Third Rock Consulting

Cyber Compliance Strategy & Readiness

Tier 2 supplier on a U.S. defence contract

103 "yes" answers. 56 survived the evidence.

All 110 CMMC Level 2 requirements validated in four weeks, 20 more than the scope asked for.

The problem

The supplier filed a self-assessment every six months and the contract obligation was live, yet nobody had ever asked the answers to prove themselves.

The approach

We tested every requirement against evidence, not a questionnaire. That surfaced controls the supplier had already paid for but never claimed. It also found a boundary fix that swapped a construction project for a door and a fob. Leadership left with three decisions, and two of them cost nothing.

Cyber Compliance Strategy & Readiness

Aerospace machining supplier to U.S. and Canadian defence programs

From breach to certification-ready, with one partner end to end.

The problem

Phishing incidents kept coming back after IT cleaned up, while the certification clock kept running. It was two problems on one network.

The approach

We investigated the breach independently. Then we tested the people, the systems and the building, and walked in uninvited to prove the point. From there we drew the controlled-information boundary, ran a mock audit and a second pre-assessment, and turned an incident into a compliance programme. Delivered with a specialist partner.

Supply Chain & Industrial Strategy

Canadian defence vehicle manufacturer bidding a DND program

ITB and Value Proposition plans in five working days.

The problem

The bid needed an ITB Company Business Plan and an ITB Management Plan. The deadline was days away, and nobody in-house spoke fluent ITB.

The approach

We wrote both plans to the letter of the bidder instructions. They turned a Canadian supply base into a low-risk ITB story evaluators could score. A former senior defence procurement leader checked the work before it went out the door.

Workforce & Program Delivery

Provincially funded aerospace workforce program

Kept on for round two. The spreadsheets were not.

The problem

A volunteer-run association was delivering a government-funded training program and handling registration, waitlists and duplicate checks by hand. Meanwhile the program was scaling to several hundred participants.

The approach

We served as the program's IT organisation on a fixed budget. When the program was renewed, we moved the website and registration onto an automated platform, built with a technical partner, so staff could run a program instead of a spreadsheet.

Cyber Compliance Strategy & Readiness

Supplier seeking work with the Canadian Armed Forces

Controlled Goods and DOS clearances achieved.

Opened negotiation of new defence business streams

The problem

Real capability, but no mapped route to the security clearances the work required, and no view of which clearances served the near term versus the long term.

The approach

Built a clearance roadmap with the C-suite against short-, mid- and long-term goals, then held single point of contact across Legal, Compliance and Operations to carry both the Controlled Goods and Designated Organization Screening applications through.

Supply Chain & Industrial Strategy

Bid and proposal positioning, business and government

Over 80% bid submission success rate.

50+ RFx submitted, on bids up to $50M USD

The problem

Strong technical answers lose to better-positioned bids. The work is deciding what to bid, how to frame it, and what the buyer is actually scoring.

The approach

Full lifecycle: RFP analysis and effort studies, Statements of Work, and the legal and procurement obstacles along the way through to final submission.

Supply Chain & Industrial Strategy

Aircraft final assembly line and its Tier 1 suppliers

70 to 80% reduction in processing time.

Schedule risk identified in 15 minutes, not days or weeks

The problem

A final assembly line and its Tier 1 suppliers had no shared view of pre-flight schedule risk. Five departments each held part of the picture and reconciled it by hand.

The approach

Diagnosed where the bottleneck actually sat across Procurement, Line Logistics, Methods Engineering, Quality and Operations, defined a single data model every department could work from, and oversaw delivery of the automation on top of it.

Supply Chain & Industrial Strategy

Multi-site engineering programme

50 to 60% reduction in cost.

Led to repeat business and an expanded scope of engagement

The problem

Workload swinging between sites, with the subject matter expertise that made the programme work concentrated in people who could walk out of the door.

The approach

Redesigned the delivery model so capacity could flex across sites while expertise stayed inside the business: a training pathway pairing new resource with onsite teams, held together by an operational, tactical and business-review cadence.

