What is (and is not) included?

Work is scoped to compliance documentation tied to federal funding requirements, not enterprise-wide cybersecurity program design or unrelated policy development.