Manufacturing CMMC L2 readiness, 9 months, 110 controls, 4x below consultant quote

Engagement at a glance

Industry: Precision manufacturing, DoD supply chain (Tier-2 subcontractor). Size: 85 employees, $14M revenue. Trigger: Prime contractor flow-down clause adding CMMC L2 as a contract requirement for the next renewal cycle. Engagement type: CaaS + CMMC L2 readiness program. Duration: 9 months. Status: Pre-C3PAO assessment, all 110 controls implemented.

The situation

An 85-employee precision-machining firm in Muskegon makes parts for a Tier-1 DoD aerospace supplier. The contract that funds roughly 40% of the firm's revenue includes a flow-down clause requiring CMMC Level 2 certification by the next renewal. The firm has no in-house IT staff beyond a part-time office-manager-plus-IT role. Their existing break-fix MSP can fix printers but has never implemented NIST SP 800-171.

The owner's first reaction to the flow-down clause is to ask the MSP. The MSP quotes "CMMC compliance" at a low price that, on inspection, covers awareness training and an EDR rollout, not the 110 controls. The owner's second reaction is to talk to a defense-contractor consultant who quotes the work at $250,000+ over 18 months. The math doesn't work either way; the contract requires certification, the consultant pricing doesn't fit the company, the existing MSP can't deliver.

What we did

Engagement structure: a 9-month CMMC L2 readiness program bundled with CaaS for ongoing operations. The readiness program is fixed-scope, $45,000 starting. CaaS is the day-to-day managed security wrapper.

Months 1-2, gap assessment. We ran a scoped self-assessment against all 110 NIST SP 800-171 controls. The output was a written gap list with each control rated Implemented, Partially Implemented, or Not Implemented. Of the 110 controls, 38 were already covered by Microsoft 365 E5 Security tooling the firm already paid for but had never configured; 41 required policy and process work; 31 required new technical implementations.

Months 3-5, implementation. We deployed and configured the gap-closing controls in priority order. Access control rules in Microsoft Entra. EDR deployment on every endpoint. Audit logging via Microsoft Sentinel at the basic tier. CUI-handling workflows (physical and electronic). Incident response playbooks. Vendor risk assessments on the four upstream and downstream entities that touched CUI.

Months 6-7, documentation. The 110-control assessment was rewritten as a System Security Plan (SSP) and a Plan of Action and Milestones (POA&M). Every control had a written narrative, evidence pointer, and named responsible party.

Months 8-9, readiness. Tabletop exercises against the SSP. Internal pre-assessment dry-runs. A practice C3PAO assessment delivered by an Evolv partner organization. Gap closure on the dry-run findings.

Outcomes

All 110 NIST SP 800-171 controls implemented and documented. Pre-engagement: 38 covered, 72 unaddressed. Post-engagement: 110 implemented, written SSP and POA&M maintained.

Time-to-readiness: 9 months. Industry typical is 12-18 months for a firm starting from this baseline.

Total engagement cost: $58,000 ($45,000 CMMC L2 readiness program + $13,000 in CaaS over the 9-month window). Below the firm's initial $250K consultant quote by roughly 4x.

Microsoft 365 E5 utilization rose from ~30% to ~85% of available security features. Configuration alone closed 38 of the 110 controls.

Cyber-insurance renewal premium decreased 18% at the following renewal, attributable to documented CMMC-aligned controls.

What to do next

If your firm is in the DoD supply chain, directly or as a subcontractor, and CMMC clauses are appearing in your contracts: start with the Scorecard. The CMMC variant maps your current state against all 110 L2 controls and tells you which are covered, partially covered, or unaddressed.

Run the Scorecard →, 5 minutes.

Book a CMMC scoping call →, 20 minutes with a named human within four business hours.