Cyber Compliance Strategy & Readiness

Tier 2 supplier on a U.S. defence contract

103 "yes" answers. 56 survived the evidence.

All 110 CMMC Level 2 requirements validated in four weeks, 20 more than the scope asked for.

The problem

The supplier filed a self-assessment every six months and the contract obligation was live, yet nobody had ever asked the answers to prove themselves.

The approach

We tested every requirement against evidence, not a questionnaire. That surfaced controls the supplier had already paid for but never claimed. It also found a boundary fix that swapped a construction project for a door and a fob. Leadership left with three decisions, and two of them cost nothing.

Cyber Compliance Strategy & Readiness

Aerospace machining supplier to U.S. and Canadian defence programs

From breach to certification-ready, with one partner end to end.

The problem

Phishing incidents kept coming back after IT cleaned up, while the certification clock kept running. It was two problems on one network.

The approach

We investigated the breach independently. Then we tested the people, the systems and the building, and walked in uninvited to prove the point. From there we drew the controlled-information boundary, ran a mock audit and a second pre-assessment, and turned an incident into a compliance programme. Delivered with a specialist partner.

Supply Chain & Industrial Strategy

Canadian defence vehicle manufacturer bidding a DND program

ITB and Value Proposition plans in five working days.

The problem

The bid needed an ITB Company Business Plan and an ITB Management Plan. The deadline was days away, and nobody in-house spoke fluent ITB.

The approach

We wrote both plans to the letter of the bidder instructions. They turned a Canadian supply base into a low-risk ITB story evaluators could score. A former senior defence procurement leader checked the work before it went out the door.

Workforce & Program Delivery

Provincially funded aerospace workforce program

Kept on for round two. The spreadsheets were not.

The problem

A volunteer-run association was delivering a government-funded training program and handling registration, waitlists and duplicate checks by hand. Meanwhile the program was scaling to several hundred participants.

The approach

We served as the program's IT organisation on a fixed budget. When the program was renewed, we moved the website and registration onto an automated platform, built with a technical partner, so staff could run a program instead of a spreadsheet.

Cyber Compliance Strategy & Readiness

Supplier seeking work with the Canadian Armed Forces

Controlled Goods and DOS clearances achieved.

Opened negotiation of new defence business streams

The problem

Real capability, but no mapped route to the security clearances the work required, and no view of which clearances served the near term versus the long term.

The approach

Built a clearance roadmap with the C-suite against short-, mid- and long-term goals, then held single point of contact across Legal, Compliance and Operations to carry both the Controlled Goods and Designated Organization Screening applications through.

Supply Chain & Industrial Strategy

Bid and proposal positioning, business and government

Over 80% bid submission success rate.

50+ RFx submitted, on bids up to $50M USD

The problem

Strong technical answers lose to better-positioned bids. The work is deciding what to bid, how to frame it, and what the buyer is actually scoring.

The approach

Full lifecycle: RFP analysis and effort studies, Statements of Work, and the legal and procurement obstacles along the way through to final submission.

Supply Chain & Industrial Strategy

Aircraft final assembly line and its Tier 1 suppliers

70 to 80% reduction in processing time.

Schedule risk identified in 15 minutes, not days or weeks

The problem

A final assembly line and its Tier 1 suppliers had no shared view of pre-flight schedule risk. Five departments each held part of the picture and reconciled it by hand.

The approach

Diagnosed where the bottleneck actually sat across Procurement, Line Logistics, Methods Engineering, Quality and Operations, defined a single data model every department could work from, and oversaw delivery of the automation on top of it.

Supply Chain & Industrial Strategy

Multi-site engineering programme

50 to 60% reduction in cost.

Led to repeat business and an expanded scope of engagement

The problem

Workload swinging between sites, with the subject matter expertise that made the programme work concentrated in people who could walk out of the door.

The approach

Redesigned the delivery model so capacity could flex across sites while expertise stayed inside the business: a training pathway pairing new resource with onsite teams, held together by an operational, tactical and business-review cadence.

