Public trust depends on systems citizens never see.
Agencies and the companies that serve them face authorization regimes and public accountability few others do. We help both sides meet them, from boundary design and engineering to an assessment-ready package.
What is at stake.
- 01
Authorization to operate
Systems need formal authorization, then continuous monitoring.
- 02
Contract eligibility
For defense and many state contracts, security status decides the award.
- 03
Citizen data
Tax, benefits and justice data demand the highest protection.
Where the exposure actually sits.
- R1
Nation-state intrusion
Long-dwell campaigns against identity, edge devices and supply chains.
- R2
Legacy modernization
Migrations that widen exposure while old and new systems coexist.
- R3
Contractor access
Integrators with privileged access across agency boundaries.
- R4
Service disruption
Ransomware against local government, courts and public services.
The rules that shape the work.
The instruments that set the bar in this sector, and what each one demands.
FedRAMP
United States (federal)NIST SP 800-53 Rev. 5 baselines, with FedRAMP 20x running alongside Rev5. Assessed by accredited 3PAOs.
GovRAMP (formerly StateRAMP)
US states and localVerified security status for cloud providers serving state and local government.
CMMC 2.0 / NIST SP 800-171
US defense industrial basePhase 1 self-assessments apply now. Phase 2 brings C3PAO certification for most contracts that handle CUI.
FBI CJIS Security Policy
US criminal justiceVersion 6.0 (December 2024) aligns more closely with NIST SP 800-53.
How we respond.
Each engagement is scoped to your regulator, your deadline and the evidence your assessor will ask for.
A SaaS provider entering the public sector.
Federal and state interest arrived before the architecture was ready: shared services, no defined boundary. We weighed Rev5 against 20x, defined a boundary that kept government data separate and sequenced GovRAMP and FedRAMP to reuse evidence.
Questions clients ask us.
What does MarkTillson do for FedRAMP and CMMC?
Everything before the formal assessment: scoping, boundary design, cloud security engineering, documentation, mock testing and POA&M closure. An independent 3PAO or C3PAO then assesses a system that is already ready.
What is the difference between FedRAMP Rev5 and 20x?
Rev5 is the established, document-based path; 20x emphasizes automated, machine-readable validation. We track program changes as they are issued and advise which path suits your offering.
Does CJIS apply to cloud providers?
Yes, where a provider stores or processes criminal justice information for an agency.
Talk to a practitioner who knows your sector.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.