NIST, CMMC and Managed IT in St. Louis, MO
Somebody else put a deadline on your systems, and the letter did not explain itself.
It arrives as an attachment nobody warned you about. A prime contractor forwards a clause out of its own award and wants written confirmation that you already satisfy it. An enterprise customer sends a vendor security review with a return date. A broker wants policies, and the dates they were last exercised, before the renewal quotes. You have an IT company, and most days they do fine work. Nobody there can read the clause and tell you what it obligates you to build.
NOC Technology is an independently owned managed IT and cybersecurity provider, founded in 2009 and headquartered in Washington, Missouri, doing NIST 800-171, CMMC and HIPAA readiness work for businesses across St. Louis and the surrounding counties. Our owner, Jon Lober, holds the CMMC Registered Practitioner credential, so the clause gets read in this building.
A compliance binder bought once was out of date the week you paid for it.
Two patterns to listen for when you ask your current provider about this.
The first sells compliance as an object. A policy pack arrives from a template vendor with your name in the header, a scan runs, a PDF lands, somebody files it, and nothing in that sequence touches the systems the requirements describe. Eleven months on, a laptop has left, a share has been opened up, a service account holds a password that never expires, and the binder reads as it did on day one. We call that Compliance Drift, and there are five signs of it. The second pattern is softer and costs more: you forward the clause, somebody promises to look into it, and back comes a questionnaire from a consultancy you have never spoken to, which assesses, reports and leaves. Nobody owns the remediation, so the plan ages in a shared drive while the contract clock runs.
The belief underneath this page is simple. Once somebody with leverage wants evidence instead of assurances, technology stops being a support function in your company. The firm worth paying reads the obligation, maps it onto systems you own, fixes what fails, and produces proof on a defensible schedule. That premise runs through
why NOC and our
comparison page.
These are the obligations we work in, and what each asks you to hand over.
Named standards, named artifacts, and where our credential stops.
NIST SP 800-171, and the CUI question nobody asks early enough
NIST Special Publication 800-171 sets the requirements for protecting controlled unclassified information held on a system the federal government does not own. For Department of Defense work the obligation usually reaches you through DFARS clause 252.204-7012, covering safeguarding and cyber incident reporting, which flows downhill from a prime to any subcontractor whose performance touches it. The requirements sit in families: access control, audit and accountability, configuration management, identification and authentication, media protection, incident response and the rest.
Project size turns almost entirely on which of your systems hold that information, and shops guess wrong in the same direction every time. A drawing lands in an inbox, moves to a shared drive, gets copied to a machinist's desktop so a job can run, then sits in a backup nobody scoped. Scope it honestly and the boundary shrinks, which decides whether the work is fundable. Background: understanding NIST compliance and CUI and CMMC for manufacturers.
CMMC, its levels, and where a Registered Practitioner stops
The Cybersecurity Maturity Model Certification program is how the Department of Defense verifies those safeguards are real rather than asserted. Level 1 covers basic protection of federal contract information, self-assessed annually. Level 2 rests on NIST SP 800-171 and is either self-assessed or assessed by an authorized third party, depending on your award. Level 3 goes further and is conducted by the Department itself. Your contract language decides which applies, not a vendor's opinion.
Be careful with anyone who blurs this next part. Jon Lober is a CMMC Registered Practitioner, an advisory credential. NOC Technology does not perform certification assessments and is not a certified third-party assessment organization. We do the preparation: a system security plan that matches the environment as built, evidence that is current on the day it is asked for, and gaps closed and dated beforehand. More: implementing CMMC, the CMMC deadline, CMMC myths and cost and timeline for a 150-person Missouri
What a gap assessment hands you when it is finished
Six written deliverables, yours to keep whoever remediates.
- A control-by-control gap report, every requirement marked met, partly met or open, naming the system or setting that decides it.
- A scoped boundary diagram. Beyond that line is work you never fund.
- A System Security Plan an assessor could read, describing how the environment truly runs today.
- A plan of action with milestones, each item carrying an owner, a date and a cost band.
- A remediation sequence ordered by risk and by which customer is asking.
- An evidence plan, because a control you cannot evidence you do not have.
HIPAA, for practices holding patient records
A covered entity or business associate is expected to hold administrative, physical and technical safeguards, a genuine risk analysis, access control and audit logging, contingency planning, and signed agreements with vendors touching the data. We are one of those vendors, and we sign. The recurring failure is documentation: safeguards exist and nobody can show when they were last reviewed. See the
HIPAA checklist for St. Louis medical practices.
Cyber insurance, and the customer who audits you.
Two obligations arrive with no regulator attached. A carrier's application asks how far multi-factor coverage reaches, whether any backup has been restored lately, what screens inbound mail, and who holds administrative rights. Answer generously and you discover at claim time what a misstatement costs. A major customer's security review wants the same things with a purchase order attached. Both get answered from live configuration. See cyber insurance and segmenting OT from IT.
