The situation
A plastics injection-molding supplier — roughly $400M in revenue, about 1,500 employees, several distinct defense programs — already had a capable IT and security organization: an established identity platform, monitoring, a security team. What it did not have was a way to prove CMMC Level 2 readiness consistently across programs, on a timeline several primes were now setting.
The challenge
Enterprise scale inverts the usual problem. The controls were largely in place; the difficulty was evidence at scale and consistency across boundaries. Different programs had grown their own conventions. An assessor sampling across the environment would find the same control implemented and documented three different ways — and inconsistency reads as risk even when each version is sound. Internal teams were also stretched across competing program deadlines.
What we did
We did not try to rebuild what already worked. We added the governance layer that tied it together:
- A single control framework and SSP structure that each program mapped into, so one control had one canonical implementation and evidence pattern — with program-specific notes where they genuinely differed.
- A managed GRC operating model: defined owners, a recurring evidence cadence, and dashboards leadership could actually read, so readiness was a standing state rather than a per-assessment project.
- Coordination with their existing teams and providers rather than replacing them — we acted as the accountable CMMC team of record while their security org and infrastructure partners kept operating.
- Tabletop and role-based training across programs so interviews held up consistently no matter which site or team an assessor sampled.
A readiness assessment per program validated that the shared model held up under sampling before any formal assessment.
The outcome
- Multiple programs converged on one control framework and one evidence pattern, so consistency stopped being a finding waiting to happen.
- Leadership gained a portfolio view of readiness instead of chasing each program's status by hand.
- The organization could enter assessments program by program from a known, repeatable posture — and answer primes with confidence.
"We weren't insecure. We were inconsistent, and we couldn't prove ourselves at scale. The program gave us one way to say it — and back it up." — Director of security & compliance (representative)
The enterprise lesson: at scale, CMMC is less about adding controls and more about governing the ones you have so they prove out the same way every time.