CMMC Compliance, Turned into a Project with an End

The company holds its government contracts directly. No prime contractor sits above it to absorb the requirement or interpret it, so the obligation sits in its own contract terms and flows down from it to everyone else.

The company had a working business and an IT setup that had grown around it. The standard asks for evidence, control by control, that specific things are true.

• Nobody internally could say which controls the business already met
• Controlled unclassified information (CUI) was on the network, but nobody could say where it was stored, including copies, or who could reach it. On a construction project that means drawings, specifications, site plans and facility details, the working documents that get emailed and shared every day
• Work happens away from the office. Job site trailers and the tablets and laptops used in the field weren't on the office network or its patching and backup schedule, and no plan accounted for them
• Controlled information leaves the company by design. It goes to subcontractors and to the architects and engineers on each project, and nobody had a record of what had gone where. As the prime, the company answers for it after it leaves
• Outside advice ranged from "you're basically fine" to quotes for a program costing more than the contracts were worth
• The exposure was ineligibility. Failing to certify meant losing the ability to hold the contracts the business bids on, and a prime contractor gets no grace period from anyone above it

The hardest part was that nobody could see the shape of the whole job. Without that, it felt open-ended, and open-ended problems get postponed.

We started with scope, because scope decides what the whole program costs.

Tech Dynamix mapped where controlled unclassified information lived: the systems that held it, the people who handled it, the parts of the network it crossed, and where it went when it left the company. Narrowing that boundary is the most effective way for a contractor to reduce what certification costs. Every system inside the boundary carries the full weight of the control set, and every system outside it doesn't.

The mapping found systems too weak to hold controlled information. Parts of the environment couldn't meet the standard as configured, and some couldn't meet it at all in their current form.

The paperwork side had two gaps. There were no written procedures, because the business's way of doing things lived in people's heads, and the standard asks for documented process. Logging and audit trails were thin or missing, so there was no way to reconstruct who did what, and a large share of the control set depends on answering that question after the fact.

With the boundary drawn, we assessed all 110 controls as part of our CMMC readiness work. For each one we wrote down, in plain language, its current status with the evidence that proves it, and the work needed to close any gap.

The remediation plan that came out of that is ordered by risk and effort, not by control number:

• Already met. Controls the business satisfied, with the evidence identified so it exists before an assessor asks
• Close quickly. Configuration and policy work with real security value and little cost: multi-factor authentication on every account that touches controlled information, an access review (which almost always removes more access than it grants), session lockout and screen timeouts, turning on logging that was already licensed and switched off, and removing local administrator rights from standard users
• Plan and budget. These items have a real price and a lead time. The largest is the systems that can't meet the standard as they stand, and the others are segmenting job site connectivity from the office network and bringing field devices under management
• Document. The written procedures, plus the system security plan and plan of action that an assessor reviews. Contractors most often leave this until last, it takes the longest, and here it started from nothing

Not all of it had to be built in-house. Much of the control set is met by security tools that already exist, including multi-factor authentication, managed detection and response, centralized logging with a SIEM to make sense of it, email security, vulnerability scanning, and device management for equipment that never comes back to the office.

Owning a tool doesn't satisfy a control. The tool has to be configured to the standard and monitored, with evidence on hand when an assessor asks, and that ongoing work is what a business without a security team can't carry alone. Certification tests documentation as much as configuration, so a business that has done the work but can't evidence it fails anyway.

The company now has a compliance program with a defined scope and sequence.

• A defined boundary, so the work and the cost apply to part of the business instead of all of it
• A written position on all 110 controls that the business can put in front of a contracting officer or an assessor
• A remediation plan ordered by risk and effort, with the cheap high-value items separated from the ones that need budget and lead time
• Evidence collected as the work is done, so nobody has to reconstruct it under time pressure later
• Written procedures where there were none, plus logging and audit trails built as the program proceeds

The work is ongoing, which is where most CMMC programs are at this stage. That's a better position than it sounds, because the expensive uncertainty is gone. The business knows the work ahead and the order to do it in, with a rough cost for each piece.

The security improvements would have been worth making without a contract requiring them. Multi-factor authentication, access limited to the people who need it, logging that someone reads, control over what leaves the company and managed field devices are the controls that stop ordinary attacks. Construction companies are a target for those attacks because so much of the work moves over email between parties who have never met.

Compliance work is expensive while it's undefined. Once the boundary is drawn and every control has a written status, CMMC compliance becomes a project the company can schedule and budget. For background on the standard itself, see CMMC in plain English.