The clause landed. Someone has to build what it demands.
A prime flowed down DFARS 252.204-7012, an Authorizing Official wants an ATO package, or an auditor has a date. The work is the same: draw a boundary, implement the controls, produce evidence someone else can verify.
We did it to ourselves first: our own CUI enclave, with every NIST SP 800-171 requirement mapped to its evidence in the Trust Codex. See it as built.
Service Organization
Four practices, each one run by the person who does the work
An AO wants a package, or a prime wants your SPRS score. Both will ask for evidence.
Led by Patrick Caruso · Director, Cyber Assurance
Patrick runs RMF and CMMC Level 2 the same way: scope the boundary, implement the controls, then write the SSP and POA&M from the evidence. We did it to our own CUI enclave first. All 110 NIST SP 800-171 requirements are self-assessed, the SPRS score is posted, and every open control sits on a POA&M with a named blocker. No C3PAO has assessed it yet, and the trust page says why.
An ATO package an AO can sign
The SSP, risk assessment, control assessment support and POA&M, written while the system is built rather than after it. The RMF guide shows how we run each step, from Prepare through continuous monitoring.
CMMC Level 2, mapped to evidence
Boundary scoping, implementation and an evidence repository for the 110 NIST SP 800-171 Rev 2 requirements, built to the standard a C3PAO assessment tests.
STIG hardening you can check before you call
Our Hardening and Validation Suite turns DISA STIGs into Ansible playbooks, with test procedures for the checks a machine cannot run. All 2,029 rules, with their check and fix text, are searchable on our free STIG server.
Evidence that does not go stale
Our own enclave's evidence flows in automatically every week. We set up the same cadence for you, so drift from the SSP shows up within a week instead of at the assessment.
Nobody can tell the assessor where your CUI stops.
Led by James Adams · Director, Infrastructure & Systems
James designs the boundary first and builds the infrastructure to fit it: a small enclave, a logged path for CUI into it, and a written record of what it inherits from the platform underneath. Ours is in production, and the showcase walks through it as built.
A boundary drawn before anything is bought
Network zones, segmentation and data flows sized to the smallest boundary that holds your CUI. Architecture diagrams and configuration management records are deliverables, because the assessor will ask for both.
Cloud platforms with the inheritance written down
Azure Government, AWS GovCloud or VMware, with what each one inherits from its provider written into the SSP rather than assumed. Every control the platform carries is one you document by inheritance instead of implementing yourself.
Backups that stay inside the boundary
A copy of CUI is still CUI. Storage, backup and recovery are designed so every copy stays inside the boundary, with a recovery plan exercised before anyone needs it.
Infrastructure as code, so drift is a diff
Reviewable, repeatable configuration, so a change to the boundary shows up in review instead of at the assessment. Runbooks ship with it.
The auditor has a date, and the procedures describe a shop that changed years ago.
Led by Brian MacDonald · Managing Member, Compliance & Operations
Brian builds quality systems the people on the floor keep using: ISO 9001 and ISO/IEC 17025 programs, document control and internal audit. Our own CMMC program runs on 64 controlled documents in our Quality system, and our ISO/IEC 27001 readiness reuses them. The trust page shows where that stands.
ISO 9001 and ISO/IEC 17025 programs
From gap analysis to the certification or accreditation audit: document control, work instructions, internal audit and corrective action.
Accreditation for calibration and test labs
Measurement traceability and uncertainty documented the way an ISO/IEC 17025 assessor samples them, for labs serving regulated programs.
Ready before the auditor arrives
A gap analysis against what the auditor will sample, corrective actions tracked to closure, and a monthly evidence cadence so the next audit is not a scramble.
Procedures that match the floor
Work instructions written with the people who do the work and kept under document control, so a revision is a record rather than a rumor.
The subcontract arrived full of clauses. Someone has to read them against your systems.
Led by John Milso · Director, Legal & Risk Advisory
John reads contract terms against what your systems actually do, before you sign the subcontract or the annual affirmation. He was senior legal counsel at a global, publicly traded software company and is licensed in Massachusetts and Rhode Island. The supply-chain page shows how we read them: each duty the clauses put on a prime, cited to its DFARS clause.
Flow-down review before you sign
Which DFARS and FAR clauses the subcontract carries, what each one obliges you to do, and which terms are worth negotiating.
An affirmation with evidence under it
The annual CMMC affirmation is a statement the False Claims Act can reach, as the self-attestation page explains. We check what the affirming official signs against the SSP, POA&M and SPRS score underneath it.
Your own subcontractors, aligned
Flow-downs to your subs that match what your prime required, and data-handling terms that match your CUI boundary.
A scope of work you can deliver
Contract terms that describe what you have built, not what the proposal hoped for. Engineering reviews the scope before counsel signs off on it.
Framework Coverage
Every framework. One delivery team.
From MacZine
How this work reads from the inside
Written by the people delivering it, in the newsletter, before it was ever a service page.
Start with where you stand
The readiness assessment emails you the result, and someone from MacTech reaches out about what to do first. Our directors are also available for proposals and can be named as key personnel.