Questions, answered plainly.

No. Voltstep isn’t a C3PAO, and CMMC rules keep whoever helps you prepare from assessing you. What we do is the readiness work: scoping, the gap analysis, policies, evidence, and a plan to close the gaps. Right now that supports a Level 1 or Level 2 self-assessment, your SPRS score, and the affirmation. If C3PAO assessments return for new awards, it’s the same preparation you’d take into one.

No. There’s no official HIPAA certification, from us or anyone else. What we do is the Security Rule risk analysis and gap assessment. We assess against the HIPAA Security Rule in effect today. HHS proposed a stricter version on January 6, 2025, and says the current rule still applies while that rulemaking continues. If you want a separate note on how the proposal would affect you, we can add one. We don’t represent clients before the Office for Civil Rights.

No. Only a licensed CPA firm can examine your controls and issue a SOC 2 report, and Voltstep isn’t a CPA firm. What we do is the readiness work before it: scoping, a gap assessment against the Trust Services Criteria, remediation, and evidence your CPA firm can follow.

No. The practice has three pillars: security leadership, agentic redesign, and regulatory readiness. CMMC is one option inside regulatory readiness, alongside SOC 2 readiness for SaaS and technology service providers, PCI DSS gap assessments for merchants and service providers, and HIPAA Security Rule gap assessments for covered entities, business associates, and health-tech vendors. All of it is delivered remotely anywhere in the U.S.

No. If your scope needs a pen test, we’ll tell you, and you can bring in a specialist for that piece.

Not as a package. If cryptography comes up during a readiness engagement, we’ll handle it inside that scope.

NIST SP 800-171 and CMMC Levels 1 and 2, PCI DSS, HIPAA, SOC 2, ISO/IEC 27001, the NIST Cybersecurity Framework, NIST SP 800-53, the CIS Controls, and CJIS. Nicholas has also worked with medical-device quality and risk standards, including ISO 14971 and IEC 62304.

Short version: CMMC is paused in Phase 1, and for now new contracts can only call for self-assessments. The detail, as of October 2026: Department of War memorandum 26-P-1023 (July 13, 2026) suspended the Phase 2 transition that had been set for November 10, 2026, and the DoW CIO page gives no new date. Until that changes, a new solicitation can designate Level 1 (Self) or Level 2 (Self), but not Level 2 (C3PAO) or Level 3. A C3PAO or Level 3 clause already in a contract stays until the contracting officer modifies it, which the memo directs at the next option or scheduled administrative modification. What has not changed: DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 safeguarding still apply, SPRS self-assessment scores are still required (annually for Level 1, every three years for Level 2), and affirming officials still affirm each year. Miss the annual affirmation and a Level 2 status lapses. Primes can still flow down stricter requirements, and the CIO page describes a reform review, so expect this to keep moving.

No. Nicholas is a Cyber AB Registered Practitioner, which covers CMMC readiness and implementation consulting, not assessing. He’s working toward the CCP and CCA credentials and doesn’t hold either yet.

It means Nicholas is working toward two Cyber AB credentials, CCP (Certified CMMC Professional) and CCA (Certified CMMC Assessor), and hasn’t earned either yet. We’ll change the site when a credential is actually granted, not before. Today he’s a Cyber AB Registered Practitioner and holds CISSP and CCSP.

No. A QSA has to stay independent of the controls they assess, so preparing you and assessing you are separate jobs. We do the preparing, so you go into your QSA assessment with the gaps closed and the evidence organized. Nicholas learned PCI as an employee, in payments, banking, and retail security at Mastercard, Ally, and H-E-B, and writing PCI conformance guidance at SecureLink.

No. Voltstep is a Native American small business, owned by a citizen of the Chickasaw Nation, but it doesn’t hold an MBE, 8(a), HUB, or similar certification, and we don’t claim one.

Nicholas Kanelos, the founder. He does the work himself. If a project needs a skill outside his, he brings in a vetted specialist for that engagement and tells you before work starts. There’s no standing staff.

Both, with the weight on engineering. We turn requirements into controls your engineers can build, including cloud configuration, identity, and pipelines on AWS, Azure, and GCP, and then into evidence someone else can check.

Yes. We work as a subcontractor under your contract, or as the prime on a direct engagement. When we’re the sub, the client stays yours. A task order can cover gap support, policy, the SSP and POA&M, or engineering. The For Partners page has the capability summary, the industry codes we plan to register, and our UEI and CAGE status.

Every engagement is quoted to its scope, from a fixed-scope package to a subcontract, so we don’t publish rates. You get a written scope and a price before any paid work starts. One request: please don’t put card numbers or CUI in the contact form.

Yes. We sign an NDA when the work calls for one, and we keep client data to the minimum we need. The contact form collects only what we need to reply. The privacy policy explains how we handle it.

We’re based in the Baltimore–DMV Metro corridor, where we also work onsite, and we work remotely with clients anywhere in the U.S. Voltstep Advisory is the practice of VOLTSTEP LLC, a Texas LLC registered to operate in Maryland.

It depends on your scope, the evidence you already have, and the deadline in your contract, so we won’t guess at a number of weeks here. Tell us the deadline, and we’ll tell you the first two steps.