Compliance

Disciplined, reliable delivery — independently appraised by the CMMI Institute, certified to ISO standards, and aligned to federal security frameworks.

CMMI ISO 9001 ISO 20000-1 ISO 27001 NIST 800-171 CMMC Cyber Essentials

Maturity Level 3

CMMI-DEV V3.0 & CMMI-SVC V3.0

Groundswell has achieved Maturity Level 3 for both CMMI-DEV V3.0 and CMMI-SVC V3.0. Our development processes are well-defined and consistently implemented, and our service management practices are robust and effective — reducing risk, improving quality, and ensuring timely delivery.

CMMI ML3 Appraised

DEV V3.0 & SVC V3.0

ISO 9001:2015

Quality Management Systems

A globally recognized standard for quality management. Our processes are efficient, consistent, and continuously improving, with rigorous monitoring of customer feedback to enhance our offerings.

ISO 9001:2015 Certified

Quality management

ISO/IEC 20000-1:2018

IT Service Management

The international standard for IT service management. Our processes are streamlined and optimized for performance, reducing downtime, proactively managing risk, and aligning service delivery with global standards.

ISO/IEC 20000-1:2018 Certified

IT service management

ISO 27001:2022

Information Security Management

A globally recognized standard for information security management. Our security practices are robust, systematic, and continuously improving — protecting sensitive customer information against threats and breaches.

ISO 27001:2022 Certified

Information security

NIST SP 800-171

Controlled Unclassified Information

Our ongoing NIST 800-171 compliance — closely aligned with our ISO 27001 program — prioritizes strong access controls, encryption, and continuous monitoring so that Controlled Unclassified Information (CUI) is protected with diligence and care.

  • Strong access controls and encryption
  • Continuous monitoring of CUI environments

NIST 800-171 Aligned

CUI protection

Cybersecurity Maturity Model Certification

CMMC

Groundswell is CMMC Level 2 with final Level 2 C3PAO Adjudication scheduled under the Department of Defense’s Cybersecurity Maturity Model Certification program. Building on our NIST 800-171 foundation, CMMC verifies that the security controls protecting Controlled Unclassified Information are implemented, assessed, and maintained — meeting DoD’s requirements for the defense industrial base.

  • DoD-mandated verification of cybersecurity practices
  • Built on our NIST 800-171 and ISO 27001 programs

CMMC

Defense industrial base

NCSC UK

Cyber Essentials

Certified under the United Kingdom’s National Cyber Security Centre (NCSC) Cyber Essentials scheme, demonstrating key technical controls against the most prevalent cyberattacks — phishing, malware, and unauthorized access — across our networks, devices, and software.

  • Government-backed UK cybersecurity certification
  • Protection against phishing, malware, and unauthorized access

Cyber Essentials Certified

NCSC United Kingdom

Note: Certification artifacts and appraisal details available on request: contracts@gswell.com.