The security underneath all of it.
Every layer on the agreement is there because a framework, a carrier or a customer names it. Detail on cybersecurity, staff training, IT risk management, penetration testing and restores that were actually tested.
An audit-ready environment is quieter than the one you have now.
Prevention, then cause, then a written report, then a shrinking ticket count.
Prevention comes first, because your technology is supposed to be doing your work. Servers, endpoints, network hardware and your Microsoft 365 tenant are watched continuously, and patch levels, configuration baselines, account hygiene and logging are half a control set and half a quiet Tuesday.
Then the cause, since a ticket marked resolved proves almost nothing. Eleven password resets out of one department in six weeks is one broken access policy wearing eleven disguises, and auditors read recurring incidents with no recorded cause as an unmanaged environment.
Anything serious comes back as a document. The after action report says what happened, what changed because of it, and what that change now prevents, because your accountability has to survive being read by an assessor or a carrier.
Then the volume itself, measured against the same months a year earlier. It goes in front of you at every review, and a flat result gets named as one. That trend line is the point of Silent Success /silent-success.
A plan nobody implements is a consulting invoice with extra steps.
The operating side of the house, which a firm that only assesses does not have.
Fully managed and co-managed IT
Machines, servers, licensing, patching, monitoring and a roadmap naming the month each component stops being supportable. Remediation tickets get worked here. See
fully managed IT and, if you employ an IT person worth keeping,
co-managed IT.
Help desk and IT support.
A US-based desk your staff calls directly, answered by technicians already looking at the system. Commitments and our performance against them are at
our SLAs, with detail on
IT support services.
Microsoft 365, cloud and backup.
Licensing sized to the people who genuinely sign in, tenant security set to the standard you answer to, and file structures an auditor and a new hire can both navigate. See
Microsoft 365,
cloud services and
Microsoft 365 backup, deliberately separate from the tenant.
vCIO, strategy and phones.
Remediation is capital spending, so the hardware and licensing plan reaches your budget meeting ahead of the deadline, out of
business IT consulting. The
phone system belongs on the same agreement. Manufacturers:
why manufacturers choose NOC.
We are fifty miles west of downtown, and you should hear that from us first.
Where we sit, what the drive changes, and the number we will not print.
There is no St. Louis address on this page, deliberately. We work out of Washington, Missouri, in Franklin County, roughly fifty miles by road from downtown. Some firms bidding for this search genuinely occupy the building beside yours, and if proximity settles the question, hire one of them. Several others list this city on a coverage page from a longer drive away than ours.
The mileage matters less than a downtown address implies, because this work is mostly network work and document work: assessment, configuration, identity, logging, backup, evidence collection, and the large majority of tickets. Onsite terms belong in your agreement, written against your building and your calendar, so no response time appears here. Whoever you hire, find out which building answers your call.
None of this should be taken on our word, so here is where to check it.
- 97.5% satisfaction. Ask our clients.
- Missourian Readers' Choice, Best Managed IT, 2025 and 2026.
- St. Louis Small Business Monthly, Best in Reliability, 2025 and 2026.
- BBB accredited since July 2024, A+ rating.
- Member, Washington Area Chamber of Commerce.
- Founded 2009, independently owned. No franchise, no private equity.
- Our owner, Jon Lober, is a CMMC Registered Practitioner.
- 24/7 support.
- Resolution commitments and our performance.
- A live pricing estimator.
Our 90-day guarantee
Try us risk-free for 90 days. Not happy? We'll refund your previous month's service costs, facilitate your move to another MSP, and hand over every piece of documentation we've compiled.
Schwoeppe Case Study
The case study to read before you call anybody.
Schwoeppe Machine and Tool is a precision machining firm in the defense supply chain. They needed NIST 800-171 compliance to protect Department of Defense work they held and qualify for the work they wanted next. Scoping, then remediation, then infrastructure that stopped misbehaving. It reads as a rehearsal for whatever clause reached your inbox.
Read the Schwoeppe case study.
You can get the monthly number tonight without speaking to a salesperson.
What it costs, and what leaving an incumbent mid-deadline involves.
Getting a price out of this market normally costs a discovery call and a deck. Ours costs a form. Your user and device counts go into our pricing page and the monthly figure comes back before anybody holds your phone number, at one flat rate, because per-incident billing rewards a provider most in the quarter you would least like to repeat. Reasoning: what managed IT costs in St. Louis. Readiness is quoted once the boundary is known.
Timing is the harder problem, because these two decisions tend to collide. There is an incumbent, a term with months left, and a deadline you did not choose, so the handover date is yours to pick. Undocumented systems get documented, licensing and credentials change hands, and our monitoring runs in parallel with theirs until that date. Those documents are most of a System Security Plan already, so the switch and the readiness work stop competing for the same weeks. Both halves are written up: switching to NOC, then transitioning your IT.
