(719) 785-0320


  • Imprims Inc
  • Imprimis Inc
  • Imprimis Inc | i2ACT-800 Compliance
  • Imprimis Inc | i2ACT-800 Compliance

Customer Support: 

Sales Support: 

Technical Support: 

Colorado Springs, CO © 2018 Imprimis, Inc.         





A highly-structured approach to the cyber compliance process supported by a suite of very effective productivity tools in the form of compliance software programs, i2Express packages, multiple general report templates, and the availability of subject matter experts yield more accurate results in much less time

… that is why we are …



We deliver Cybersecurity Solutions in a comprehensive “Services Suite” that leverages our IC2E Cybersecurity Compliance Essentials with our industry leading i2ACT-800 Software Tools to provide a complete NIST 800-171 or NIST 800-53 DSS AAPM Assessment.  From here we add our i2Express Cybersecurity Compliance Packages which deliver the completed Policies and Procedures, Systems Security Plan (SSP) and Plan of Actions & Milestones (POA&M).  The process is completed with a full set of recommendations and remediations which can be combined with our Integrated Cybersecurity Sustainment Services that include Continuous Monitoring, CISO Services, Vulnerability Scanning and Training for long-term compliance.


Imprimis provides NIST 800-171 and NIST 800-53 DSS AAPM Assessment packages which combine the i2ACT-800s or i2ACT 800 Pro compliance tools with a complete assessment which can be performed either onsite or remotely.  The packages offer a fast and cost-effective beginning to your cybersecurity compliance process.

NIST 800-171 Assessment Package

  • An established NIST 800-171 database within the i2ACT-800s.

  • An assessment report detailing compliance with the DFARS requirements.

  • A remediation plan detailing all noncompliant requirements and the general tasks that must be completed to become compliant.


NIST 800-53 DAAPM Assessment Package

  • ​A DSS established NIST 800-53 database within the i2ACT-800 PRO tool.

  • An assessment report detailing compliance with the DFARS requirements and specific DSS requirements.

  • A remediation plan detailing all noncompliant requirements and the general tasks that must be completed to become compliant specific to NIST 800-53 and the DSS AAPM requirements.






Based upon Imprimis, Inc.’s experience in the cybersecurity compliance field; and the need of Department of Defense contractors to quickly have completed NIST 800-171 assessments, Plans of Actions and Milestones (POA&M), System Security Plans (SSP) and supporting Policies and Procedures (P&P); Imprimis has developed compliance packages to achieve those goals quickly while minimizing the expense.

These packages take into consideration accepted cybersecurity principles and “Best Practices” that can greatly reduce remediation costs and time it takes to reach compliance.  These compliance milestones allow DoD contractors to be eligible to compete for and retain contracts in as little as 1 month!


The POA&M Package was developed by Imprimis so that remediation tasks and actions identified as needed during the assessment can quickly be included and scheduled in the POA&M and inserted into a Microsoft Project worksheet. 

These tasks collectively define the plan that will support the client to move from the current configuration to a fully compliant state.

  • Provide the customer a tailored POA&M which will include all remediation activities which need to be completed for full compliance

  • If requested, Imprimis will lead facilitated meetings with customer to define options, including cost and implementation lead times, to achieve the final schedule for all tasks.

  • The customer will make decisions on key elements which include network changes required, key technology/system selections such as multi-factor authentication, backup, monitoring and scanning selections, and will make the final decisions on schedule based on the customer’s needs and resources available.



  • Customer POA&M in MS Project or Excel (can apply to open source project management tools)


Utilizing the I2ACT SSP Template and working closely with the customer, a NIST 800-171r1 and DFARS compliant SSP will be developed as follows:

  • System definition including diagrams and hardware/software inventories

  • Identification of the customer’s management organization with responsibility for the protecting the business, Information Technology, and controlled Unclassified Information (CUI) 

  • Risk analysis/assessment

  • Inclusion of the most current NIST 800-171 assessment

  • Recommended inclusion of the customer’s Policies and Procedures and POA&M (If any controls are noncompliant, the POA&M is a required component of the SSP.)



