Network Depot Ongoing Services Framework

Managed next-gen AV, behavioral detection, threat containment on all endpoints.

Log ingestion, correlation rule tuning, analyst review, automated alerting

Critical CVEs ≤14 days, high CVEs ≤30 days, monthly patch reporting

Weekly internal scans, monthly external scans, CVSS-based remediation tracking

NGFW rule management, IDS/IPS tuning, network segmentation maintenance

MFA enforcement, PAM/PIM, account provisioning/deprovisioning, quarterly recertification

Disk encryption (BitLocker/FileVault), TLS enforcement, key lifecycle management

Automated encrypted backups, monthly restore tests, immutable offline copies

Anti-phishing gateway, SPF/DKIM/DMARC config, DLP policy enforcement

CIS/STIG baseline enforcement, drift detection, automated compliance scanning

Corporate device enrollment, remote wipe capability, policy compliance enforcement

Unlimited tickets for all end users — password resets, software issues, connectivity, device troubleshooting, and general IT support via phone, email, and chat

Helpdesk-level triage for suspected phishing, malware alerts, and account lockouts — escalated immediately to SOC when thresholds are met

Living document updates, control implementation narratives, annual full review

Gap tracking, remediation milestones, status reporting, evidence of completion

Annual review of 19+ required policies and 12 SOPs, executive approval coordination

Score calculation, DoD portal submission, maintenance after material changes

Ongoing evidence packaging, compliance artifacts organized for C3PAO assessment

Quarterly privileged account reviews, user access certifications, exception documentation

Security impact analysis, change log maintenance, approval workflows for in-scope systems

Quarterly ESP reviews, contractual CMMC flow-down verification, risk scoring

CUI registry updates, data flow diagram maintenance, labeling compliance

Incident logs, 72-hour DFARS/DIBNet reporting, post-incident reports

Scheduling and tracking of all monthly, quarterly, and annual compliance activities

Secure device provisioning, compliant account setup, and full access revocation with asset recovery upon departure — completed within 1 business day

Approved software installation and removal, license tracking, enforcement of application allowlist policy across all in-scope endpoints

Policy ownership, executive reporting, risk governance, regulatory liaison

NIST SP 800-30 methodology, risk register, executive risk reporting, remediation prioritization

Annual training deployment, quarterly phishing simulations, role-based advanced training

Pre-assessment gap analysis, evidence package prep, assessor liaison, post-finding remediation

Annual pen test scoping, vendor management, findings review, remediation tracking

Annual scenario-based exercises, lessons learned report, IRP updates

Annual DR exercise coordination, RTO/RPO validation, BCP update

Critical supplier identification, SBOM management, counterfeit component guidance

Policy review for CMMC alignment, evidence support for renewals, claims coordination

CMMC rule updates, DFARS/FAR clause changes, NIST framework revisions — client briefings

CMMC requirement pass-through review, subcontractor assessments, contractual guidance

FedRAMP authorization validation, cloud misconfiguration monitoring, CASB controls

Strategic compliance roadmap, program performance review, upcoming milestone planning