The situation
A precision machine shop — roughly $8M in revenue, about 45 people, no full-time IT beyond a part-time managed-services contract — won work on a defense program and received a contract flow-down referencing CUI handling and CMMC Level 2. Leadership knew it was important and had no idea what it required. The shop ran a flat network: the same machines and shares the front office and the floor used every day.
The challenge
For a company this size, the instinct — and the fear — was that "becoming CMMC compliant" meant securing everything and hiring an IT department they could not afford. Their real constraints were ordinary: a tight budget, no in-house security expertise, and a deadline driven by the prime, not by them.
What we did
We started with a gap assessment to answer the only question that mattered first: where does the CUI actually go? It turned out to touch a handful of people and two engineering workstations — not the whole shop.
That reframed the project. Instead of hardening 45 seats, we designed a small enclave around the CUI work and brought in a vetted infrastructure partner to stand up a government-cloud workspace for the documents and email. With the boundary small, the rest followed:
- Policies and an SSP written to the actual environment — not a generic template — so every control mapped to something real.
- A managed GRC routine so evidence stayed current instead of being reconstructed under pressure.
- Short, practical training for the few people inside the boundary, so they could answer for their own controls.
We then ran a readiness assessment as a dry run before the formal one.
The outcome
- The in-scope footprint shrank from "the whole company" to a defined enclave of a few users and two workstations.
- Their self-assessment score moved from deeply negative to assessment-ready, with a short, owned POA&M for the remaining low-weight items.
- The owner stopped treating compliance as an existential threat and started treating it as a manageable line item — and a door to more defense work.
"We thought CMMC meant tearing out our whole network. It meant drawing a line around the part that actually mattered and doing that part well." — Operations lead (representative)
The lesson generalizes: for a small manufacturer, the win is rarely more security everywhere. It is the right boundary, drawn early, with the rest of the business deliberately left out of scope.