02The challenge
Northstar handled CUI in email, file shares and on the shop floor. With no dedicated security staff, a whole-company Level 2 scope looked unaffordable.
03The approach
- 1CUI enclaveA dedicated cloud enclave dramatically reduced the assessment boundary.
- 2SSP authoredA plain-language System Security Plan the team could maintain.
- 3ITAR alignmentForeign-person access controls built into the same enclave.
- 4Mock assessmentFull C3PAO-style dry run before the real thing.
04In their words
CMMC felt impossible for a 60-person shop. Fourteen weeks later we had a clean assessment and a system we actually understand.
05The results
- ✓CMMC Level 2 assessment passed with no open POA&M items
- ✓Retained two prime-contractor relationships
- ✓Ongoing vCISO keeps annual affirmations routine