Work / Defense contracting
GCC High migration and CMMC Level 2 readiness for a 35-person subcontractor
A 35-person engineering subcontractor received flow-down requirements for CMMC Level 2 from its prime, with controlled unclassified information scattered across commercial Microsoft 365, personal OneDrives and a shared drive on an old server.
Representative engagement. Details from more than one client are combined and identifying specifics changed; the technical approach and outcomes are as delivered.
The situation
The company's commercial Microsoft 365 tenant could not satisfy DFARS 7012's requirements for the data they held, their System Security Plan was a template nobody had filled in, and the prime's deadline left about seven months. Leadership's first instinct was to move everything and everyone into a sovereign cloud, which would have tripled licensing cost.
What we did
We started by scoping: which people, systems and data actually touched CUI. It turned out to be 14 of the 35 staff and two workflows. That defined an enclave — a GCC High tenant for those users, managed devices enrolled in Intune with a hardened baseline, and a documented boundary — while the rest of the company stayed on commercial 365 with its own, lighter hardening.
The migration moved mailboxes, Teams and SharePoint content for the enclave users over two weekends, with CUI located and relocated from personal drives along the way. Logging was centralized, MFA became phishing-resistant for the enclave, and a vulnerability-management cadence was put in place. The SSP was written from the environment as built, control by control, with a Plan of Action for the handful of items that needed more time, and an evidence library organized the way a C3PAO wants to receive it.
Cybersecurity & compliance
Managed IT (Complete)
Where it stands now
The company is on a Complete plan: monthly vulnerability scans and remediation tracking, log monitoring, an annual tabletop exercise, and the SSP kept current as the environment changes. They passed their assessment on the first attempt.
Have a similar situation?
Tell us where it hurts and we'll say whether the same approach fits, and what it would take.