The defense supply chain runs on compliance.
Colorado Springs businesses carry a security burden most cities don't. Degarmo Technologies is a veteran-owned managed security services provider delivering managed IT, cybersecurity and CMMC 2.0 readiness to organizations across the Pikes Peak region.
If you touch a defense contract, your IT is in scope.
Fort Carson, Peterson Space Force Base, Schriever Space Force Base and the Air Force Academy anchor one of the densest concentrations of defense and aerospace employers in the country. That gravity reaches a long way past the primes — into the machine shops, engineering firms, logistics companies and professional services businesses that supply them.
If your company handles Federal Contract Information or Controlled Unclassified Information, your contract almost certainly carries security obligations. And unlike most compliance regimes, this one has teeth at the procurement stage: you can lose the ability to bid.
Where CMMC actually stands right now
The DFARS CMMC rule took effect 10 November 2025 and is enforceable in contracts today — Level 1 and Level 2 self-assessments. But on 13 July 2026 the DoD suspended the transition to Phase 2, halting Level 2 C3PAO assessments and Level 3 certification. No replacement dates have been published.
That is not a reprieve. Your contract obligation is unchanged, a self-assessment is a representation you are making to the government, and NIST SP 800-171 Rev 2 is still the baseline. No provider can certify you — that is a C3PAO function, and it is suspended anyway. What we do is the engineering underneath: implementing the controls, maintaining your System Security Plan and POA&M, and keeping the evidence current so your score is defensible rather than optimistic. More on our CMMC work →
Managed IT and security, run as one function.
Managed IT
Fully managed endpoints and servers, patching, monitoring and an unlimited business-hours helpdesk your team can actually call.
Managed cybersecurity
Managed EDR, 24/7 monitoring, email security, dark web monitoring and security awareness training for the whole staff.
Compliance as a service
CMMC 2.0 readiness, NIST SP 800-53 and 800-171, and HIPAA programs — maintained continuously, not rebuilt every audit cycle.
Backup and recovery
Backups with tested restores, Microsoft 365 backup, and documented recovery objectives you have actually seen demonstrated.
Cloud and Microsoft 365
Tenant hardening, identity and access management, licensing, and migration work handled without downtime theatre.
Virtual CIO
A technology roadmap and budget tied to your contract obligations, reviewed every quarter with someone who reads the same clauses you do.
Someone local, with real operations behind them.
We have someone based in the Pikes Peak region — so when a job needs hands on hardware, you get a local visit rather than a flight and a rescheduled week. Behind that sits our full operations capability: monitoring, patching, detection and response running continuously, wherever your office happens to be.
Onsite when it matters
Hardware replacement, network cutovers and new-office builds handled by someone who can drive to you.
Monitoring never sleeps
Detection, patching, alerting and response run around the clock. Distance is irrelevant to how fast we see a problem.
One team, not a queue
You get engineers who know your environment and your compliance posture, not whoever picks up next.
Serving the Pikes Peak region.
Colorado Springs and the surrounding communities, including:
Start with an honest assessment.
We will look at where you actually stand — against your contract obligations, not a generic checklist — and tell you what needs closing and what does not. If we are not the right fit, we will say so.