CMMC and NIST 800-171 Readiness
Scope your environment, assess controls against the 110 requirements, build the SSP and POA&M, and close gaps in a defensible order ahead of assessment.
Learn moreAtlanta, Georgia
Cybersecurity, Compliance and AI-Enabled Solutions for Growing Organizations
Secure Technology Consultants helps government contractors and growing businesses reduce cyber risk, prepare for CMMC and NIST requirements, strengthen Microsoft 365, and build practical security programs without enterprise-level overhead.
Senior-led cybersecurity, compliance, and managed-services engagements aligned to your operations, contractual requirements, and risk priorities.
Atlanta-based cybersecurity and technology advisory
CMMC and NIST 800-171 focused advisory
Microsoft 365 security and governance depth
Metro Atlanta on-site and remote engagements nationwide
Core services
Security programs built to hold up under contracts, audits, and real incidents
Six engagement areas that can stand alone or work together as a single roadmap.
Virtual CISO and GRC Leadership
Executive security leadership on a fractional basis: policy, roadmap, budget guidance, vendor oversight, and board-ready reporting.
Learn moreCybersecurity Risk Assessments
Identify what would hurt the business most, rank exposures by likelihood and impact, and translate findings into a funded remediation plan.
Learn moreMicrosoft 365 Security and Governance
Harden identity and access, tune Defender and Purview configurations, and put data-sharing guardrails in place across Teams, SharePoint, and OneDrive.
Learn moreIncident Response and Business Continuity
Practical response playbooks, escalation paths, and tested recovery expectations so a bad day stays contained and documented.
Learn moreManaged Security and IT Operations
Ongoing monitoring, patch and endpoint hygiene, and day-to-day IT support aligned to the same control set your compliance program depends on.
Learn moreFrameworks and capabilities
We work in the standards your customers and contracts reference
Framework alignment is a means to an end: fewer unmanaged risks, cleaner evidence, and faster answers when a customer asks how you protect their information.
CMMC
Level 1 and Level 2 readiness planning, evidence organization, and assessment preparation support.
NIST SP 800-171
Control-by-control gap analysis, SSP and POA&M development, and CUI scoping guidance.
NIST Cybersecurity Framework
Profile development and maturity tracking across Govern, Identify, Protect, Detect, Respond, and Recover.
NIST Risk Management Framework
Categorization, control selection, and continuous monitoring practices adapted to smaller teams.
Microsoft Security and Governance
Identity, device, data, and tenant configuration baselines mapped back to your framework obligations.
AI Governance
Acceptable-use policy, data handling rules, model and vendor review, and human oversight for AI tools.
How STC works
A five-stage engagement model, repeated as your environment changes
- 01
Assess
Understand the business, systems, data flows, and obligations before recommending a single control.
- 02
Prioritize
Sequence work by risk reduction and compliance deadline so limited budget goes to what matters first.
- 03
Implement
Deploy controls, policies, and configurations with your team or ours, documented as we go.
- 04
Validate
Test that controls work as written and that evidence is complete enough to withstand review.
- 05
Continuously Improve
Review changes, threats, and audit findings on a regular cadence and adjust the roadmap.
Industries served
Organizations where security requirements arrive faster than headcount
Government and Public-Sector Organizations
Municipalities, county governments, public agencies, and government partners requiring defensible security, risk, compliance, and IT operational oversight.
Government Contractors and the Defense Industrial Base
Prime contractors, subcontractors, and professional-services firms working toward DFARS, NIST SP 800-171, CMMC, and customer-driven security requirements.
Healthcare and Public Health Organizations
Public-health, healthcare-support, research, and consulting organizations protecting sensitive operational, workforce, and program information.
Technology, Software, MSP and MSSP Organizations
Software developers, technology partners, MSPs, and cybersecurity providers requiring secure infrastructure, governance, service-delivery oversight, and client-data protection.
Insurance, Recruiting and Human Resources Firms
Organizations handling candidate, employee, customer, financial, and other sensitive personal information across cloud applications and distributed workforces.
Creative, Digital and Professional Services Firms
Agencies, consultancies, and growing service businesses that need practical security leadership and reliable IT operations without building a full internal department.
