Validating and Rebuilding a Legacy CMMC Program for a Navy Ship-Preservation Subcontractor

This engagement carried a dimension most do not. The company entered with a prior compliance baseline, an SPRS score of roughly 60 from a 2020 audit, but under new ownership that had inherited the program without full knowledge of how it was built or how current it remained. It was not starting from zero; it needed to validate, update, and rebuild confidence in a program that existed on paper but had gaps in practice.

The first principle was validation before acceleration: a 2020 baseline is a starting point, not a guarantee. The second was to give the technology decision its own phase, holding the policy and technical tracks until the platform question was settled in exchange for a clean execution phase with no rework.

The platform decision came out of a structured evaluation of two cloud CUI options, judged on FedRAMP status, audit readiness, shared-responsibility clarity, Microsoft 365 integration, cost at a four-user scope, and CMMC track record rather than vendor marketing. The FedRAMP-authorized, M365-integrated option won. With it set, the architecture crystallized: four dedicated CUI workstations isolated on a separate VLAN, a firewall managing the network boundary and VPN, the platform handling CUI email and files in the cloud, and the MSP engaged against a documented question set and a shared-responsibility matrix.

As of March 2026 the program has moved from an unvalidated 2020 baseline to a structured, modern effort built on the right foundation, targeting an SPRS score of 110.