Very few companies here keep all of their people inside one county.
One agreement covers the metro, and these are the pages for each part of it.
Up the river corridor
Inside St. Louis County
Franklin and Gasconade counties
Across the river
Still comparing? There is an open comparison at compare and a ranked rundown at the top five IT support companies in St. Louis.
What owners and operations managers ask on the first compliance call.
Scope, levels, artifacts, credentials, cost, distance, and life after the deadline.
Can you help us meet NIST 800-171 in St. Louis?
Yes, and it starts with scope rather than tooling. We establish which systems hold controlled unclassified information, assess every requirement against that boundary, then hand over a gap report, a System Security Plan, a plan of action and an evidence plan.
Is NOC Technology a CMMC assessor or a certified third-party assessment organization?
No. An authorized third-party assessment organization conducts the CMMC certification assessment itself and reports the result, and it has to stay independent of the environment it examines. Jon Lober holds the CMMC Registered Practitioner credential, which is advisory, so our half of the division is the preparation, the remediation and the evidence that an assessment then examines.
Which CMMC level applies to our company?
Your contract decides, so reading it is the first job. Level 1 covers basic protection of federal contract information, self-assessed. Level 2 rests on NIST SP 800-171, self-assessed or third-party assessed depending on the award. Level 3 is run by the Department itself.
We just received a flowdown clause from a prime contractor. What happens first?
Send us the clause. We read the actual language, identify the standard behind it and the reporting it obligates, and say whether controlled unclassified information is genuinely in play, because sometimes it is not. That answer usually shrinks the project.
What does a compliance gap assessment actually produce?
Six written deliverables: a control-by-control gap report, a scoped boundary diagram, a System Security Plan, a plan of action carrying owners, dates and cost bands, a remediation sequence ordered by risk and contract pressure, and an evidence plan naming who produces which artifact and how often. All six are yours to keep whoever performs the remediation.
Are you actually located in St. Louis?
We are not. Our building is in Washington, Missouri, in Franklin County, roughly fifty miles by road from downtown, and there is no branch closer than that. Put the same question to every name on your shortlist, because a service-area listing and a staffed local office read identically in a search result.
How much does managed IT cost for a St. Louis business?
The figure is already published. Your user and device counts go into /pricing and the monthly number comes straight back, no sales call, which almost nobody here offers. Security sits inside that rate rather than in a tier above it. Readiness work is quoted separately, once the assessment has sized your boundary.
Our practice holds patient records. Can you support our HIPAA obligations?
Yes. Administrative, physical and technical safeguards, a documented risk analysis, access control, audit logging, contingency planning, staff training, and a signed business associate agreement from us. What most practices lack is dated proof of review, so we keep that review on a schedule and hold the records showing it happened and what changed.
A customer sent us a vendor security review. Will you complete it?
Yes, with you, and from what your systems genuinely do rather than what sounds best. Where an answer would be a stretch today, it returns as a gap carrying a date and a cost, which reads better than a bare yes.
Can you help with a cyber insurance application or renewal?
Yes, and applications are where many businesses first discover what they cannot evidence. The questions cover account coverage, tested and offline backups, inbound mail screening, administrative rights and training. Each gets answered from live configuration rather than from optimism, and anything that would read as a misstatement at claim time gets flagged before you sign.
Can you stay on as our IT provider once the compliance work is done?
That is the point of hiring us instead of a consultancy. Compliance decays the moment nobody maintains it, so the team that closed the gaps keeps controls configured, evidence current and the annual review on a calendar. Nothing gets handed to a stranger, and you never onboard a second provider to hold the paperwork.
How long does readiness take, and can we phase it?
Weeks to several quarters, decided by boundary size and how much remediation needs funding rather than configuration. Phasing is normal and the plan of action is built for it: contract-critical items first, the rest sequenced against your capital cycle. Dates move with your budget, so the whole programme never stalls on one approval.
We are inside a term with our current provider. Can we still talk?
Most of these conversations start exactly there. Forward the agreement and we will read the termination language, say what notice it genuinely demands, and check whether an auto-renewal date is closer than you think. Then the plan gets shaped around that window rather than around our quarter, which is the whole reason to look early.
When is NOC the wrong choice?
When what you want is the certification stamp rather than the work that earns it. When the deadline has already gone by and what would actually help is somebody to carry the blame. When the artifacts should be written once and filed, because we will keep asking you to maintain them. And when daily physical presence is the requirement, which a downtown firm can promise and we will not.
Written by Jon Lober, CMMC-RP, owner, NOC Technology. Last updated 10/2026.
Send us the clause, or price the monthly side yourself.
Whichever deadline is closer, start with that one.
Sales: 636.390.6621 Support: 314.500.1000 Support is available 24/7.
