Cybersecurity and export control clauses turn into real operating obligations the day you sign. We review DFARS 252.204-7012, CMMC and export control terms in your contracts, draft supplier flow-downs and help you understand what your customers are asking you to represent. We are not a CMMC assessor or licensing body, and each engagement is a flat fee, quoted before we start.
At a glance
- Practice
- GovCon
- Pricing
- Flat fee, quoted before we start
- Included
- 6 deliverables
- Process
- 3 steps, one named attorney
- Where we work
- Slack, email or a call
When founders call us
The moments that usually bring a company to us for this work.
- 01
A prime asks you to confirm your CMMC level and NIST SP 800-171 assessment score
- 02
Your contract includes DFARS 252.204-7012 and you will receive controlled unclassified information
- 03
You are hiring foreign national engineers to work on hardware or software that may be export controlled
- 04
You need to flow cybersecurity and export terms down to your own suppliers
What you get
Scoped in writing before we start. One flat fee for all of it.
- Review of DFARS 252.204-7012 and CMMC clauses in your contracts, with plain-language obligations
- Supplier and subcontractor flow-down terms for CUI, incident reporting and export control
- Representation and certification review before you sign or submit
- Export control contract provisions covering ITAR and EAR classification responsibilities
- Technology control plan and foreign national access considerations, noted as fact-dependent
- Coordination with your security assessor or export classification advisor on contract language
How it works
- 1
Map the obligations
We identify which cyber and export clauses apply and what information you will handle.
- 2
Draft and flow down
We prepare supplier terms and review your representations to customers.
- 3
Align with your advisors
We coordinate contract language with your assessor or export consultant and finalize.
Mistakes we help you avoid
The ones we see most often, and catch before they cost you.
- Avoided
Representing a CMMC status or assessment score your current environment does not support
- Avoided
Receiving CUI under a 7012 contract without a plan for the 72-hour incident reporting requirement
- Avoided
Sharing controlled technical data with foreign national employees without checking export rules
- Avoided
Forgetting to flow 7012 and export terms to suppliers who will touch covered information
CMMC, Export Control & Supply Chain: questions founders ask
It requires contractors to provide adequate security for covered defense information, generally by implementing NIST SP 800-171. It also requires reporting cyber incidents to DoD within 72 hours of discovery and flowing the clause to subcontractors handling covered information. Cloud services used for that information have additional requirements.
CMMC is DoD's program for verifying that contractors protecting federal contract information and CUI meet required security levels. It has three levels, with assessments ranging from self-assessment to third-party or government assessment depending on the level and contract. Requirements are being phased into contracts over time.
ITAR is administered by the State Department and controls defense articles and services on the US Munitions List. EAR is administered by the Commerce Department and covers most other items, including many dual-use technologies. Classification determines which regime applies, and it depends on the specific item.
No. CMMC assessments are performed by authorized assessors or the government, not law firms. We draft and negotiate the contracts and representations around your cybersecurity and export posture and coordinate with your technical advisors.
Get a flat-fee quote for CMMC, Export Control & Supply Chain.
A short call with an attorney. You leave with a written scope and one fixed price.
Book a call