and you still post and affirm a self-assessment score in SPRS. Those obligations predate CMMC by nearly a decade and the pause does not touch them. The certification audit is paused. The requirement to protect CUI is not. One thing to watch: a proposed government-wide CUI rule would raise the baseline to NIST SP 800-171 Revision 3, so the gap you leave open today is likely to get wider, not narrower.
Are there cybersecurity requirements for non-DoW Federal contracts?
Yes. FAR 52.204-21 sets a baseline safeguarding requirement for Federal Contract Information (FCI), the non-public information generated in the course of any federal contract (proposals, invoices, delivery orders, internal reports), and it applies government-wide, not just to Department of War contracts. It covers 15 basic practices such as access control, authentication, physical security, and malware protection. It's self-assessed, with no third-party audit and no documentation mandate, far lighter than the 110-control NIST 800-171 standard required for DoW contracts involving CUI, but it's the floor every federal contractor must clear regardless of agency. We assess you against these 15 requirements and confirm you're covered.
NIST 800-171 vs. NIST 800-53?
NIST SP 800-53 is the full federal control catalog that agency systems are authorized against (the basis for FedRAMP and an ATO). 800-171 is the smaller set that protects CUI in contractor systems. We work in both, and help you figure out which applies to you.
What does a cybersecurity assessment cover?
We measure your systems against the baseline that applies to you (a NIST SP 800-53 profile, FedRAMP Moderate or High, NIST SP 800-171, CIS IG1/IG2), document where you stand, and hand you a prioritized plan to close the gaps. It is the first step toward an Authority to Operate or passing an audit.
What is an Authority to Operate (ATO)?
The formal approval that lets a federal system go live, granted after your controls are assessed and your risk is documented and accepted. We prepare the package (System Security Plan, risk assessment, control evidence) and support you through authorization.
What is Zero Trust?
A security model that trusts no user or device by default and verifies every request, rather than assuming anything inside the network is safe. Federal agencies are required to move toward it. We assess where you are, build the roadmap, and implement it in steps.
What is continuous monitoring?
Keeping your security and compliance current after authorization, instead of rebuilding the evidence before every audit. We watch your controls, your network traffic, and your vulnerabilities, and flag risk while there is still time to act.
Do you offer vCISO or fractional CISO support?
Yes. When you need security leadership without a full-time hire, our advisors can serve as your virtual CISO (vCISO). For leadership-level strategy across the CIO, CTO, and CISO roles, see our Strategic CXO Services.
What is network traffic analysis?
Watching the traffic moving across your network to catch threats that get past the perimeter. We deploy and tune the correct tool, integrate it with your IT service management, and turn it into near real-time intelligence.
Pursuing CMMC?
CMMC Level 2 maps to the 110 requirements of NIST 800-171. If that is the path you are on, we know it well, and we get you ready for it.
