Service
Scoping, architecture, remediation and assessment support for defense suppliers who need CMMC Level 2 without rebuilding the whole business.
If you supply the US defense industry you must prove your cybersecurity to an independent assessor. The cost depends almost entirely on how much of your business is in scope, so we start by confining the sensitive information to a small, well-defined area — then fix the gaps and prepare the evidence for assessment.
Most CMMC programs cost far more than they need to because the enclave was never scoped. Every system in scope is a system that must be assessed, evidenced and maintained — so the highest-leverage work happens before any control is implemented.
CMMC applies to systems that process, store or transmit controlled unclassified information. If CUI is allowed to spread across the general corporate network, the assessment boundary becomes the whole company. Pull CUI into a defined enclave and the assessable footprint may be a fraction of that.
This single decision drives the cost of everything downstream — remediation, assessment, and every year of maintenance afterwards. It is where we start.
A POA&M is a commitment with a deadline, not a parking space. We will not write one for a control that has no funded path to closure — we would rather have the difficult conversation before the assessment than have it become a finding.
Compliance engineering covers NIST SP 800-171 outside the CMMC context, plus FIPS 140-3 cryptographic boundary work. Federal and defense covers the wider program context.
The Cybersecurity Maturity Model Certification is mandated by the US Department of Defense to verify that companies in the Defense Industrial Base actually protect the government information they hold. It replaced self-attestation because self-attestation was not working.
Without the level your contract requires, you cannot view, bid on or win the work. CMMC is enforced through the contract vehicle itself, which is why the deadline that matters is your next recompete — not a general compliance calendar.
Two categories of government information trigger CMMC, and confusing them is the most expensive early mistake we correct.
All CUI is protected information; not all protected information is CUI. Determining which you hold is done by inspecting your data, not by asking the contracts team what they assume.
| Level | Name | Controls | Protects | Assessed by | Frequency |
|---|---|---|---|---|---|
| 1 | Foundational | 15 practices | FCI | Yourself — self-assessment | Annual |
| 2 | Advanced | 110 controls (NIST SP 800-171) | CUI | A C3PAO, independently | Every 3 years |
| 3 | Expert | 110 + selected NIST SP 800-172 | CUI on the most critical programs | The government (DIBCAC) | Every 3 years |
Level 3 exists specifically to resist Advanced Persistent Threats — well-resourced, patient attackers, typically nation-state, who are targeting a named program rather than scanning for easy prey. The extra NIST SP 800-172 controls assume the adversary will get in and focus on limiting what they achieve.
| Approach | In-scope systems | Assessment effort | Annual maintenance |
|---|---|---|---|
| CUI everywhere (no enclave) | Entire estate | Highest | Every system, every year |
| Segmented enclave | Enclave + shared services | Moderate | Bounded and predictable |
| Fully isolated enclave / VDI | Enclave only | Lowest | Smallest, but users complain most |
The third option is cheapest to assess and hardest to live with. We scope to what your people will actually use, because an enclave users route around is worse than no enclave — CUI ends up outside the boundary and outside your knowledge.
| Category | Definition | Assessment impact |
|---|---|---|
| CUI assets | Process, store or transmit CUI | All applicable controls, fully assessed |
| Security protection assets | Provide security to the enclave (SIEM, IdP, EDR console) | Assessed — these are in scope even outside the boundary |
| Contractor risk managed | Could access CUI but are policy-restricted | Documented, limited assessment |
| Specialized assets | OT, test equipment, IoT | Documented in the SSP, not fully assessed |
| Out of scope | Physically or logically incapable of reaching CUI | Not assessed — must be provable |
The category people miss is security protection assets. Your EDR console is in scope even if it holds no CUI, because compromising it compromises the enclave.
| Phase | What it produces |
|---|---|
| Gap analysis and readiness assessment | Your current posture scored against every applicable control, with gaps, vulnerabilities and an honest readiness verdict. Not a score designed to make you feel prepared. |
| Remediation and implementation | The engineering itself — secure file sharing, multi-factor authentication, log monitoring and retention, encrypted storage, and where it fits, a secure cloud enclave that holds CUI away from the rest of the business. |
| Documentation | System Security Plan describing the boundary and each control's implementation, and a Plan of Action and Milestones tracking every unresolved gap with a dated commitment. |
| Policy and process | Company-wide security policies, an incident response plan, and security awareness training — all three are assessed, and all three are commonly left until the last month. |
| Assessment support | Evidence mapped control by control, and we stay in the room to answer assessor findings. |
Starting position: CUI in engineering drawings on a shared drive open to all staff. No IdP. Local administrator on every workstation. One IT contractor, two days a week.
CMMC consulting is a crowded market and the quality spread is wide. A CMMC compliance consultant adds value in scoping, architecture and evidence engineering. They cannot certify you — that is the C3PAO — and any firm implying otherwise has a conflict of interest worth walking away from.
| A good CMMC consultant | A warning sign |
|---|---|
| Starts with CUI discovery and scoping | Starts by selling a tool |
| Scores your gaps honestly, including the painful ones | Reports you are "90% compliant" in week two |
| Refuses to write a POA&M with no funded closure path | Puts everything unresolved on a plan of action |
| Is independent of your assessor | Offers to both consult and certify |
| Leaves you able to maintain the evidence | Builds a dependency on their platform |
For CMMC Level 2 compliance specifically, the deciding factor is almost always enclave scope rather than control sophistication. Most Level 2 programs that run over budget did so because scoping was never done, not because a control was hard.
| Phase | Typical duration | Most common overrun |
|---|---|---|
| CUI discovery | 3–6 weeks | CUI found somewhere nobody expected |
| Enclave design and build | 6–10 weeks | User workflow objections |
| Migration and sanitization | 4–8 weeks | Legacy file shares with unclear ownership |
| Gap remediation | 3–6 months | Items needing capital approval |
| Evidence automation | 4–6 weeks | Can start earlier; usually left too late |
| Assessment scheduling | 2–6 months wait | C3PAO availability — book early |
That last row is the one that breaks contract deadlines. Assessor capacity is constrained; book the slot before remediation finishes, not after.
Bring us the estate you actually have — mixed OS fleets, ageing routers, unmanaged IoT — and we will tell you what can be unified under one agent and what needs custom work.
