CMMC and NIST 800-171 Readiness
Scope your environment, assess controls against the 110 requirements, build the SSP and POA&M, and close gaps in a defensible order ahead of assessment.
Learn moreAtlanta, Georgia
Cybersecurity, Compliance and AI-Enabled Solutions for Growing Organizations
Secure Technology Consultants helps government contractors and growing businesses reduce cyber risk, prepare for CMMC and NIST requirements, strengthen Microsoft 365, and build practical security programs without enterprise-level overhead.
Advisory engagements led by a hands-on practitioner, scoped to your contracts and your team.
Atlanta-based, practitioner-led advisory
CMMC and NIST 800-171 focused advisory
Microsoft 365 security and governance depth
Metro Atlanta on-site and remote engagements nationwide
Core services
Security programs built to hold up under contracts, audits, and real incidents
Six engagement areas that can stand alone or work together as a single roadmap.
Virtual CISO and GRC Leadership
Executive security leadership on a fractional basis: policy, roadmap, budget guidance, vendor oversight, and board-ready reporting.
Learn moreCybersecurity Risk Assessments
Identify what would hurt the business most, rank exposures by likelihood and impact, and translate findings into a funded remediation plan.
Learn moreMicrosoft 365 Security and Governance
Harden identity and access, tune Defender and Purview configurations, and put data-sharing guardrails in place across Teams, SharePoint, and OneDrive.
Learn moreIncident Response and Business Continuity
Practical response playbooks, escalation paths, and tested recovery expectations so a bad day stays contained and documented.
Learn moreManaged Security and IT Operations
Ongoing monitoring, patch and endpoint hygiene, and day-to-day IT support aligned to the same control set your compliance program depends on.
Learn moreFrameworks and capabilities
We work in the standards your customers and contracts reference
Framework alignment is a means to an end: fewer unmanaged risks, cleaner evidence, and faster answers when a customer asks how you protect their information.
CMMC
Level 1 and Level 2 readiness planning, evidence organization, and assessment preparation support.
NIST SP 800-171
Control-by-control gap analysis, SSP and POA&M development, and CUI scoping guidance.
NIST Cybersecurity Framework
Profile development and maturity tracking across Govern, Identify, Protect, Detect, Respond, and Recover.
NIST Risk Management Framework
Categorization, control selection, and continuous monitoring practices adapted to smaller teams.
Microsoft Security and Governance
Identity, device, data, and tenant configuration baselines mapped back to your framework obligations.
AI Governance
Acceptable-use policy, data handling rules, model and vendor review, and human oversight for AI tools.
How STC works
A five-stage engagement model, repeated as your environment changes
- 01
Assess
Understand the business, systems, data flows, and obligations before recommending a single control.
- 02
Prioritize
Sequence work by risk reduction and compliance deadline so limited budget goes to what matters first.
- 03
Implement
Deploy controls, policies, and configurations with your team or ours, documented as we go.
- 04
Validate
Test that controls work as written and that evidence is complete enough to withstand review.
- 05
Continuously Improve
Review changes, threats, and audit findings on a regular cadence and adjust the roadmap.
Industries served
Organizations where security requirements arrive faster than headcount
Government and Public-Sector Organizations
Municipalities, county governments, public agencies, and government partners requiring defensible security, risk, compliance, and IT operational oversight.
Government Contractors and the Defense Industrial Base
Prime contractors, subcontractors, and professional-services firms working toward DFARS, NIST SP 800-171, CMMC, and customer-driven security requirements.
Healthcare and Public Health Organizations
Public-health, healthcare-support, research, and consulting organizations protecting sensitive operational, workforce, and program information.
Technology, Software, MSP and MSSP Organizations
Software developers, technology partners, MSPs, and cybersecurity providers requiring secure infrastructure, governance, service-delivery oversight, and client-data protection.
Insurance, Recruiting and Human Resources Firms
Organizations handling candidate, employee, customer, financial, and other sensitive personal information across cloud applications and distributed workforces.
Creative, Digital and Professional Services Firms
Agencies, consultancies, and growing service businesses that need practical security leadership and reliable IT operations without building a full internal department.
AI-enabled solutions
Adopt AI deliberately, with governance in place before the tooling
Our AI work starts with policy, data boundaries, and oversight. Where STC evaluates partner-developed product concepts, we identify them clearly as pilots or private demonstrations rather than generally available software.
Secure AI adoption
AdvisoryEvaluate where AI tools can help, what data they may touch, and the controls required before rollout.
AI governance
AdvisoryPolicy, review workflow, and oversight roles so AI use stays documented and defensible.
Workflow automation
AdvisoryReduce manual effort in security and compliance operations with reviewed, auditable automation.
AI Vendor and Data Risk Review
AdvisoryAssess prospective AI tools, including vendor safeguards, data access, privacy, security, and contractual risk before adoption.
Fleet and Field Operations Pilot
Testing opportunityA test-ready demonstration exploring vehicle tracking, field activity visibility, and conversational operational reporting.
Interested in a pilot or demonstration?
Pilot participation and private demonstrations are arranged case by case. Reach out to discuss fit, scope, and data handling.
Start the conversationWhy STC
Senior-level judgment, delivered at the scale of your organization
Practitioner-led engagements
You work directly with the person doing the assessment, not a handoff chain.
Right-sized for your team
Programs built for the staff and budget you actually have, not an enterprise template.
Compliance and operations together
Security decisions account for how your systems are supported and run day to day.
Plain-language reporting
Findings and roadmaps written so leadership can act on them without translation.
Founder & Principal Consultant
Derek Hardmon
Cybersecurity, Risk & Governance Leader
Derek Hardmon founded Secure Technology Consultants to give growing and regulated organizations direct access to experienced cybersecurity, risk, and technology leadership—without the cost or complexity of building every capability internally.
Before founding STC, Derek held senior technology and information security leadership positions in financial services, including Vice President of Information Technology and Vice President, Information Security Officer. His broader career has included cybersecurity, risk, technology operations, and advisory work supporting government, regulated organizations, managed service environments, and growing businesses.
Derek's approach connects cybersecurity decisions to business realities. Rather than treating security and compliance as separate technical exercises, he helps organizations understand what information and systems matter most, where meaningful risk exists, what requirements apply, and what should be addressed first. His work includes cybersecurity and technology assessments, NIST-aligned governance, CMMC readiness, Microsoft 365 security, identity and access management, policy development, incident-response planning, vendor risk management, security program development, and fractional cybersecurity leadership.
Every STC engagement includes Derek’s direct involvement—from discovery and risk prioritization through recommendations, implementation oversight, documentation, and executive reporting. When specialized expertise is required, STC coordinates with trusted technology partners while remaining directly accountable for the quality and outcome of the engagement.
Experience & Leadership
Experience built across security, technology, and organizational leadership.
Executive Technology & Security Leadership
Former Vice President of Information Technology and Vice President, Information Security Officer in financial services.
Cybersecurity Community Leadership
Served for several years on the Information Systems Security Association (ISSA) Metro Atlanta Chapter Board of Directors, including as Treasurer and Conference Chairman.
Board & Organizational Leadership
Former Board Member of The Intown Academy, an Atlanta charter school, with experience contributing to organizational governance and community leadership.
Contact
Let's talk about where your security program stands today
A short introductory conversation is usually enough to identify your most pressing gap and the practical next step. No obligation, no scripted pitch.
- Office
- Secure Technology Consultants, LLC
233 Peachtree Street NE, Suite 433
Atlanta, GA 30303 - Phone
- 404-692-0858
- Coverage
- Metro Atlanta on-site; remote engagements nationwide