Loading
NIST CSF 2.0 · SP 800-53 · SP 800-171 · RMF · CMMC 2.0
Independent, evidence-based NIST assessments that quantify your real risk, satisfy auditors, and give you a clear roadmap — not a 200-page PDF that sits on a shelf. Serving federal contractors, healthcare organizations, and regulated businesses across Washington, DC.
Capabilities
We start with constraints: who approves work, what you must prove to regulators or boards, and how buyers actually decide. Delivery follows from that — not from a generic checklist.
A structured evaluation of your security posture across all six CSF 2.0 functions, producing a current-state profile, target-state profile, and a prioritized gap list with effort and risk-reduction estimates for every finding.
A deep-dive evaluation of your security and privacy controls against the NIST SP 800-53 Rev 5 catalog — required for federal systems and increasingly expected by enterprise customers and cyber insurers.
Purpose-built assessment for defense contractors and organizations handling Controlled Unclassified Information (CUI) — covering all 110 SP 800-171 practices required for CMMC 2.0 Level 2 certification.
Full RMF lifecycle support for federal agencies and contractors seeking an Authority to Operate (ATO) — from categorization and control selection through assessment, authorization, and continuous monitoring.
Quantitative and qualitative risk assessments aligned with NIST SP 800-30 and SP 800-39 — giving leadership a defensible, prioritized view of organizational risk that informs budget and strategy decisions.
A structured evaluation of your ICT supply chain risks aligned with NIST SP 800-161 Rev 1 — the gold standard for identifying, assessing, and responding to cybersecurity risks introduced through vendors, suppliers, and technology providers.
Office on N Street NW. Most engagements pair DC stakeholders (legal, security, procurement) with a senior remote build team — clear owners, written decisions, and no bait-and-switch on who does the work.
Our assessors are trained practitioners who work from primary NIST source documents — not commercial tools that auto-generate reports without human judgment.
Every gap finding includes a specific remediation recommendation, effort estimate, and a risk-reduction score. You leave with a prioritized roadmap, not just a list of problems.
Deep experience with DoD contractors, civilian agencies, healthcare organizations, and financial firms — where NIST compliance is mandatory, not aspirational.
We don't sell the tools we recommend. Our assessments are vendor-neutral so findings reflect your actual risk, not a path to a product sale.
Every assessment produces evidence packages, control narratives, and artifacts formatted to satisfy C3PAO assessors, FedRAMP 3PAOs, and SOC 2 auditors — not just internal stakeholders.
We translate NIST control language into business risk. Board-level summary decks, CISO-level technical findings, and engineering-level remediation tickets — all from one engagement.
Outcomes
Illustrative benchmarks from past work — your mileage depends on offer, traffic, and sales follow-up.
A transparent, milestone-driven engagement from first call to launch.
We define the assessment boundary — which systems, data types, and organizational units are in scope. We align on the specific NIST framework(s) being assessed, collect existing documentation (SSPs, policies, network diagrams), and schedule stakeholder interviews. No surprises mid-engagement.
Our assessors conduct structured interviews with system owners, administrators, and leadership; review technical artifacts and policy documentation; and perform hands-on technical testing (configuration review, vulnerability scanning, log analysis). Every finding is tied to specific evidence.
We map findings to specific NIST controls or CSF subcategories, assign maturity scores or control determinations, and calculate risk using likelihood/impact scoring per NIST SP 800-30. Gaps are categorized by severity and sequenced for remediation based on risk reduction per dollar spent.
Final deliverables include an executive summary (board-ready), full technical findings report, current-state and target-state profiles, prioritized POA&M, and a remediation roadmap with timelines and effort estimates. We present findings directly to your leadership and answer every question.
FAQ
Straight answers — scoped to what you sell and who has to sign off.
Next step
Schedule a free 30-minute scoping call. We'll tell you exactly which NIST assessment applies to your situation, what the engagement looks like, and what it costs — before you commit to anything.
Based at 1717 N Street NW, Washington, DC · hello@thoriumdc.com · (202) 666-9377