The engagement
Allyon ran the full Factory sequence — gap assessment and boundary definition through SSP and POA&M development, evidence collection, and mock-assessment preparation — to its own CMMC Level 2 certification in June 2026. A cross-functional, company-wide effort, executed on the same runbook we ran on ourselves, closing at 110/110.
How the production line ran
The sequence is fixed. What changes between engagements is the environment going into it — not the order of operations, and not the standard each station has to clear before the next one starts.
Scope & Assess
The CUI boundary was defined and data flows mapped before any remediation money moved. All 110 controls scored against the DoD Assessment Methodology, producing the gap register that drove everything downstream.
Architect
Target state designed across the Microsoft security planes — GCC High and Azure Government, Entra ID Conditional Access, Intune baselines, Purview CUI labeling and DLP, Defender, and WDAC.
Implement & Document
Deployment and hardening ran while the SSP, policies, and POA&M were written against the live configuration — which is why the documentation held up when assessors tested it rather than describing an environment that did not exist.
Evidence & Sustain
Evidence collected at the assessment-objective level — the way a C3PAO actually tests — then a mock assessment run as the release gate before the certification window opened.
In the client’s words
"Achieving CMMC Level 2 certification was a cross-functional, company-wide effort that required disciplined execution across every control. inDirect IT was an outstanding partner throughout the entire journey — from gap assessment and boundary definition through SSP/POA&M development, evidence collection, and mock assessment preparation. Their practitioner-led approach, deep Microsoft GCC High and Azure Government expertise, and commitment to objective-level evidence made the difference. We couldn't have hit 110/110 with the same confidence without them. Highly recommend inDirect IT to any defense contractor serious about building a defensible, operational compliance program."
What made the difference
- Boundary before budget — scope defined and verified at Station 01, so remediation spend landed only on systems that belonged in the assessment.
- SSP from the live environment — documentation written against real configuration, which is why it held up under assessor testing.
- Objective-level evidence — artifacts organized the way a C3PAO tests, not the way a binder is organized.
- The mock-assessment gate — findings surfaced and closed internally before the certification window, so assessment week held no surprises.
- Practitioner-led throughout — the people who scoped it were the people who built it and the people who defended it. No hand-off to a bench.
Your name could be Case 02. The runbook is fixed; the input is your environment. Start with a gap assessment or a strategy call.
Put a certification on this page.
Tell us where your program stands and a practitioner will map the path from your current state to a defensible certification. Or email rj@indirectit.com directly.