Steel Patriot Partners

What Steel Patriot Partners does

Steel Patriot Partners is a privately held cybersecurity and compliance firm headquartered in Leesburg, Virginia, that helps defense contractors, federal civilian agencies, and federal healthcare organizations achieve and maintain federal cybersecurity compliance certifications. The company was co-founded by Jason Ford (CEO) and Amy Ford (COO), with Michael Parisi serving as Chief Growth Officer, and is built by operators with experience in the federal compliance space dating back to the late 1990s, including co-founding one of the first FedRAMP cloud providers and achieving a FedRAMP ATO in 2014. Its core customer segments are the Defense Industrial Base (CMMC, DFARS, NIST 800-171), Federal Civilian Agencies (FedRAMP, FISMA), and Federal Healthcare organizations handling federal research and Medicare/VA/NIH data, with adjacent expansion into cloud-first regulated industries.

The company's flagship product is Federal ZenGRC, a GRC platform built in partnership with ZenGRC and hosted on AWS GovCloud. Federal ZenGRC holds FedRAMP Moderate, CMMC Level 2, and GovRAMP Moderate certifications verified by independent 3PAO Schellman Compliance, LLC, and is listed on the FedRAMP and StateRAMP marketplaces. The platform features an object-based framework mapping approach, automated artifact generation, leveraged assessments that allow controls to be reused across multiple frameworks (FedRAMP, CMMC, GovRAMP, FISMA, HIPAA, GLBA, CUI, DFARS, ISO, SOC2, PCI), and continuous monitoring capabilities. Steel Patriot Partners positions itself as an "implementation-for-you" provider rather than an advisory-only consultancy, executing actual control implementation, policy development, cloud security engineering, and managed SOC operations.

Revenue is generated through two streams: subscription-based SaaS licensing for Federal ZenGRC, distributed through Carahsoft and the government marketplaces, and professional services revenue from modular implementation engagements under multi-year contracts. The services portfolio spans GRC implementation, security assessments, cloud operations and engineering, managed cybersecurity (SOC, MDR, vulnerability management), federal healthcare data compliance, and complimentary ROI workshops. The go-to-market is sales-led and event-driven, combining direct enterprise engagement with content marketing, industry conference presence (RSAC, Automate 2026), and a partner referral network. The company is a service-disabled veteran-owned LLC with no disclosed external funding.

Name

Steel Patriot Partners

Legal name

Steel Patriot Partners, LLC

Website

https://steelpatriotpartners.com

Company type

Private

Founded year

2014

Operating status

Operating

Headcount range

11–50 employees

Short description

Steel Patriot Partners is a Virginia-based cybersecurity firm that helps defense contractors, federal agencies, and healthcare organizations achieve FedRAMP, CMMC, and GovRAMP compliance through modular implementation services and its Federal ZenGRC SaaS platform.

Ownership category

akta.pro rank

Product category

Federal Cybersecurity Compliance Services

NAICS

Computer Systems Design and Related Services (54151)

akta.pro primary industry

Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)

akta.pro secondary industry

Security Management Platforms Integration (PSIM/SOC, Command & Control) (BPAKAGAH)

Keywords

• Federal cybersecurity compliance
• FedRAMP implementation services
• CMMC compliance consulting
• GRC platform services
• Managed cloud security

Headquarters

HQ city

Leesburg

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Marketing or Sales, Others

Revenue model

1. Compliance Consulting and Implementation Services: Professional services providing modular implementation of cybersecurity controls, gap assessments, policy development, control implementation, and ongoing compliance operations. Services are tailored to help organizations achieve FedRAMP, CMMC, GovRAMP, and other federal compliance certifications.
2. Federal ZenGRC SaaS Platform: Software-as-a-Service GRC platform available through Carahsoft for government procurement. Organizations pay to use the platform for compliance management, artifact generation, and continuous monitoring.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels5 records

Core offering

Steel Patriot Partners provides modular cybersecurity compliance implementation and managed security services to defense contractors, federal agencies, and healthcare organizations pursuing federal certifications such as FedRAMP, CMMC, GovRAMP, FISMA, and NIST 800-171. The firm pairs professional services (program assessment, policy/control build, program operations, engineering, and security assessments) with Federal ZenGRC, a FedRAMP Moderate, CMMC Level 2, and GovRAMP certified GRC SaaS platform built on ZenGRC and hosted on AWS GovCloud that automates artifact generation, maps controls across frameworks, and enables continuous monitoring.

