Deep-Tech, Dual-Use & Defense

Sell to government and defense.
Clear the controls first.

Defense and dual-use buyers require CMMC, NIST 800-171, and export-control discipline before they will engage, and government cloud brings FedRAMP into scope. We build the SOC 2 floor and specify the rest with our export-counsel bench.

Book a call Start the free scoping
Why this matters for deep-tech

The contract starts
with controlled data.

Working with government or defense means handling controlled unclassified information and, often, export-controlled technology. A prime contractor will not flow work down to you without evidence that you protect that data to standard, and an export-control misstep is a serious legal matter with real consequences. These controls are the gate to the engagement.

What you need, when and why

The frameworks in your world,
and who owns each.

We deliver this in-house
SOC 2

The commercial security baseline your partners and investors expect. We assess, implement, and deliver this done-for-you as the foundation the specialist controls build on.

We specify and connect the right partner
CMMC NIST 800-171 ITAR / EAR export controls FedRAMP

The defense and export regimes that gate government work. We specify the controls and bring in our export-counsel bench and the right assessment partner to execute and certify them.

How the evidence gets built

One control, traced end to end.

Frameworks are abstract until you can see a single requirement turn into the artifact a reviewer actually reads. Here is one, the way it runs through the program.

The control
Controlled technical data is stored, accessed, and transmitted only inside an authorized boundary, and export-controlled information never reaches a foreign person without a license.
Where it is required
The NIST 800-171 requirements for protecting controlled unclassified information, the CMMC assessment that verifies them, and ITAR and EAR export-control obligations.
The evidence it produces
The data-flow and boundary diagram, the access-control and encryption evidence, the export-control classification of the technology, and the technology-control plan. A prime contractor or a government reviewer sees a defensible boundary they can verify.
Who it is for

Built for the companies
at the edge of policy.

Defense-adjacent deep-tech

Hardware and software companies pursuing defense or government contracts.

Dual-use technology

Products with both commercial and controlled applications under export law.

Government-cloud and gov-tech

Teams whose deployments bring FedRAMP and CUI protection into scope.

Tell us who you want to sell to. We will tell you which controls gate the contract.



or start the free scoping questionnaire at ferendis.com/start