Federal contractors · Tampa Bay
The cybersecurity your federal contracts already require, done before the contracting officer asks
IT and security for Tampa Bay construction companies, manufacturers and engineering firms that hold or bid federal contracts, defense work especially. We close the gaps and keep the evidence behind your self-assessment.
What we hear from federal contractors
A score nobody can back up
Someone entered a NIST SP 800-171 score in SPRS a while ago. If the contracting officer asked for the evidence behind it tomorrow, would anyone know where it is?
An affirmation signed on faith
Each year someone at the company affirms in writing that the requirements are met. An affirmation that isn't accurate can bring False Claims Act exposure.
Crews and subs on personal phones
Field crews and subcontractors open drawings and email on their own phones, outside anything the company controls.
Drawings and specs sent by email
Contract drawings, specs and submittals travel as email attachments and sit in inboxes and download folders nobody tracks.
Not sure what's FCI and what's CUI
Until you know which kind of contract information you hold and where it lives, you can't tell which requirements apply or how far they reach.
What we do
Managed IT and security first, from a local team that has kept Tampa Bay businesses running since 2005.
Find where contract information lives
We map where Federal Contract Information and any Controlled Unclassified Information sit, who touches them, and which systems are in scope.
Close the gaps, requirement by requirement
We work through FAR 52.204-21's basic safeguarding requirements, and NIST SP 800-171 where CUI is present, and fix what's missing in order of risk.
Evidence you can hand over
Policies, settings, screenshots and logs filed against each requirement, so your self-assessment score and your annual affirmation rest on something you can show.
Phones and laptops in the field
Company accounts, multi-factor sign-in and device management for the phones and laptops crews use on site, plus a clear rule for personal devices.
Monitoring and incident readiness
Monitoring, updates and backups, and a written plan for the 72-hour cyber-incident report that DoD contracts with CUI require.
AI, used safely
AI can take paperwork off estimators and project managers, but contract information comes with rules. We set up approved AI tools on company accounts and write down what may go into them, with a section for Federal Contract Information and CUI.
TampaTeks is not a CMMC third-party assessor (C3PAO) and doesn't certify anyone. We prepare you: we close the gaps, keep the evidence, and help you answer your self-assessment and affirmation accurately.
Start here
Federal Contractor Cyber Readiness Assessment
We find where your contract information lives, check it against the requirements your contracts carry, and hand you the evidence and a plan for the gaps.
What you get
- The scope of your FCI and CUI: where it lives and who touches it
- A requirement-by-requirement gap list against FAR 52.204-21, and NIST SP 800-171 where CUI is present
- An evidence pack for your self-assessment and annual affirmation
- A remediation roadmap, in order of what matters most
From $2,500 fixed
Done in 10 business days for most offices.
Credited in full toward a 12-month managed IT agreement signed within 60 days.
Talk to us about itNot sure yet? Start with the Free IT Health Check. It costs nothing.
Free download
AI Acceptable Use Policy Template
A ready-to-edit policy for how your team uses AI tools: which tools are approved, what information may go into them, and what to do when something goes wrong. It includes an appendix for Federal Contract Information and CUI. Word format; plan on about an hour to fill it in.
Questions we get
Is CMMC still happening?
Partly. Phase 1 has been in effect since November 10, 2025: contracts can require CMMC self-assessments and an annual affirmation. Phase 2, third-party certification, was set to start November 10, 2026, but the Department suspended it on July 13, 2026 while a reform task force reviews the program. As of November 2026 there is no restart date. The requirements in FAR 52.204-21 and DFARS 252.204-7012 still apply either way.
Can you get us CMMC certified?
No. Only an authorized third-party assessor (a C3PAO) can certify a company, and TampaTeks is not one. We get you ready: we close the gaps, build the evidence, and help you answer your self-assessment and affirmation accurately, so you're prepared if third-party assessments return.
We only handle FCI, not CUI. Does this apply to us?
Yes, at a smaller scale. Contracts with Federal Contract Information carry FAR 52.204-21's 15 basic safeguarding requirements. Controlled Unclassified Information on a DoD contract adds DFARS 252.204-7012 and NIST SP 800-171's 110 requirements. The assessment starts by working out which one you have.
We're a subcontractor. Do these rules reach us?
Usually. The safeguarding clauses flow down to subcontracts that handle FCI or CUI, so your prime may ask for your score or your affirmation before it awards the work.
How big does our company need to be?
We usually work with companies where 15 or more people use a computer or phone for work, in the office or in the field. Smaller than that? Talk to us anyway, and we'll tell you honestly whether we're the right fit.
See where you stand, at no cost
The Free IT Health Check reviews your computers, security and backups. Takes a minute to request.
This page describes IT best practices. It is not legal or regulatory advice, or contract advice.