Product overview

Steel Patriot Partners operates as a cybersecurity and compliance consulting firm offering both a proprietary SaaS platform (Federal ZenGRC) and professional services. Federal ZenGRC is a FedRAMP Moderate, CMMC Level 2, and GovRAMP certified GRC platform built in partnership with ZenGRC and hosted on AWS GovCloud. The platform provides automated compliance artifact generation, control management workflows, risk assessments, and audit management for federal frameworks. Complementing the platform, Steel Patriot Partners offers modular implementation services including GRC implementation, security assessments, cloud operations and engineering, cybersecurity operations (SOC, MDR, vulnerability management), federal healthcare data compliance, and ROI workshops. The company emphasizes an "implementation-for-you" approach rather than just advisory services, focusing on controls actually being put in place.

Differentiator

Problem solved

Functional benefit

Brands

• Federal ZenGRC: A FedRAMP Moderate, CMMC Level 2, and GovRAMP certified GRC platform specifically designed for federal compliance, enabling organizations to achieve and maintain federal compliance standards including FedRAMP, GovRAMP, CMMC, NIST, FISMA, HIPAA, GLBA, CUI, DFARS, SOC2, and PCI.

Products and services

• Federal ZenGRC A FedRAMP Moderate, CMMC Level 2, and GovRAMP certified SaaS GRC platform designed for federal compliance. Provides automated artifact generation, leveraged cross-framework assessments, and expert implementation support for achieving and maintaining standards including FedRAMP, GovRAMP, CMMC, NIST, FISMA, HIPAA, GLBA, CUI, DFARS, ISO, SOC 2, and PCI. Hosted on AWS GovCloud and procured via direct purchase, Carahsoft, and the FedRAMP/StateRAMP marketplaces.
• GRC Implementation Services Modular implementation services for GRC programs that put controls in place, not just advisory. Spans Program Assessment (gap analysis and ROI roadmap), Program Build (policy, system, and control implementation), Program Operations (ongoing compliance and monitoring), Program Engineering (technical, infrastructure, and SOC support), and Executive Advisement (strategic guidance and audit liaison). Targeted at organizations pursuing federal and industry compliance certifications.
• Security Assessments Security assessments and compliance certifications including readiness assessments (SOC 2, ISO 27001, HIPAA/HITRUST, NIST CSF/800-53, FedRAMP), risk and technical assessments (enterprise risk, vulnerability management, penetration testing, cloud security posture), policy and control evidence buildout, and certification preparation and audit support. Sold to organizations needing third-party-validated compliance posture.
• Cloud Operations & Engineering Managed cloud operations and engineering services for AWS, Azure, and GCP. Includes cloud platform engineering and foundations, cloud security and posture operations, and managed cloud operations and reliability. Supports CNAPP tools (Wiz, Prisma Cloud, Orca, Microsoft Defender) and provides 24/7 operational function for cloud security.
• Cybersecurity Operations (Managed Security) Managed cybersecurity services including Security Operations Center (SOC) with 24/7 monitoring, internal penetration testing, vulnerability management, cloud security posture management, managed detection and incident response, security architect as a service, and information security strategy development. Sold to organizations that need continuous, outsourced security operations capability.
• Federal Healthcare Data Compliance Specialized compliance services for federal healthcare data ecosystems. Addresses NIST 800-171 controls for research CUI, Medicare/VA/NIH data sharing requirements, and multi-site trial security. Provides a unified framework for cross-institutional CUI protection, consolidated reporting, and healthcare-specific federal requirements. Sold to healthcare providers, health plans, and research institutions handling federal healthcare data.

Quantifiable outcome

• Achieved SOC2 compliance for healthcare plan provider in 2023
• +2 more outcomes

Named customers4 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration17 records

Feature4 records

Partnerships

Seven partnerships are on record, tiered flagship, core and minor.

