Government Contractor Managed IT Services
ICSI (International Computer Services, Inc.) provides managed IT and cybersecurity services for small and mid-sized government contractors. From our Annapolis, Maryland headquarters, we help contractors meet NIST SP 800-171, DFARS and CMMC requirements with system security plans, assessments and remediation, Microsoft 365 Government, multi-factor authentication and a 24×7 help desk.
Key facts
- Frameworks: NIST SP 800-171, DFARS and CMMC
- Compliance work: System Security Plans, assessments and remediation, IT user policies, security incident response plans
- Security: intrusion detection and response, advanced endpoint protection, multi-factor authentication, security awareness training
- Cloud: Microsoft Office 365 Gov
- Support: a 24×7 help desk, network maintenance, business continuity and disaster recovery
- Business size: 5 to over 400 devices
- Team certifications: Microsoft Modern Work partner; CompTIA-certified technicians (Security+, Network+ and A+); Cisco CCNA; Microsoft Azure Fundamentals (AZ-900); Microsoft Certified: Azure Administrator Associate
- First step: a free Government Contractor IT Security Assessment, (410) 280-3000
Why it matters now? Since November 10, 2025, Department of Defense contracts can include the CMMC clause DFARS 252.204-7021, which makes the required CMMC level a condition of contract award (source: DoD CMMC acquisition final rule, 48 CFR, Federal Register, 10 September 2025).
Last updated: October 2026 · Written by the ICSI team
Government Contractor Managed IT Services from ICSI address the unique challenges facing Government Contractors.
Besides the need for a secure, while accessible and productive, IT network every business requires, Government Contractors must also meet the additional cybersecurity requirements of NIST SP 800-171, DFARS, and CMMC.
ICSI understands the challenging environment Government Contractors operate in. This holds especially true for small to mid-sized firms, who are squeezed between giant competitors and the need to meet stringent federal regulations for cyber security.
ICSI works with businesses from 5 to over 400 devices giving them a fully vetted and repeatable IT process, tailored to their specific support and security needs. We do not believe in a one size fits all model to IT support, your business is unique and we use our expertise in the IT field to provide a solutions that best fits your needs.
ICSI Government Contractor Managed IT Services work with you to meet regulatory requirements quickly. Cyber security services are a focal point of our managed IT services work with government contractors. We offer a full suite of the services you need:
- System Security Plans
- NIST SP 800-171, DFARS, CMMC Assessments and Remediation
- Intrusion Detection and Response
- Advanced Endpoint Protection
- Microsoft Office 365 Gov
- Business Continuity/Disaster Recovery
- IT User Policies
- Security Incident Response Plan
- Multi Factor Authentication
- Security Awareness Training
- Network Maintenance
ICSI gives your staff the capabilities to provide continuous up-time, a 24×7 Help Desk for support, and an environment that is as adaptable as your team needs it to be.
CMMC Level 1 and Level 2: which one applies to you?
Level 1 covers contractors that handle only Federal Contract Information (FCI). It means meeting the 15 basic safeguarding requirements in FAR 52.204-21, with a self-assessment and an affirmation entered in SPRS every year.
Level 2 covers contractors that handle Controlled Unclassified Information (CUI). It means meeting the 110 requirements of NIST SP 800-171. Depending on the contract, that is checked by a self-assessment or by an independent C3PAO assessment every three years, with an affirmation every year. Your solicitation states the level you need.
How ICSI prepares government contractors
- Gap assessment: we compare your current setup with the NIST SP 800-171 requirements and show you what is missing.
- System Security Plan and plan of action: we write up how each requirement is met and the steps to close the gaps.
- Remediation: multi-factor authentication, advanced endpoint protection, intrusion detection and response, backups and access controls.
- Policies and training: IT user policies, a security incident response plan and security awareness training for your staff.
- Ongoing support: 24×7 help desk, monitoring and network maintenance, so you stay ready for your next assessment.
Microsoft 365 GCC or GCC High?
Microsoft 365 GCC suits many contractors that handle FCI. Contractors that handle export-controlled (ITAR) data, or CUI that has to meet DFARS 252.204-7012, usually need GCC High. Your contracts and the type of data you hold decide which one is right, and we help you check that before any move.
What affects the cost?
Our pricing is scalable. The main things that shape it are the CMMC level you need, the number of users and devices, how many gaps the assessment finds, your Microsoft 365 licensing (GCC High costs more than the commercial version) and whether you need an independent assessment. After a free IT security assessment we give you a clear quote for your business.
Frequently Asked Questions
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that checks whether contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). If your DoD contracts involve FCI or CUI, the solicitation states the CMMC level you need.
NIST SP 800-171 is the set of security requirements for protecting Controlled Unclassified Information on contractor systems. DFARS 252.204-7012 requires DoD contractors that handle CUI to meet it, and CMMC Level 2 is based on it.
A System Security Plan describes your systems and how each security requirement is met. NIST SP 800-171 requires one, and assessors review it first. ICSI writes and maintains System Security Plans as part of our government contractor services.
We assess your current environment against NIST SP 800-171 and CMMC, fix the gaps (for example multi-factor authentication, endpoint protection, intrusion detection, IT user policies, an incident response plan and staff training), document everything in your System Security Plan and keep it maintained as part of your managed IT service.
Yes. Small and mid-sized contractors are our focus. We support businesses from 5 to over 400 devices.
Call ICSI at (410) 280-3000 to request your free Government Contractor IT Security Assessment.