Call Us On:
843-329-7463
Call Us On:
843-329-7463
Security 1st Consulting was founded in 2016 by Dr. Tracey B. Manuel, a retired U.S. Army Reserve Major with more than 25 years of federal cybersecurity experience at FEMA, the U.S. Coast Guard, the U.S. Marine Corps, the National Science Foundation, NIWC, and the VA.
We are an SDVOSB and HUBZone-certified small business. We help defense contractors and federal agencies assess their security, meet NIST SP 800-171 and CMMC requirements, and document the results so they hold up under review.
Identify vulnerabilities in your organization with comprehensive risk assessments. We help you understand potential threats and develop strategies to mitigate them.
Craft a tailored cybersecurity strategy that aligns with your business goals. Our experts design solutions to protect your assets while supporting your operational objectives.
We help defense contractors prepare for CMMC Level 1 and Level 2: scoping, gap analysis against FAR 52.204-21 and NIST SP 800-171 Rev 2, System Security Plans, POA&Ms, and getting results ready for SPRS.
Prepare for a breach before it happens. We help you write and test an incident response plan so your team knows who does what, and when.
Meet the rules that apply to your contracts and your industry, including NIST SP 800-171, CMMC, RMF, HIPAA, and PCI-DSS.
Maximize your competitive edge with strategic business development and end-to-end proposal management designed to secure high-value contracts.
Simulate real-world attacks to uncover weaknesses in your systems. Our assessments provide actionable insights to strengthen your defenses.
Implement strategies to protect sensitive data and ensure privacy compliance, reducing the risk of data breaches and maintaining customer trust.
Design and implement secure network architectures that defend against unauthorized access and cyber threats.
In a world where cyber threats and breaches are becoming more common every day, Security 1st Consulting understands the importance of ensuring that our customers’ networks and systems are properly secured.
We prioritize safeguarding your sensitive data with industry-leading practices, ensuring confidentiality and compliance with the latest regulations. Your trust is our top priority, and we make sure your information stays secure.
From firewalls to intrusion detection systems, we design and implement robust network defenses that protect your business from unauthorized access, data leaks, and evolving cyber threats
Dr. Manuel's background includes cybersecurity work at FEMA, USCG, USMC, NSF, NIWC, and VA. That experience shapes how we document and defend your controls.
Find out where you stand on CMMC before the solicitation asks.
Answers to the questions defense contractors ask us most about CMMC and working with Security 1st Consulting.
If you hold or are bidding on a Department of War (formerly Department of Defense) contract and your company handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), probably yes. CMMC requirements are placed in solicitations and contracts through DFARS clause 252.204-7021, which took effect November 10, 2025. The solicitation states which level applies.
Level 1 covers FCI. It requires the 15 security requirements in FAR 52.204-21, an annual self-assessment, and an annual affirmation of compliance. Open items on a Plan of Action and Milestones (POA&M) are not allowed at Level 1. Level 2 covers CUI. It requires the 110 security requirements in NIST SP 800-171 Rev 2, assessed every three years, either by self-assessment or by an authorized third-party assessor (C3PAO), depending on the contract.
Partly. On July 13, 2026, the Department of War suspended Phase 2 of the rollout, which would have started requiring third-party (C3PAO) Level 2 certification on November 10, 2026, and began a review of the program. Phase 1 self-assessment requirements are still in place, and the existing DFARS 252.204-7012 obligations to protect CUI did not change. As of October 2026, no new Phase 2 date has been announced.
Self-assessment results and the annual affirmation are entered in the Supplier Performance Risk System (SPRS). A senior official at your company affirms that the company meets and will maintain the requirements.
We help you scope the systems that handle FCI or CUI, run a gap analysis, write or update your System Security Plan, build a POA&M where one is allowed, and prepare your self-assessment for SPRS. We do not issue CMMC certificates; Level 2 certification assessments are performed by authorized C3PAOs.
Federal agencies can set aside contracts for SDVOSB and HUBZone small businesses, and prime contractors can count work subcontracted to us toward their small business goals.
Our experts are ready to assess your systems, identify vulnerabilities, and provide clear strategies to strengthen your defenses. From secure networks to data protection, we deliver trusted solutions designed to keep your business safe and resilient.
