Cyber, Defense & GovCon

Business cyber readiness in Maryland

A Baltimore professional firm, an Annapolis contractor and a Lexington Park engineering supplier may depend on the same email and payment tools while handling very different information. Begin with the work that would stop if an account, device or outside service became unavailable. Give each critical process an owner and a practical recovery plan.

NIST’s Small Business Quick-Start Guide helps organize the work around governance, identifying risks, protection, detection, response and recovery. Use it to build a business plan that your employees and technology provider can follow.

A 30-minute meeting: could the team still finish today’s work?

Bring an operating manager, the person responsible for payments and your IT contact. This is a discussion exercise using fictional situations; keep live systems running. Record each gap as task, owner, next step and due date.

1. Minutes 1–10: one essential service is unavailable. Choose scheduling, customer files, dispatch or order processing. Identify the work due today, the people waiting for it and the approved temporary process. Find the provider’s support number without relying on the affected account.
2. Minutes 11–20: a familiar supplier requests new payment details. Walk through how your team verifies the change using an established contact route and obtains approval. Include the person who covers payments when the usual approver is away.
3. Minutes 21–30: the service returns, but yesterday’s work is missing. Ask which records can be restored, who authorizes recovery and how staff will check that the result is usable. Assign three follow-ups and a date to review what was completed.

For a more formal exercise, CISA’s tabletop packages provide scenarios and planning materials. The FTC’s small-business guidance covers safeguards, vendor security and common attacks. The meeting above is Maryland Authority’s own planning exercise.

Choose a checklist that matches your business

Use these prompts to prepare your next provider conversation. Ask for evidence of what is configured and tested, including multifactor authentication, software updates, access reviews and backups.

• Professional firms and real estate businesses: identify who can open client documents, change payment details or recover a shared account. Check the departure process for former employees and the secure route for exchanging sensitive files.
• Retail, hospitality and local services: map dependencies between bookings, point-of-sale systems, delivery platforms and business email. Agree how staff will confirm existing reservations or orders during an outage without collecting information in an unapproved tool.
• Medical and care practices: identify scheduling, claims and communication dependencies. Rehearse the approved downtime process with clinical and administrative leaders so staff know where to get instructions and how to reconcile records afterward.
• Manufacturers and field-service teams: list vendor remote access, shop-floor or dispatch systems and their owners. Coordinate security changes with the people responsible for equipment safety and uptime; an office-computer procedure may not suit production machinery.
• Defense and federal suppliers: identify the customer information you receive, where it flows and which people or service providers can access it. Keep contract obligations and assessment evidence alongside the operational plan.

Six questions to ask a cybersecurity provider

1. What is covered? Request a list of devices, cloud accounts, locations, backups and outside connections. Identify systems that remain your responsibility.
2. Who acts after an alert? Clarify monitoring hours, investigation, escalation and who may approve containment. Get the after-hours contact process in writing.
3. What recovery has been demonstrated? Ask for a dated restoration test, what was restored and any gaps. Define the amount of work your business could afford to lose.
4. How is your access controlled? Ask about named administrator accounts, multifactor authentication, restricted permissions, activity logs and removal of access when work ends.
5. What happens if your service has an incident? Establish notification, coordination, access to relevant logs and an alternative way to reach support.
6. What is included in the price? Separate onboarding, routine support, security monitoring, incident-response work and testing. Define billable assets, minimum commitments, extra charges and how records transfer when you leave.

CISA’s guidance for managed service providers and smaller businesses addresses provider access, logging, backups and contractual responsibilities. Use the questions to compare written proposals.

Defense work needs a separate requirements review

The Fort Meade intelligence and cyber community, APG’s research and testing organizations, and the naval aviation work around Patuxent River offer different customer and teaming contexts. A supplier should identify the responsible organization and the actual solicitation or subcontract before buying a compliance package.

For that requirement, document whether you will handle Federal Contract Information or Controlled Unclassified Information, which systems are in scope, the required standard and revision, any assessment or affirmation, and who is responsible for each deliverable. Ask how a cloud or managed service provider fits into that scope. A general cybersecurity checklist does not establish contract eligibility or an assessment result.

Use the official CMMC program, the current contract documents and NIST’s government-contractor resources together. Confirm requirement-specific questions with the contracting officer or prime contractor. Recheck current instructions when a solicitation changes.

Regional context: Fort Meade mission, Aberdeen Proving Ground and Naval Air Warfare Center Aircraft Division.

Cybersecurity questions owners ask

Does managed IT include incident response?

The agreement determines the service. Ask who investigates a suspicious sign-in, who can take action and whether specialist incident support is included or billed separately. An ordinary help-desk contact is not enough information to answer those questions.

What should a business with limited time do first?

Identify essential accounts and services, name the people responsible for them, and review multifactor authentication, updates and recovery arrangements. Choose a small set of gaps with owners and dates. NIST’s quick-start guide gives the team a structure for continuing the work.

Is a backup confirmation enough?

Ask to see evidence that the records your business needs can be restored and used. Find out who can request restoration and which dependencies must also return. NIST’s incident-response resources include guidance on recovery planning and testing.

Where can Maryland businesses find support?

Maryland APEX Accelerator provides procurement counseling and information about government cybersecurity requirements. Maryland MEP’s manufacturing cybersecurity program covers training and assessments, including incident planning and IT/operational-technology security. Ask each program about current eligibility, availability and costs.

Cyber readiness resources reviewed November 2, 2026.