Certified for the set-aside. Built for the mission.
Merek Security Solutions, LLC is an SBA-certified Service-Disabled Veteran-Owned Small Business delivering cybersecurity governance, data compliance, and behavioral security — senior-led, research-grounded, and available as prime or teaming partner.
UEI H1NDZGJS5J55 · CAGE 88U41 · SAM.gov active · Santa Fe, New Mexico
Four practice lines, one human-centered method.
Security programs that hold up under real human behavior — not just on paper.
Governance, Risk & Compliance
- CMMC 2.0 readiness and NIST SP 800-171 gap assessment (CyberAB Registered Practitioner)
- DFARS 252.204-7012 / CUI scoping, SPRS scoring, System Security Plan and POA&M development
- NIST RMF, FISMA and ATO support; NIST SP 800-53 control mapping
- HIPAA, GDPR and data-privacy compliance programs
Virtual CISO & Program Leadership
- Fractional CISO / ISSM advisory on retainer
- Security policy, procedure and architecture development
- MSP and vendor oversight; change control and boundary determinations
- Incident-response planning, tabletop exercises and executive briefings
Behavioral Cybersecurity & Training
- Security-awareness and behavior-change training grounded in cyberpsychology
- Cybersecurity training for non-IT government and contracting professionals
- Case-study, scenario and facilitated-discussion pedagogy for adult learners
- Post-training behavioral baseline measurement
Cyberpsychology Research & Digital Wellness
- Applied research on human–technology behavior and security culture
- MindfulBytes K-5 digital-wellness curriculum — 533+ learners across three institutions
- Program design and outcome measurement for schools and workforces
- Research partnerships with academic and nonprofit institutions
The facts a buyer needs first.
- Legal name
- Merek Security Solutions, LLC
- Headquarters
- 3005 South Saint Francis Dr., Suite 1-D #445, Santa Fe, NM 87505
- Founded
- October 2018
- Structure
- Limited liability company, 100% owner-held; no parent entity or affiliates
- UEI
- H1NDZGJS5J55
- CAGE
- 88U41
- SAM.gov
- Active registration
- Size
- Small Business
- Set-asides
- Service-Disabled Veteran-Owned Small Business (SBA-certified) · Veteran-Owned
- Facility clearance
- None — unclassified engagements; cleared staff provided through teaming partners where a requirement calls for them
- Procurement
- Open market · SDVOSB set-aside and sole-source eligible (FAR 19.14) · Prime or subcontractor · Teaming welcomed
- Point of contact
- Michael C. Davis, CEO & Founder · michael@merek.io · (505) 395-0710
NAICS Codes
- 541512
- Computer Systems Design Services
- 541519
- Other Computer Related Services
- 541611
- Administrative Management & General Management Consulting
- 541690
- Other Scientific & Technical Consulting Services
- 541990
- All Other Professional, Scientific & Technical Services
- 611430
- Professional & Management Development Training
Credentials
Held across Merek's principal and specialist bench.
What a buyer gets that a checklist can't give.
SDVOSB-certified (SBA VetCert, 2026)
Eligible for SDVOSB set-aside and sole-source awards under FAR 19.14 — government-wide.
30 years in cybersecurity
U.S. Navy (22 years), the Pentagon, DISA, Los Alamos National Laboratory, Boeing, and IBM.
The human factor, by design
Cyberpsychology research informs every control, policy, and training hour we deliver.
Senior-led, right-sized
The principal is on every engagement; a vetted specialist bench and teaming partners scale delivery.
Fluent in DoD procurement language
Daily work with DFARS, CUI, SPRS, SSP, and POA&M requirements on the contractor side.
Teaching credibility
Research Fellow, Center for Digital Thriving, Harvard Graduate School of Education (2025–2026).
Representative engagements.
Public-sector clients are named. Private clients are described, not named, until they say otherwise.
Bernalillo County, New Mexico
Cybersecurity training for county government employees — non-IT professionals who must apply security in procurement, administrative, and operational duties. Threat fundamentals, regulatory framing, and behavior-change principles delivered through interactive case studies.
New Mexico defense manufacturer
DFARS 252.204-7012 contractor. SPRS scoring assessment against NIST SP 800-171, System Security Plan and POA&M development, CMMC Level 2 readiness roadmap, and MSP gap reconciliation — now an ongoing vCISO retainer covering quarterly on-site training, tabletops, and CUI-boundary change control.
TXNM Energy
Behavioral cybersecurity training proof-of-concept for a regulated electric utility. Threat scenarios adapted to a critical-infrastructure environment, interactive case-study format, and post-training behavioral baseline measurement built on Merek's cyberpsychology methodology.
MindfulBytes — Rio Grande School & partner institutions
Design and delivery of a K-5 digital-wellness curriculum reaching 533+ learners across three institutions, with outcome measurement on the program and an IRB-reviewed research track. Demonstrates the firm's capacity to build, field, and measure behavior-change programs end to end.
Senior-led. Scaled by a bench. Stated plainly.
Michael C. Davis — CEO & Founder
A 22-year U.S. Navy cybersecurity veteran with 30 years in the field. His career spans DIACAP through the NIST Risk Management Framework, with ISSM responsibility, DFARS 252.204-7012 implementation, and CUI protection in Navy and joint-service environments. Doctoral candidate in Cyberpsychology (Capitol Technology University); Research Fellow, Center for Digital Thriving, Harvard GSE (2025–2026); Executive Director, Center for Cybersecurity and Cyberpsychology Research.
About Michael →Have a requirement or a teaming slot?
Take the two-page PDF to your contracting officer or capture manager, or start the conversation directly.