  • Draft customer SSP


More than 100 of the 110 requirements in NIST 800-171 call for governing policies and procedures.  The Imprimis P&P document addresses this need and is designed to be adopted “as is” and will require no changes.  This package provides direct mapping of NIST 800-171r1 requirements to the policies and procedures a company needs to implement to be compliant  with the added benefit of saving money and resources typically incurred when developing P&P’s.   Of course, the customer can modify or adjust the P&P at any time as they see fit.  


A training briefing and video are included with this package, so all employees can immediately be trained on the adopted P&P.


Policies and Procedures Package includes:

  • Two separate documents – a Policy document and a Procedure document which allows for easy future additions/deletions

  • Facilitated review of the P&P package with the customer as  

  • Incorporation of minor changes after customer review if necessary

  • Assistance with customer’s approval process for P&P adoption

  • Overview of the training briefing and video

  • A draft Incident Response Plan (IRP)


Note: This P&P Package does not include completely customized P&P preparation, re-writing of existing customer policies and procedures, or actual training of employees.



  • Final tailored P&P package


The purpose of the Incident Response Plan (IRP) is to plan, implement, and maintain a robust incident-handling capability for organizational information and operational systems.  This capability includes preparation, detection, analysis, containment, recovery, and user response activities.   The IRP Package will be prepared working jointly with client,  taking into account their existing corporate culture, processes and IT knowledge base and will provide the:

  • Establishment of the Cyber Incident Response Team (CIRT) which includes corporate management, the Chief Information Security Officer (CISO) and IT management and staff.

  • Definition of the process for responding to incidences.

  • Determination of the appropriate documentation and reporting to be included with incident responses.


Once the IRP is in place, the client will be responsible for training their management and staff on incident response and developing mock incident response exercises multiple times per year.
Final tailored Incident Response Plan

As small businesses become increasingly dependent on internet-based services and applications, they also become a larger target for cybercriminals looking to exploit vulnerabilities, to steal money and information as well as possibly destroy data and disrupt operations.  As a result, it is crucial for small businesses, small manufacturers, as well as small financial and information/IT consulting firms (who process and manage confidential information for their clients) to take proper cybersecurity measures – to protect their customers, their firms, their partners and their confidential information within.   That is why Imprimis (i2)created  i2CyberStart.


i2CyberStart Program - Commercial Cybersecurity Compliance:

This unique Commercial Cybersecurity Compliance solution is tailored for small businesses that utilize industry standard cybersecurity frameworks (like the NIST CSF), or no cybersecurity framework, and contains several innovative Imprimis Cybersecurity Compliance Essentials, (or what we call “IC2E”) which are customized assessment tools, best practices, and recommendations from our experience in the field with customers solving their cybersecurity challenges.


The i2CyberStart program which is part of our integrated Imprimis Cybersecurity Suite of services, has been designed for commercial businesses not needing to be NIST 800-171 compliant.  i2 recognizes the need for every business to be cybersecure – no company is safe from cyberattacks and all will be targeted.  This program is targeted for small to medium sized businesses, however it dynamically scales up for use with larger commercial enterprises as well.


It ensures that the basic requirements for a minimum level of security are met and allows companies to build on that security as time moves on as their operational and security requirements change.


Cybersecurity Assessment, Planning, Remediation and Sustainment:

The i2CyberStart Program” is designed to provide companies a path to ‘on-ramp’ cybersecurity programs gradually, dramatically reducing cyber risk yet with manageable costs and a foundation capable of growing to strong mature cybersecurity programs. The i2CyberStart Program allows Imprimis to carefully guide a company through 4 primary stages of cybersecurity compliance processes;




                           provides the following key benefits:

  • A rapid evaluation of the current cybersecurity profile of the company focusing on policies and procedures, operational readiness, IT and networking gaps identifying and prioritizing all security needs.

  • A ‘to-be’ network design is identified to dramatically reduce risk for low initial investment .

  • A cybersecurity insurance solution is suggested to round out the company’s risk management program.