AI-enabled solutions
Adopt AI deliberately, with governance in place before the tooling
Our AI work starts with policy, data boundaries, and oversight. Where STC evaluates partner-developed product concepts, we identify them clearly as pilots or private demonstrations rather than generally available software.
Secure AI adoption
AdvisoryEvaluate where AI tools can help, what data they may touch, and the controls required before rollout.
AI governance
AdvisoryPolicy, review workflow, and oversight roles so AI use stays documented and defensible.
Workflow automation
AdvisoryReduce manual effort in security and compliance operations with reviewed, auditable automation.
AI Vendor and Data Risk Review
AdvisoryAssess prospective AI tools, including vendor safeguards, data access, privacy, security, and contractual risk before adoption.
Fleet and Field Operations Pilot
Testing opportunityA test-ready demonstration exploring vehicle tracking, field activity visibility, and conversational operational reporting.
Interested in a pilot or demonstration?
Pilot participation and private demonstrations are arranged case by case. Reach out to discuss fit, scope, and data handling.
Start the conversationWhy STC
Security leadership supported by a disciplined delivery model
Senior-Led Engagements
Every engagement receives experienced leadership, defined accountability, and clear communication from initial discovery through final recommendations and ongoing service delivery.
Scalable Service Delivery
STC aligns leadership, technical resources, and trusted service partners to the requirements, coverage, and specialized expertise of each engagement.
Right-Sized Solutions
Services are designed around the client's actual environment, risk, staffing, and budget rather than imposed from a generic enterprise template.
Security and Operations Together
Recommendations account for how technology is configured, supported, monitored, and used in day-to-day business operations.
Clear Executive Reporting
Findings, priorities, responsibilities, and roadmaps are documented so leadership can make informed decisions and track progress.
Leadership
Derek Hardmon
Founder and President
Derek Hardmon founded Secure Technology Consultants to help growing and regulated organizations strengthen cybersecurity, manage technology risk, and meet expanding contractual and compliance requirements.
Before founding STC, Derek held senior technology and information security leadership positions in financial services, including Vice President of Information Technology and Vice President, Information Security Officer. His experience also includes cybersecurity advisory, technology operations, risk management, governance, and security-program leadership across public-sector, regulated, managed-service, and commercial environments.
Under Derek's leadership, STC provides cybersecurity advisory, compliance readiness, Microsoft 365 security, managed security and IT operations, risk assessments, policy development, incident-response planning, vendor-risk management, and fractional security leadership.
STC uses a structured engagement model that defines scope, responsibilities, technical resources, escalation paths, documentation, and measurable outcomes. When an engagement requires additional capacity or specialized expertise, STC coordinates with qualified technology and service partners while maintaining clear accountability for delivery.
Selected delivery experience
Experience supporting organizations with complex security and operational requirements
Public-Sector Security Programs
Cybersecurity, risk, compliance, and technology-operations support for municipal, county, and other public-sector environments.
CMMC and NIST Readiness
Control assessments, environment scoping, SSP and POA&M development, evidence organization, remediation planning, and assessment preparation.
Managed Security and IT Operations
Endpoint monitoring, patch and vulnerability management, identity and access controls, Microsoft 365 security, operational support, and service-delivery oversight.
Security Program Development
Development and improvement of policies, governance processes, risk registers, incident-response procedures, vendor controls, executive reporting, and security roadmaps.
Concurrent Engagement Delivery
Experience coordinating multiple client engagements, technical priorities, stakeholder groups, and documentation requirements across public-sector and commercial environments.
Experience & Leadership
Experience built across security, technology, and organizational leadership.
Executive Technology & Security Leadership
Former Vice President of Information Technology and Vice President, Information Security Officer in financial services.
Cybersecurity Community Leadership
Served for several years on the Information Systems Security Association (ISSA) Metro Atlanta Chapter Board of Directors, including as Treasurer and Conference Chairman.
Board & Organizational Leadership
Former Board Member of The Intown Academy, an Atlanta charter school, with experience contributing to organizational governance and community leadership.
Contact
Let's talk about where your security program stands today
A short introductory conversation is usually enough to identify your most pressing gap and the practical next step. No obligation, no scripted pitch.
- Office
- Secure Technology Consultants, LLC
233 Peachtree Street NE, Suite 433
Atlanta, GA 30303 - Phone
- 404-692-0858
- Coverage
- Metro Atlanta on-site; remote engagements nationwide