Manufacturing / CMMC Level 2 + OT

CMMC Level 2 in 90 days.

A precision-machining subcontractor supplying components for major defense primes. 180 employees, two plants, ITAR-controlled production. A prime customer required CMMC Level 2 certification within 120 days or risk losing the contract. No CMMC experience in-house, active CNC production that couldn't stop.

The problem

Two plants running flat networks: CNC machines, engineering workstations, ERP, and general office all sharing the same broadcast domain. CUI was mixed with non-controlled data across the file shares. No logging retention, no SSP, no POA&M, no documented incident response runbook. The prime customer's CMMC 2.0 deadline was hard. Another supplier was already queued up to take the contract if certification missed the date.

The engagement

• Week 1-2: CMMC Level 2 gap assessment against all 110 NIST SP 800-171 controls. CUI data-flow mapping. SSP and POA&M drafted. C3PAO engaged for assessment slot.
• Week 3-5: Network segmentation following the Purdue model. CUI enclave carved out with dedicated ingress and egress. OT zone isolated using passive monitoring only; nothing injected into CNC control loops. All network changes staged during planned non-production windows.
• Week 6-8: MFA universal for CUI access. PAM deployed for admin accounts. Logging aggregated into SIEM with 90-day active retention, 1-year cold storage. DLP tuned for CUI markings.
• Week 9-11: Security awareness training for all CUI-handling personnel. Incident response runbook documented and tabletop-tested. Supply-chain security controls for subcontractors. Evidence collection for all 110 controls.
• Week 12: Pre-assessment dry run with EFROS compliance team. Gaps closed. Ready for C3PAO.
• Week 13: C3PAO assessment conducted. Certification issued, inside the 90-day target and well ahead of the prime's 120-day deadline.

The outcome

Zero CMMC readiness to Level 2 certified in 90 days, with no CNC downtime. The prime-customer contract was retained and two additional DoD-tier contracts followed.

• ✓CMMC Level 2 certification achieved on first C3PAO attempt
• ✓110/110 NIST 800-171 controls operational with documented evidence
• ✓Zero production hours lost during segmentation and deployment
• ✓Prime-customer contract retained; two additional DoD-tier contracts won post-certification
• ✓Controls operate continuously, so the next recertification is steady-state instead of a scramble.

Voices from the engagement

Additional perspectives from the same engagement across different roles.