HomeIndustriesDefense Contractors
CMMC Level 2, implemented — not just assessed.
NIST 800-171 control implementation for suppliers and manufacturers in the defense industrial base. Enclave architecture, engineering, documentation, and hosting from one firm, so your prime's flow-down clause stops being an open question.
The flow-down letter arrived. The clock started.
Your prime wants a CMMC status. Your SPRS score is a number you'd rather not say out loud. And the gap between "we have a firewall" and "we implement 110 NIST 800-171 controls with evidence" is measured in engineering hours nobody on staff has.
Most contractors get two kinds of offers: consultants who produce a gap assessment and leave, or platform vendors who sell a "compliant cloud" that still leaves the hard 40% — your network, your endpoints, your access control — to you.
I do the part they don't: the actual infrastructure.
Scope it small. Build it right. Document everything.
- Enclave architectureScope CUI down to a defensible enclave instead of dragging your whole company into assessment scope. Smaller boundary, smaller cost, cleaner assessment.
- Control implementationThe technical controls of NIST 800-171 engineered in: segmentation, FIPS-validated encryption, MFA, endpoint protection, logging, media protection, and configuration baselines.
- SSP & POA&MA System Security Plan that describes what actually exists, and a POA&M with real dates — the documents your C3PAO assessor reads first.
- CUI enclave hostingSingle-tenant infrastructure at our Tier III colocation facility in Southfield, MI. Dedicated hardware, isolated networks behind FortiGate firewalls, no shared tenancy questions to explain away.
- SPRS scoringAn honest self-assessment score with the worksheet to defend it, and a sequenced plan to raise it.
- Assessment supportI sit in on the assessment and answer the technical questions about the environment I built.
Defense-grade paperwork, backed by real engineering.
Third Level IT is SAM.gov registered with a CAGE code, so subcontracting and teaming paperwork is straightforward. The infrastructure practice comes from fifteen years of enterprise network engineering at Presidio and Sentinel Technologies — the same discipline your prime's security team expects.
Machine shops, engineering firms, and build-to-print suppliers in the 20–500 person range are the core of this practice. If that's you, the path to Level 2 is shorter than the consultants made it sound.
Scope is the whole game in CMMC. Get the boundary right and the other 109 controls get cheaper.
Nate HowardFounder & Principal Engineer
Need a CMMC answer for your prime?
Bring your DFARS clause and your current SPRS score. I'll map the realistic path to Level 2 — scope, cost, and sequence.