Cyber Compliance Strategy & Readiness

Tier 2 supplier on a U.S. defence contract

103 "yes" answers. 56 survived the evidence.

All 110 CMMC Level 2 requirements validated in four weeks, 20 more than the scope asked for.

The problem

The supplier filed a self-assessment every six months and the contract obligation was live, yet nobody had ever asked the answers to prove themselves.

The approach

We tested every requirement against evidence, not a questionnaire. That surfaced controls the supplier had already paid for but never claimed. It also found a boundary fix that swapped a construction project for a door and a fob. Leadership left with three decisions, and two of them cost nothing.

Cyber Compliance Strategy & Readiness

Aerospace machining supplier to U.S. and Canadian defence programs

From breach to certification-ready, with one partner end to end.

The problem

Phishing incidents kept coming back after IT cleaned up, while the certification clock kept running. It was two problems on one network.

The approach

We investigated the breach independently. Then we tested the people, the systems and the building, and walked in uninvited to prove the point. From there we drew the controlled-information boundary, ran a mock audit and a second pre-assessment, and turned an incident into a compliance programme. Delivered with a specialist partner.

Cyber Compliance Strategy & Readiness

Supplier seeking work with the Canadian Armed Forces

Controlled Goods and DOS clearances achieved.

Opened negotiation of new defence business streams

The problem

Real capability, but no mapped route to the security clearances the work required, and no view of which clearances served the near term versus the long term.

The approach

Built a clearance roadmap with the C-suite against short-, mid- and long-term goals, then held single point of contact across Legal, Compliance and Operations to carry both the Controlled Goods and Designated Organization Screening applications through.