CMMC Level 2 for a Satellite Communications Integrator
Every practice met at the C3PAO assessment, with no POA&M items carried forward.
Client name withheld by agreement- Client
- Satellite communications systems integrator
- Region
- Huntsville, Alabama
- Year
- 2025
- Duration
- 18 weeks
- Scope
- 110 NIST SP 800-171 practices · 2 labs · 140 cleared users
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A satellite communications integrator builds ground terminals and network management software for defense programs. Controlled unclassified information moved between two engineering labs, a software build farm and subcontractors by email and shared drives.
A new prime contract required CMMC Level 2 certification before award. The integrator had a system security plan written three years earlier for a network that no longer existed.
What we did
The approach, step by step.
- 01
Boundary drawn around the work
We followed CUI from contract receipt through design, build and delivery, then set an assessment boundary that kept business systems out.
- 02
Labs and build farm hardened
Configuration baselines, application allowlisting, audit logging and FIPS-validated encryption were applied to lab workstations and build servers.
- 03
Subcontractor sharing controlled
A managed file exchange with access expiry replaced email for CUI going to and from eleven subcontractors.
- 04
SSP rewritten from the ground truth
A new system security plan and evidence set described every practice exactly as it now operates, with screenshots and owners.
- 05
Assessment rehearsed
A mock assessment against every objective, including staff interviews, gave the team confidence before the C3PAO arrived.
Outcomes
What changed, in numbers.
- 110
- of 110 practices met at assessment
- 0
- POA&M items carried forward
- 11
- subcontractors moved to controlled file exchange
- 18
- weeks from kickoff to assessment ready
The assessor asked to see a control and our engineer pulled it up in seconds. That happened all week.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Denver, Colorado · 15 weeks
AI, Cloud & Digital Trust · 2025SOC 2 Type II for a Legal E-Discovery PlatformAn unqualified Type II report covering Security and Confidentiality, delivered before the Am Law 100 renewal cycle.
-
Seattle, Washington · 22 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Contact-Center AI ProviderVoice agents that can no longer be talked into reading back card numbers, and an AI management system heading for certification.
-
Houston, Texas · 24 weeks
AI, Cloud & Digital Trust · 2024Cloud Security Platform for a Genomics LaboratoryPetabytes of patient genomes locked behind one set of guardrails, with no slowdown in sequencing turnaround.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.