  • The solution will be offered through a framework that allows for expansion and growth into more stringent cybersecurity profiles to include cybersecurity standards such as the NIST frameworks and standards, OSI, and others.


The                                 Program is Delivered in Four Phases:










Phase 1 – Assessment & Planning

  • Cyber Readiness Report

  • CyberFense Scan

  • Presentation of Results


Phase 2 – Policies & Procedures - Gap Analysis and Requirements Definition

  • Initial Customer Interview

  • IC2E Cybersecurity Assessment

  • Network Inspection and Discovery

  • Insurance Underwriting Data

  • Briefing


Phase 3 – Design and Build


  • Design of a “To Be” Network

  • Develop a Plan of Action and Milestones (POA&M)

  • Cyber Insurance Options and Review

  • Briefing – Design and Plan of Action


Phase 4 – System Build, Implementation and Sustainment

  • Core System Build

  • Core Inspection

  • Documentation

  • Sustainment

  • Management Briefing and Insurance Acquisition








The Turnkey Information Security & Compliance (TISC) program is designed to bring clients into compliance with DFARS 204.73 rapidly and at the lowest cost possible.  It was designed and developed by Imprimis based on years of experience bringing clients into compliance, and utilizes detailed packages and databases developed by Imprimis based on real-world experience.


The normal progression of compliance is shown in Figure 1 and involves assessing the system and organization and identifying actions required to bring the organization into compliance. This is followed by the development of a remediation plan and budget along with the development of a System Security Plan (SSP).  These two phases of the process tend to be very labor intensive.  The remediation is usually spread over a long period of time for a couple of reasons.  First, the governance program requiring the development of policies and procedures is very difficult to accomplish and very, very labor intensive.


Assessment or Gap Analysis

Plan of Action & Milestones (POA&M)

System Security Plan (SSP)



FIGURE 1 - Normal Compliance Progression

The second reason is that implementing security core competencies and controls can disrupt the normal operation of the organization and therefore, must be done at times where this impact can be minimized.  Once remediation is completed, most organizations tend to “let up” having achieved their goal and do not carefully tend to compliance sustainment or remaining in compliance.  This leads to  compliance “porpoising,” surging into compliance with great effort and then rapidly falling out of compliance, and repeating the process as needed.  This is particularly true for smaller organizations that do not have dedicated staff.

Imprimis has developed a process for smaller organizations that do not have dedicated staff that both achieves compliance and supports them throughout sustainment.  This process is referred to as the Imprimis Turnkey Information Security & Compliance or TISC.  The flow of TISC is shown in Figure 2. 























This flow allows the organization to achieve compliance and sustain compliance in the least amount of time and for the least cost.  The single greatest cost in compliance is labor- both internal labor and external labor.  The turnkey model minimizes both categories of labor and sets up the sustainment activity as well.  As these are bid as fixed-price-completion projects, the uncertainty of the “real” cost is removed. 

Important to note, the turnkey approach works for organizations that need to comply with various standards and it applies to organizations who do not need to comply to a standard but want to establish a good cybersecurity program.  Imprimis offers the CyberStart™ program for such organizations providing a turnkey project that transforms the organization’s cyber profile to one employing best practices and supports the organization in obtaining the proper cybersecurity insurance to round out their risk management program.






Ready Packages

  • P&P

  • SSP

  • POA&M

Security Core Competencies

  • NGFW

  • IDS

  • EPP

  • Network Security (Cloud/Virtual)

  • Access Control

  • Physical Security

  • Encryption Technology



  • Continuous Monitoring

  • Vulnerability Management

  • Training

  • CISO Services

  • Incident Response

FIGURE 2 - Turnkey Security & Compliance Flow



Once an organization achieves full compliance with NIST 800-171 or any other standard or regulation, they need to commit to ongoing efforts to remain in compliance – or sustain compliance.  Imprimis provides a full suite of supporting services.  These are divided into two groups – Continuous Sustainment Services and On-Demand Services.

