Third Level IT

HomeIndustriesDefense Contractors

CMMC Level 2, implemented — not just assessed.

NIST 800-171 control implementation for suppliers and manufacturers in the defense industrial base. Enclave architecture, engineering, documentation, and hosting from one firm, so your prime's flow-down clause stops being an open question.

  • CMMC 2.0 Level 2
  • NIST 800-171
  • DFARS 252.204-7012
  • SPRS
  • FIPS 140-2
The situation

The flow-down letter arrived. The clock started.

Your prime wants a CMMC status. Your SPRS score is a number you'd rather not say out loud. And the gap between "we have a firewall" and "we implement 110 NIST 800-171 controls with evidence" is measured in engineering hours nobody on staff has.

Most contractors get two kinds of offers: consultants who produce a gap assessment and leave, or platform vendors who sell a "compliant cloud" that still leaves the hard 40% — your network, your endpoints, your access control — to you.

I do the part they don't: the actual infrastructure.

What I do

Scope it small. Build it right. Document everything.

  • Enclave architectureScope CUI down to a defensible enclave instead of dragging your whole company into assessment scope. Smaller boundary, smaller cost, cleaner assessment.
  • Control implementationThe technical controls of NIST 800-171 engineered in: segmentation, FIPS-validated encryption, MFA, endpoint protection, logging, media protection, and configuration baselines.
  • SSP & POA&MA System Security Plan that describes what actually exists, and a POA&M with real dates — the documents your C3PAO assessor reads first.
  • CUI enclave hostingSingle-tenant infrastructure at our Tier III colocation facility in Southfield, MI. Dedicated hardware, isolated networks behind FortiGate firewalls, no shared tenancy questions to explain away.
  • SPRS scoringAn honest self-assessment score with the worksheet to defend it, and a sequenced plan to raise it.
  • Assessment supportI sit in on the assessment and answer the technical questions about the environment I built.
Why it works

Defense-grade paperwork, backed by real engineering.

Third Level IT is SAM.gov registered with a CAGE code, so subcontracting and teaming paperwork is straightforward. The infrastructure practice comes from fifteen years of enterprise network engineering at Presidio and Sentinel Technologies — the same discipline your prime's security team expects.

Machine shops, engineering firms, and build-to-print suppliers in the 20–500 person range are the core of this practice. If that's you, the path to Level 2 is shorter than the consultants made it sound.

About the hosting environment

Scope is the whole game in CMMC. Get the boundary right and the other 109 controls get cheaper.

Nate HowardFounder & Principal Engineer

Need a CMMC answer for your prime?

Bring your DFARS clause and your current SPRS score. I'll map the realistic path to Level 2 — scope, cost, and sequence.