Frequently Asked Questions

---

Submerged Cyber combines real-world cybersecurity leadership with practical compliance expertise. Our founder is a retired U.S. Navy Chief, CISSP, experienced vCISO, CMMC expert, and adjunct cybersecurity professor who has guided organizations through CMMC, HIPAA, HITRUST, NYDFS, and other regulatory frameworks. We focus on practical solutions that improve security while supporting your business goals.

We believe compliance should strengthen your business—not slow it down. Instead of delivering a checklist, we partner with you to build a sustainable cybersecurity program that reduces risk, supports growth, and prepares your organization for future requirements.

We primarily support small and mid-sized businesses that need to improve their cybersecurity posture or meet regulatory requirements. Our clients include Defense Industrial Base (DIB) contractors, manufacturers, healthcare organizations, financial services firms, engineering companies, professional service organizations, and other regulated industries. 

It begins with a conversation. We will discuss your business, current security posture, contractual requirements, and objectives, then recommend the services that best fit your needs. There is no obligation, and the consultation is complimentary.

Absolutely. Many of our clients begin with little or no understanding of compliance requirements. We guide organizations from initial scoping and gap assessments through implementation, documentation, and assessment preparation. 

Yes. Our vCISO services provide experienced cybersecurity leadership without the cost of hiring a full-time executive. We help develop security strategies, manage compliance initiatives, oversee risk management, and provide ongoing guidance tailored to your business.

We help organizations navigate:

• CMMC Level 1
• CMMC Level 2
• NIST 800-171
• HIPAA 
• HITRUST 
• NYDFS Cybersecurity Regulation 
• NIST Cybersecurity Framework (CSF) 
• CIS Controls 
• Risk management programs 
• Vendor security assessments 
• General cybersecurity governance and compliance initiatives

Yes. We frequently work alongside internal IT teams and Managed Service Providers (MSPs). Our focus is cybersecurity strategy, governance, compliance, and risk management—not replacing your existing IT support.

Yes. We offer engaging cybersecurity awareness training for employees, including phishing awareness, password security, social engineering, safe use of AI tools, data protection, and other topics designed to strengthen your organization's security culture.

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's cybersecurity framework for contractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). If your organization performs work for the DoD or is part of the defense supply chain, you may be required to meet CMMC requirements before you can win or maintain contracts. 

If your organization stores, processes, or transmits Controlled Unclassified Information (CUI), you will likely need to comply with CMMC Level 2 and the requirements of NIST SP 800-171. We can help determine your required certification level during a scoping assessment.