Skip to content
Third Rock Consulting Aerospace · Defence · Space

Case Studies

Cyber Compliance Strategy & Readiness

Tier 2 supplier on a U.S. defence contract

103 "yes" answers. 56 survived the evidence.

All 110 CMMC Level 2 requirements validated in four weeks, 20 more than the scope asked for.

The problem

The supplier filed a self-assessment every six months and the contract obligation was live, yet nobody had ever asked the answers to prove themselves.

The approach

We tested every requirement against evidence, not a questionnaire. That surfaced controls the supplier had already paid for but never claimed. It also found a boundary fix that swapped a construction project for a door and a fob. Leadership left with three decisions, and two of them cost nothing.

Anonymised at the client's request: the sector and the scale are described, the name is withheld.

More evidence

Other work that held up.

Start the conversation

Thirty minutes. If you do not have a problem, we will tell you.