Manufacturing / CMMC Level 2 + OT
CMMC Level 2 in 90 days.
A precision-machining subcontractor supplying components for major defense primes. 180 employees, two plants, ITAR-controlled production. A prime customer required CMMC Level 2 certification within 120 days or risk losing the contract. No CMMC experience in-house, active CNC production that couldn't stop.
The problem
Two plants running flat networks: CNC machines, engineering workstations, ERP, and general office all sharing the same broadcast domain. CUI was mixed with non-controlled data across the file shares. No logging retention, no SSP, no POA&M, no documented incident response runbook. The prime customer's CMMC 2.0 deadline was hard. Another supplier was already queued up to take the contract if certification missed the date.
The engagement
- Week 1-2: CMMC Level 2 gap assessment against all 110 NIST SP 800-171 controls. CUI data-flow mapping. SSP and POA&M drafted. C3PAO engaged for assessment slot.
- Week 3-5: Network segmentation following the Purdue model. CUI enclave carved out with dedicated ingress and egress. OT zone isolated using passive monitoring only; nothing injected into CNC control loops. All network changes staged during planned non-production windows.
- Week 6-8: MFA universal for CUI access. PAM deployed for admin accounts. Logging aggregated into SIEM with 90-day active retention, 1-year cold storage. DLP tuned for CUI markings.
- Week 9-11: Security awareness training for all CUI-handling personnel. Incident response runbook documented and tabletop-tested. Supply-chain security controls for subcontractors. Evidence collection for all 110 controls.
- Week 12: Pre-assessment dry run with EFROS compliance team. Gaps closed. Ready for C3PAO.
- Week 13-14: C3PAO assessment conducted. Certification issued.
The outcome
“We went from zero CMMC readiness to Level 2 certified in 90 days without stopping a single CNC machine. The contract stayed. And now we're winning work we couldn't have bid on before.”
— VP Operations, precision-machining defense subcontractor
- CMMC Level 2 certification achieved on first C3PAO attempt
- 110/110 NIST 800-171 controls operational with documented evidence
- Zero production hours lost during segmentation and deployment
- Prime-customer contract retained; two additional DoD-tier contracts won post-certification
- Controls operate continuously, so the next recertification is steady-state instead of a scramble.
Voices from the engagement
Additional perspectives from the same engagement across different roles.
“All 110 NIST 800-171 controls operating with documented evidence on day one of the C3PAO assessment. The assessor spent two days verifying instead of hunting for artifacts. That alone cut our assessment cost by a third.”
— Compliance Director, precision-machining defense subcontractor
“Segmentation, PAM, SIEM, DLP, MFA rollout. 90 days start to certified with zero CNC downtime. Our engineering workstations never lost access to the controllers. I did not believe that was possible when we kicked off.”
— Head of Security, precision-machining defense subcontractor