• ZenGRCflagshipOEM/ Whitelabel/ Licensing Partner · 1 January 2024Steel Patriot Partners is the only ZenGRC partner for Federal, DoD, State, and Local compliance. They built Federal ZenGRC as a specialized version of ZenGRC for federal requirements, serving as the system owner and maintainer. The partnership enables Steel Patriot Partners to offer Federal ZenGRC as a FedRAMP Moderate, CMMC Level 2, and GovRAMP certified GRC platform.
• CarahsoftcoreChannel Partner/ Reseller/ DistributorFederal ZenGRC platform is available for purchase through Carahsoft, a government IT solutions distributor, enabling government agencies to procure the solution through existing federal contract vehicles.
• Schellman Compliance, LLCcoreImplementation/ SI/ Consulting PartnerIndependent assessor that verified Federal ZenGRC's FedRAMP Moderate Ready, GovRAMP Moderate Ready, and CMMC Level 2 status. Schellman is a certified 3PAO (Third-Party Assessment Organization) for FedRAMP assessments.
• Amazon Web Services (AWS)coreTechnology or IntegrationFederal ZenGRC is hosted on AWS GovCloud, leveraging AWS infrastructure for federal compliance requirements. AWS provides the underlying cloud platform meeting FedRAMP security standards.
• Insight AssuranceminorImplementation/ SI/ Consulting PartnerAssessment and certification partner providing FedRAMP and other security framework assessment services.
• A-LignminorImplementation/ SI/ Consulting PartnerAssessment and certification partner providing security and compliance assessments including FedRAMP, SOC 2, and ISO certifications.
• Trace3minorImplementation/ SI/ Consulting PartnerTechnology partner and solution provider for enterprise cloud and security solutions supporting client environments.

Scale indicators3 records

Recent moves7 records

Expansion highlights5 records

Direct peers

• Coalfire: Coalfire is a direct competitor providing FedRAMP advisory, CMMC assessment support, cloud security engineering, and managed compliance services to defense, federal civilian, and healthcare organizations — substantially overlapping SPP's offerings across GRC consulting and platform-adjacent services.
• A-LIGN: A-LIGN is a closely comparable cybersecurity compliance assessor and consulting firm offering SOC 2, ISO 27001, HITRUST, FedRAMP, and CMMC readiness and certification services — directly overlapping SPP's assessment and implementation practices (and listed as an SPP partner/assessor).
• Schellman & Co. Schellman is a top-tier assessment firm and certified FedRAMP 3PAO that provides SOC 2, ISO 27001, HITRUST, FedRAMP, and CMMC assessments — directly competing with SPP on the assessment side while also acting as SPP's independent assessor.
• BARR Advisory: BARR Advisory is a cybersecurity and compliance advisory firm delivering SOC 2, ISO 27001, HITRUST, FedRAMP, and CMMC readiness and attestation services to SaaS and federal-adjacent customers — a direct competitor for SPP's compliance-implementation engagements.
• Linford & Co: Linford & Co provides SOC 2, ISO 27001, HIPAA, and other compliance readiness and audit support to technology and SaaS customers, overlapping the compliance-assessment portion of SPP's service catalog.
• KirkpatrickPrice: KirkpatrickPrice is a registered PCI QSA and CPA firm providing SOC 2, ISO 27001, PCI DSS, HITRUST, and FedRAMP attestation and readiness services — competing for the same compliance-audit wallet SPP targets.
• RSI Security: RSI Security is a cybersecurity and compliance services firm delivering SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, and FedRAMP readiness and managed security services to mid-market and federal-adjacent clients, comparable to SPP's bundled consulting-plus-managed-services offering.
• Pivot Point Security: Pivot Point Security is a GRC and cybersecurity consulting firm specializing in ISO 27001, SOC 2, HITRUST, and CMMC implementation — a direct competitor for SPP's policy-build and control-implementation services.

Broad incumbents

• Booz Allen Hamilton: Booz Allen Hamilton is a large federal systems integrator with a sizable cybersecurity and FedRAMP/CMMC practice serving DoD and federal civilian clients — a broad incumbent that competes with SPP on large federal opportunities while also serving as a potential subcontractor source.
• Wolf & Company: Wolf & Company is a Top-100 accounting and advisory firm providing SOC, ISO, HITRUST, CMMC, and cybersecurity services to regulated industries — a broader incumbent competing in adjacent segments of SPP's market.

Market position

Strengths5 records

Competitive moat4 records

Key risks4 records

Key highlights7 records

Customer concentration

• YouTubeyoutu.be/FK2P5rOiDJA
• Xx.com/HiImPatRiot

Compliance11 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Steel Patriot Partners