CMMC Level 2 Readiness for a Defense Supplier
An SPRS score raised from 38 to 110 and a C3PAO assessment booked with confidence.
Client name withheld by agreement- Client
- Aerospace components manufacturer
- Region
- North Texas
- Year
- 2025
- Duration
- 16 weeks
- Scope
- 110 NIST SP 800-171 practices · 3 plants
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
An aerospace components manufacturer needed CMMC Level 2 to keep its prime contracts. Its self-assessed SPRS score was 38 out of 110, and controlled unclassified information was spread across three plants, email and engineering file shares.
Losing eligibility would mean losing the majority of its revenue. The team had a hard date and no margin for a failed assessment.
What we did
The approach, step by step.
- 01
CUI found and fenced
We traced where controlled unclassified information is created, stored and shared, then built an enclave that keeps it in one defensible boundary.
- 02
All 110 practices implemented
Technical controls in Microsoft 365 GCC High and on the plant floor, with policies and procedures written for how the plants really operate.
- 03
System security plan that reads true
An SSP and evidence binder that describe the environment exactly as an assessor will find it.
- 04
Mock assessment
A full rehearsal against the assessment objectives, with interviews, so nothing surprised the team on the day.
Outcomes
What changed, in numbers.
- 38 to 110
- SPRS score raised
- 110
- NIST SP 800-171 practices implemented
- 3
- plants brought inside one CUI enclave
- 1
- C3PAO assessment booked with confidence
We went from hoping to pass to knowing we would.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Austin, Texas · 14 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II Readiness for an HR PlatformA clean Type II report on the first audit window, and enterprise deals unblocked the same quarter.
-
U.S. and EU · 20 weeks
AI, Cloud & Digital Trust · 2025 · OngoingAI Governance and Red Teaming for a GenAI PlatformAn AI management system built for certification, and 31 jailbreak paths closed before launch.
-
Texas and Oklahoma · 26 weeks
AI, Cloud & Digital Trust · 2024Secure Cloud Landing Zone for a Health NetworkGuardrails in code across every account, with critical misconfigurations down 92% in two quarters.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.