We deliver a compliant company, not a product: the NIST SP 800-171 program defense contractors sign for, the technology integrated behind it, and the upkeep that keeps it defensible.
Stehrling's team has worked together on 800-171 and CMMC for years, guiding defense primes, manufacturers, universities, and tribal enterprises through federal security requirements and building the compliance programs behind them.
We kept seeing the same failures. Firms that delivered a gap report and disappeared. Generic frameworks forced onto businesses they did not fit. Organizations left to figure out implementation alone, then asked to sign an affirmation for work nobody had verified.
Stehrling exists to do the work itself. We build the program with your team, in your environment, to the standard an assessor applies, and we stay after it is built.
Based in Fredericksburg, Virginia. Working with contractors across the country.
Brian led a defense contractor's team through two DIBCAC assessments. He is a cybersecurity and compliance executive with decades in the Defense Industrial Base, and an engineer by training: systems architecture, NIST frameworks, and DoD security standards shape how Stehrling approaches every environment.
His rule for client work: don't force a solution. Find the best business decision for the client and see it through.
Kate was that contractor's Affirming Official for both assessments, the executive who signs for its compliance. She brings 30 years in DoD consulting across delivery, program management, business development, and executive roles, including more than 15 years leading cybersecurity compliance work in the DIB, higher education, and manufacturing.
She leads client engagements toward outcomes that last: a program the organization can run and defend on its own.
Former Marine Corps officer with more than 25 years in the federal and defense markets, leading cybersecurity services delivery across risk management, compliance, and operations for DoD, federal, and critical infrastructure clients. He works across federal cyber and defense acquisition policy, CMMC, NIST SP 800-171, and NIST SP 800-53.
Recipient of the Presidential Volunteer Award for work supporting the CMMC Standards Working Group (2020 to 2021), and a current member of the CMMC Industry Standards Council.
Policies, procedures, training, change control, and the governance that makes them stick, written for how your organization actually operates. Roughly half of 800-171 is behavior, not configuration, and no tool delivers it.
We meet weekly, review your work, and explain the reason behind every control. When we are done, your people own the program and can run it without us.
Every member of our delivery team holds a CCA or CCP credential. The people building your program know what assessors evaluate, what evidence they accept, and where organizations get tripped up.
If your timeline is unrealistic, we will say so. If there is a simpler path, we will show you. We would rather lose a deal than set a client up to fail.
When a project needs more depth, we bring it in. Our bench includes CCAs, CCPs, and Registered Practitioners, plus cloud, network, and security engineers and database, IAM, and infrastructure specialists. For specialized execution such as managed enclaves or GCC High migrations, we work with vetted partners. Stehrling owns the program throughout.
Want to meet the team? Tell us where you are and we will put the right people on the call. Expect a reply within one business day.
Contact our team →
An independent firm building NIST 800-171 compliance programs and AI governance for defense contractors and the DIB.