Foxx Cyber vCISO
A personal virtual CISO you talk to in plain English. It keeps your risk register, policies and decisions in order, and changes nothing without your say-so.
Pricing on request
Cybersecurity your business can actually run. One account, three products.
Foxx Cyber builds security software for businesses too small to hire a security team: a personal virtual CISO that talks to you, Bedrock CMMC for defense contractors who need Level 2, and Flowdown for the primes who manage them. Create one account and pick what you need.
Three products. Each one does a job you can name.
The full story of each product lives on its own site. This page is the short version, and the door.
Bedrock CMMC
Build and mature your CMMC Level 2 package, then hand it to your assessor without rebuilding it. One chain of custody from control narrative to SPRS affirmation.
From $149/month
Bedrock Flowdown
A live roster of your subcontractors' CMMC and DFARS status, evaluated against the level each contract flows down. Subs update through a private link.
Pricing on request
Buying works the same way for all three.
One account, one bill, one place to manage your team and reach support.
-
1
Create a Foxx Cyber account
An email and a password, verified. It is the account you use for every product, so you only ever do this once.
-
2
Pick a product and a plan
Monthly or annual, paid by card through Stripe. Change or cancel from your account page, not by emailing anyone.
-
3
Your workspace is ready in minutes
We provision the product, send you the activation link, and you sign in there. Billing, your team and support stay here.
Practitioner-built, and checkable.
Foxx Cyber is a practitioner shop, not a marketing one. The proof we offer is the kind you can verify.
CISSP / CISM credentials
Founded by an active CMMC-domain practitioner with DoD and Air National Guard background.
We run it on ourselves
Foxx Cyber pursues its own Level 2 on Bedrock CMMC, and publishes the security posture behind every product.
Open where it can be
Skein, Loom, Bedrock RMF and more are public at gitlab.com/foxxcyber-oss. Read the code before you trust it.
Free, unofficial, no sign-up
Read CMMC and NIST 800-171 the way they should have been written.
We read the same regulations you do, so we published a plain-language reading aid: every one of the 110 requirements with the original text beside it, a worksheet for the CUI question, and a straight answer on Rev. 2 versus Rev. 3.
110 requirements
Every control, in plain language
The plain version, the verbatim wording, the assessment objectives, and the SPRS weight. One page each.
Three questions, at mostIs the information in front of you CUI?
Ends in a determination or the exact email to send your contracting officer. Over-protecting is recoverable.
Status firstRev. 2 versus Rev. 3
What your contract requires today, what NIST has published, and why those are different things.
Practitioner guides
Written by the people building the platform.
- What is CMMC? A complete guide for defense contractors CMMC (Cybersecurity Maturity Model Certification) is the DoD's framework requiring defense contractors to prove their cybersecurity posture. Learn what CMMC is, who needs it, the 3 levels, and how to get certified.
- CMMC Phase 2 is suspended. Your security obligations are not. On July 13, 2026 the Department of War suspended CMMC Phase 2 third-party assessment requirements. What was suspended, what still applies — DFARS 7012, NIST 800-171, SPRS affirmations — and what defense contractors should do now.
- The CMMC assessment process: from self-assessment to certification A practical guide to the CMMC assessment process — from self-assessment and evidence collection to SPRS scoring and preparing for your C3PAO evaluation. Learn what assessors look for at each stage.
Start with an account. Pick the product after.
Creating an account costs nothing and commits you to nothing. Plans, billing, your team and support all live behind it.