Northern Virginia · Cybersecurity
Cybersecurity for the Dulles corridor
Testing, gap assessments, and remediation support for NoVA contractors and SaaS vendors — advisory only, with clear boundaries on certifications we cannot issue.
Capabilities
Security services in Northern Virginia
Northern Virginia concentrates defense tech, integrators, and cloud shops facing overlapping customer questionnaires. We translate frameworks into prioritized fixes your engineers can schedule.
CMMC & NIST readiness
Gap assessments against SP 800-171, CSF 2.0, and CMMC Level 2 practices — POA&M and evidence prep included.
- SSP support
- Control mapping
- Evidence templates
- C3PAO coordination prep
Penetration testing
External, internal, web app, and phishing engagements with executive and engineer-readable reports.
- Scoped ROE
- Manual testing
- Remediation guidance
- Verification retest
Vulnerability management
Authenticated scanning plus analyst review — prioritized by business risk, not raw CVSS alone.
- NIST SP 800-30 aligned
- False-positive review
- Remediation tracking
- Executive summaries
Incident response advisory
Playbooks, tabletop exercises, and retainer-based response support — roles defined upfront.
- IR plan review
- Tabletop facilitation
- Forensics partner coordination
- Comms templates
Architecture & zero trust
Identity, segmentation, and cloud control reviews for hybrid environments common in NoVA.
- Threat modeling
- IAM reviews
- M365 / Azure hardening
- Roadmap prioritization
Built for the Washington, DC Market
DC-headquartered with daily NoVA client work — on-site kickoffs in Arlington or Herndon when useful, Eastern-time incident calls, and assessors who understand FedRAMP-adjacent language without overclaiming.
Honest scope
We do not sell certifications or attestations we cannot legally provide.
Engineer-readable
Findings your team can ticket — not PDFs that gather dust.
Fast kickoff
Calendar slots for assessments within weeks, not quarters.
Risk-based
Priorities tied to business impact and customer contract language.
Outcomes
How engagements tend to land
Illustrative benchmarks from past work — your mileage depends on offer, traffic, and sales follow-up.
How We Work
A transparent, milestone-driven engagement from first call to launch.
Scope
Systems, data classes, and compliance drivers captured in the SOW.
Assess
Testing or gap analysis with daily check-ins on critical findings.
Report
Executive summary plus technical detail with remediation steps.
Verify
Retest or readiness review before customer audit windows.
FAQ
Frequently Asked Questions
Straight answers — scoped to what you sell and who has to sign off.
Next step
Facing a customer security questionnaire?
Share the framework and timeline — we respond with a scoped assessment or remediation plan.
Based at 1717 N Street NW, Washington, DC · hello@thoriumdc.com · (202) 666-9377