Defense consulting firm passes its C3PAO CMMC Level 2 assessment — 110 of 110 controls
How a defense-industry consulting firm went from kickoff to a perfect Level 2 assessment in about 90 days
Industry: Defense consulting (professional services; handles controlled unclassified information for defense customers)
Location: Northeastern United States
Solution: CMMC Level 2 preparation plus managed IT and security from Stealth Technology Group, a Cyber AB Registered Practitioner Organization: scoping and enclave design, remediation, System Security Plan and POA&M, control-by-control evidence, assessment rehearsal and assessment-day support
Results: Passed its C3PAO CMMC Level 2 assessment in July 2026 with all 110 NIST SP 800-171 requirements met and no open POA&M items, about 90 days from kickoff to assessment-ready
Results
C3PAO CMMC Level 2 assessment passed — 110 of 110 controls
About 90 days from kickoff to assessment-ready
One partner for managed IT and CMMC — no hand-offs, no finger-pointing
The Challenge
The firm’s defense work depends on handling controlled unclassified information (CUI) for its customers, and its primes were flowing CMMC Level 2 down the supply chain. A Level 2 assessment by an authorized C3PAO was the way to keep that work and win more of it.
The firm had a small internal IT footprint, CUI mixed into everyday systems, and no appetite for a year-long program. It needed three things: a boundary that kept CUI out of the general business environment, evidence a third-party assessor would accept for every one of the 110 requirements, and a timeline the business could live with. It also wanted one partner accountable for the outcome, not a compliance consultant handing findings to an IT vendor.
The Solution
Stealth ran the engagement as a single accountable team: the people operating the environment were the people building the evidence.
- Scoped tightly. CUI moved into a dedicated enclave: virtual desktops for the people who work with it, a controlled document workspace for storage, administrator access through a bastion host, and privileged roles granted just in time rather than held permanently. Everything outside the enclave stayed out of scope.
- Mapped every requirement to an owner. All 110 NIST SP 800-171 requirements were assigned, implemented and written up the way an assessor tests them: 103 implemented inside the enclave, 6 inherited from cloud and service providers with the shared responsibility documented, and 1 not applicable (media inspection) with the justification recorded.
- Closed the gaps. Identity and multifactor authentication, endpoint and email protection, logging and alerting, backup, access control and configuration management, with evidence captured as each control was built.
- Wrote the System Security Plan and POA&M and assembled the evidence package control by control, so nothing depended on memory on assessment day.
- Rehearsed. The team walked the evidence for every requirement before the assessor arrived and fixed anything that did not read cleanly.
About 90 days after kickoff the firm was assessment-ready. The C3PAO found all 110 requirements met, and the plan of action and milestones had no open items. The firm holds the result; Stealth prepared the environment, the evidence and the team, and continues to operate the enclave under managed IT and security.
Is this you? If your primes are asking about CMMC, or you have signed an SPRS affirmation you are not sure you could defend, a 30-minute readiness conversation will tell you where you stand and what it would take.
Talk to Michael Bannach, President and CEO
In July 2026 a defense consulting firm we prepared met all 110 requirements at its C3PAO CMMC Level 2 assessment, about 90 days after kickoff. In 30 minutes Michael walks through your scope, the score you have posted in SPRS and what it would take to be assessment-ready. Read the case study.