Cyber Compliance Strategy & Readiness

Tier 2 supplier on a U.S. defence contract

103 "yes" answers. 56 survived the evidence.

All 110 CMMC Level 2 requirements validated in four weeks, 20 more than the scope asked for.

The problem

The supplier filed a self-assessment every six months and the contract obligation was live, yet nobody had ever asked the answers to prove themselves.

The approach

We tested every requirement against evidence, not a questionnaire. That surfaced controls the supplier had already paid for but never claimed. It also found a boundary fix that swapped a construction project for a door and a fob. Leadership left with three decisions, and two of them cost nothing.

Cyber Compliance Strategy & Readiness

Aerospace machining supplier to U.S. and Canadian defence programs

From breach to certification-ready, with one partner end to end.

The problem

Phishing incidents kept coming back after IT cleaned up, while the certification clock kept running. It was two problems on one network.

The approach

We investigated the breach independently. Then we tested the people, the systems and the building, and walked in uninvited to prove the point. From there we drew the controlled-information boundary, ran a mock audit and a second pre-assessment, and turned an incident into a compliance programme. Delivered with a specialist partner.

Supply Chain & Industrial Strategy

Canadian defence vehicle manufacturer bidding a DND program

ITB and Value Proposition plans in five working days.

The problem

The bid needed an ITB Company Business Plan and an ITB Management Plan. The deadline was days away, and nobody in-house spoke fluent ITB.

The approach

We wrote both plans to the letter of the bidder instructions. They turned a Canadian supply base into a low-risk ITB story evaluators could score. A former senior defence procurement leader checked the work before it went out the door.

Workforce & Program Delivery

Provincially funded aerospace workforce program

Kept on for round two. The spreadsheets were not.

The problem

A volunteer-run association was delivering a government-funded training program and handling registration, waitlists and duplicate checks by hand. Meanwhile the program was scaling to several hundred participants.

The approach

We served as the program's IT organisation on a fixed budget. When the program was renewed, we moved the website and registration onto an automated platform, built with a technical partner, so staff could run a program instead of a spreadsheet.

Cyber Compliance Strategy & Readiness

Supplier seeking work with the Canadian Armed Forces

Controlled Goods and DOS clearances achieved.

Opened negotiation of new defence business streams

The problem

Real capability, but no mapped route to the security clearances the work required, and no view of which clearances served the near term versus the long term.

The approach

Built a clearance roadmap with the C-suite against short-, mid- and long-term goals, then held single point of contact across Legal, Compliance and Operations to carry both the Controlled Goods and Designated Organization Screening applications through.

Supply Chain & Industrial Strategy

Bid and proposal positioning, business and government

Over 80% bid submission success rate.

50+ RFx submitted, on bids up to $50M USD

The problem

Strong technical answers lose to better-positioned bids. The work is deciding what to bid, how to frame it, and what the buyer is actually scoring.

The approach

Full lifecycle: RFP analysis and effort studies, Statements of Work, and the legal and procurement obstacles along the way through to final submission.

Supply Chain & Industrial Strategy

Aircraft final assembly line and its Tier 1 suppliers

70 to 80% reduction in processing time.

Schedule risk identified in 15 minutes, not days or weeks

The problem

A final assembly line and its Tier 1 suppliers had no shared view of pre-flight schedule risk. Five departments each held part of the picture and reconciled it by hand.

The approach

Diagnosed where the bottleneck actually sat across Procurement, Line Logistics, Methods Engineering, Quality and Operations, defined a single data model every department could work from, and oversaw delivery of the automation on top of it.

Supply Chain & Industrial Strategy

Multi-site engineering programme

50 to 60% reduction in cost.

Led to repeat business and an expanded scope of engagement

The problem

Workload swinging between sites, with the subject matter expertise that made the programme work concentrated in people who could walk out of the door.

The approach

Redesigned the delivery model so capacity could flex across sites while expertise stayed inside the business: a training pathway pairing new resource with onsite teams, held together by an operational, tactical and business-review cadence.