The continuous activity includes continuous monitoring of the system, frequent vulnerability scans, part-time CISO (Chief Information Security Officer) support and training.  Imprimis also provides support when needed or on-demand.  These services include incident response, forensic analysis, annual reassessments and advisory services.

Continuous Sustainment Services

  • Continuous Monitoring

  • Vulnerability Scanning

  • Part Time CISO Services

  • Training

On-Demand Sustainment Services

  • Incident Response

  • Forensic Analysis

  • Advisory Services

  • On-Site Training

  • Annual Reassessments

  • Supply Chain Management


Imprimis provides continuous monitoring via a cloud-based SIEM (Security Information & Event Management) which collects logs and network information from multiple devices and ahs the ability to correlate activities and identify anomalies.  The analysis also includes behavioral analysis utilizing a UEBA (User or Entity Behavioral Analysis) program.  Logs and data are collected from key devices within the network and stored in a cloud-based SIEM where the UEBA analysis takes place.  Alerts are issued for anomalies and the logs are maintained for at least 12 months.  One of the primary benefits of continuous monitoring is tracking logins and failed login attempts.  With proper network segmentation activities within the network can be tracked as well.




Another very important capability is to scan the network for vulnerabilities.  Vulnerabilities exist within the software used for operating systems and applications.  They can also include open ports and exposed network segments.  Imprimis installs scanner software within the network to provide the scanning information, the internal scans show open ports, and any un-remediated software vulnerabilities on all devices within the network.  The scanning software also performs a discovery scan which is important for asset management - both software and hardware assets.  Vulnerability scans of externally facing IP addresses are scanned periodically to ensure no vulnerabilities are exposed outside of the network.


  • Policies & Procedures Courses

  • Role-Based Training

  • Smart Cyber Citizen™      On-line Courses

  • KnowBe4 Training Packages


Imprimis provides training as part of the sustainment support.  Training is a mandatory compliance requirement and is one of the most important activities a company can provide as part of their cybersecurity program. More than 3 out of 4 successful attacks involve the compromised accounts of someone who is authorized to be on the system. 

Imprimis provides training to staff and executives on policies and procedures of the company, and the responsibility of key people who have responsibility for managing risk.  These would include such courses as the role and responsibilities of data owners or network owners.  In addition, Imprimis provides the Smart Cyber Citizen™ classes to enhance awareness of staff at all levels.  Imprimis also provides KnowBe4 training to enhance skills in the cyber domain.


Annual Reassessment Services

An assessment will be performed annually to ensure full compliance with NIST 800–171 and the development of a POA&M will be done if necessary.

Supply Chain Support

Supply chain support will include 1) making all subcontractors and suppliers aware of CUI, educating them how to deal with CUI and comply with cybersecurity requirements, 2) working with key members of the supply chain to ensure that they are in compliance or assist them in becoming compliant, 3) monitoring the supply chain to ensure continued compliance.

Crisis Incident Response Services

Respond in accordance with governing policies and procedures, the SSP, and information security best practices to actual incidences that have significantly affected an organization’s ability to operate (e.g., Petya & FedEx) by providing on-site/remote technical advice, forensic analysis, and remediation recommendations/services. 

Ongoing Cybersecurity Advisory Services

Provide advisory services during sustainment to support continuous improvement.  Support information security testing and exercises as required.  Provide support as required to remediate cyber security issues.

Recurring Training

Provide recurring training for all employees and additional role-based training for IT and cyber security personnel.

CISO / Risk Management Advisory Services

Provide the services of a very senior subject matter expert to act as the CISO or Interim CISO or advise the Chief Information Security Officer or CISO, the corporate risk management executive, and senior management regarding cyber-based risks and provide senior management with recommendations to remediate deficiencies and strengthen overall cyber security and risk management.


Cyber Insurance is no longer considered ‘nice to have but not necessary’ – it is one of the most important aspects of cyber protection and fiduciary responsibility.

Imprimis can provide access to Cyber Insurance options at most favorable rates based upon a company’s cybersecurity posture and profile as well as discounted personal ID Protection for each of your employees through ID Shield.