Client Success Story
Closing the CMMC Level 2 Gap for a Manufacturer with Legacy IT and Cloud Hesitancy
A Virginia manufacturer with minimal IT staff, aging infrastructure, and reservations about the cloud risked losing DoD contracts under DFARS 7012. InterSec's phased NIST 800-171 approach closed the gaps and reached CMMC Level 2 in nine months.
The Challenge
The firm had to comply with DFARS 7012 while working around aging IT systems and a genuine skepticism about moving to the cloud, and losing DoD contracts was a real possibility without prompt remediation. The obstacles were as much about resources and culture as technology.
The Approach
InterSec started by securing executive backing, then deployed a field-tested readiness framework so the whole organization aligned on the standard from the top down. Bringing leadership in early cleared the roadblock that mattered most here, the hesitancy about cloud adoption.
The Solution in Practice
The team began by scoping CUI, identifying where sensitive data lived across the on-premise systems and the partial cloud footprint, so the protection effort targeted the right assets. From there, InterSec overhauled policies and procedures, establishing asset management, vulnerability scanning, and encryption practices the company had lacked. Because a program is only as strong as the people running it, the work included hands-on staff training and practical security-awareness sessions.
Employee adoption is the difference between a program that lasts and one that lapses after the deadline, so the work trained the people, not just the systems.
Results & Impact
Modernizing the IT systems and building a culture of security readiness protected the company's contracts and laid a foundation for ongoing risk management.
Key Takeaways
Working With InterSec
Limited IT staff and aging systems are the norm, not a disqualifier for CMMC.
InterSec prepares defense manufacturers for assessment with a roadmap scaled to their resources. Let's find your quickest path to a defensible program.