CMMC and NIST 800-171 Readiness
Scope your environment, assess controls against the 110 requirements, build the SSP and POA&M, and close gaps in a defensible order ahead of assessment.
Learn moreAtlanta, Georgia
Cybersecurity, Compliance and AI-Enabled Solutions for Growing Organizations
Secure Technology Consultants helps government contractors and growing businesses reduce cyber risk, prepare for CMMC and NIST requirements, strengthen Microsoft 365, and build practical security programs without enterprise-level overhead.
Advisory engagements led by a hands-on practitioner, scoped to your contracts and your team.
Atlanta-based, practitioner-led advisory
CMMC and NIST 800-171 focused advisory
Microsoft 365 security and governance depth
Metro Atlanta on-site and remote engagements nationwide
Core services
Security programs built to hold up under contracts, audits, and real incidents
Six engagement areas that can stand alone or work together as a single roadmap.
Virtual CISO and GRC Leadership
Executive security leadership on a fractional basis: policy, roadmap, budget guidance, vendor oversight, and board-ready reporting.
Learn moreCybersecurity Risk Assessments
Identify what would hurt the business most, rank exposures by likelihood and impact, and translate findings into a funded remediation plan.
Learn moreMicrosoft 365 Security and Governance
Harden identity and access, tune Defender and Purview configurations, and put data-sharing guardrails in place across Teams, SharePoint, and OneDrive.
Learn moreIncident Response and Business Continuity
Practical response playbooks, escalation paths, and tested recovery expectations so a bad day stays contained and documented.
Learn moreManaged Security and IT Operations
Ongoing monitoring, patch and endpoint hygiene, and day-to-day IT support aligned to the same control set your compliance program depends on.
Learn moreFrameworks and capabilities
We work in the standards your customers and contracts reference
Framework alignment is a means to an end: fewer unmanaged risks, cleaner evidence, and faster answers when a customer asks how you protect their information.
CMMC
Level 1 and Level 2 readiness planning, evidence organization, and assessment preparation support.
NIST SP 800-171
Control-by-control gap analysis, SSP and POA&M development, and CUI scoping guidance.
NIST Cybersecurity Framework
Profile development and maturity tracking across Govern, Identify, Protect, Detect, Respond, and Recover.
NIST Risk Management Framework
Categorization, control selection, and continuous monitoring practices adapted to smaller teams.
Microsoft Security and Governance
Identity, device, data, and tenant configuration baselines mapped back to your framework obligations.
AI Governance
Acceptable-use policy, data handling rules, model and vendor review, and human oversight for AI tools.
How STC works
A five-stage engagement model, repeated as your environment changes
- 01
Assess
Understand the business, systems, data flows, and obligations before recommending a single control.
- 02
Prioritize
Sequence work by risk reduction and compliance deadline so limited budget goes to what matters first.
- 03
Implement
Deploy controls, policies, and configurations with your team or ours, documented as we go.
- 04
Validate
Test that controls work as written and that evidence is complete enough to withstand review.
- 05
Continuously Improve
Review changes, threats, and audit findings on a regular cadence and adjust the roadmap.
Industries served
Organizations where security requirements arrive faster than headcount
Government and Public-Sector Organizations
Municipalities, county governments, public agencies, and government partners requiring defensible security, risk, compliance, and IT operational oversight.
Government Contractors and the Defense Industrial Base
Prime contractors, subcontractors, and professional-services firms working toward DFARS, NIST SP 800-171, CMMC, and customer-driven security requirements.
Healthcare and Public Health Organizations
Public-health, healthcare-support, research, and consulting organizations protecting sensitive operational, workforce, and program information.
Technology, Software, MSP and MSSP Organizations
Software developers, technology partners, MSPs, and cybersecurity providers requiring secure infrastructure, governance, service-delivery oversight, and client-data protection.
Insurance, Recruiting and Human Resources Firms
Organizations handling candidate, employee, customer, financial, and other sensitive personal information across cloud applications and distributed workforces.
Creative, Digital and Professional Services Firms
Agencies, consultancies, and growing service businesses that need practical security leadership and reliable IT operations without building a full internal department.
AI-enabled solutions
Adopt AI deliberately, with governance in place before the tooling
Our AI work starts with policy, data boundaries, and oversight. Where STC evaluates partner-developed product concepts, we identify them clearly as pilots or private demonstrations rather than generally available software.
Secure AI adoption
AdvisoryEvaluate where AI tools can help, what data they may touch, and the controls required before rollout.
AI governance
AdvisoryPolicy, review workflow, and oversight roles so AI use stays documented and defensible.
Workflow automation
AdvisoryReduce manual effort in security and compliance operations with reviewed, auditable automation.
AI Vendor and Data Risk Review
AdvisoryAssess prospective AI tools, including vendor safeguards, data access, privacy, security, and contractual risk before adoption.
Fleet and Field Operations Pilot
Testing opportunityA test-ready demonstration exploring vehicle tracking, field activity visibility, and conversational operational reporting.
Interested in a pilot or demonstration?
Pilot participation and private demonstrations are arranged case by case. Reach out to discuss fit, scope, and data handling.
Start the conversationWhy STC
Senior-level judgment, delivered at the scale of your organization
Practitioner-led engagements
You work directly with the person doing the assessment, not a handoff chain.
Right-sized for your team
Programs built for the staff and budget you actually have, not an enterprise template.
Compliance and operations together
Security decisions account for how your systems are supported and run day to day.
Plain-language reporting
Findings and roadmaps written so leadership can act on them without translation.
Founder & Principal Consultant
Derek Hardmon
Cybersecurity, GRC and IT Operations Leader
Derek Hardmon founded Secure Technology Consultants to give organizations direct access to experienced cybersecurity and technology leadership—without the cost or complexity of building every capability internally.
Before founding STC, Derek spent more than a decade in financial services, holding vice-president-level leadership positions in information technology management and information security. His broader career includes work across municipal and county government, public health, energy-sector software, managed service providers, cybersecurity operations, and growing professional-services organizations.
This experience enables Derek to connect security decisions with operational realities, regulatory responsibilities, customer expectations, and business priorities. His work includes cybersecurity and technology assessments, NIST-aligned governance, CMMC readiness, Microsoft 365 security, identity and access management, policy development, incident-response planning, vendor oversight, and managed IT operations.
Every STC engagement receives Derek’s direct involvement—from discovery and risk prioritization through recommendations, implementation oversight, documentation, and executive reporting. When specialized capabilities are required, STC can coordinate with trusted technology partners while remaining accountable for the engagement.
Contact
Let's talk about where your security program stands today
A short introductory conversation is usually enough to identify your most pressing gap and the practical next step. No obligation, no scripted pitch.
- Office
- Secure Technology Consultants, LLC
233 Peachtree Street NE, Suite 433
Atlanta, GA 30303 - Phone
- 404-692-0858
- Coverage
- Metro Atlanta on-site; remote engagements nationwide