Client profile
A mission-critical precision machining shop supporting aerospace, defense, space and adjacent technology programs, already performing on Department of Defense contracts.
Client name and identifying details have been withheld or generalized to protect confidentiality, consistent with TRANUSA’s practice across all client engagements.
The Problem
The shop was doing what a responsible subcontractor is supposed to do. They had internal IT. They had security tooling in place. They were actively engaged with their obligations under NIST SP 800-171 and treating them as a priority. What they did not have was a reliable way to tell how much of the framework any of it actually covered.
That is a harder question than it looks, and the market does not make it easier. Internal IT was leading the search and evaluating point solutions, and vendors were happy to supply them. One quote paired an EDR product with a SIEM and presented the bundle as “your CMMC solution.” Those are real controls doing real work. They also answer a fraction of the assessment objectives, and leave policy, documented and repeatable process, evidence collection, the System Security Plan and POA&M untouched. A shop can buy in good faith, act on the best information it has been given, and still be a long way from a complete program, with nothing visible to signal the difference.
The rest of the gap was operational rather than technical. Their IT function was built for uptime, which is what a manufacturer needs it to do: keep the machines running and the people working. Access to mission-critical systems was not being logged or reviewed. Not because anyone had decided it did not matter, but because operations teams are not measured that way, and there was no system in place to make it routine.
What TRANUSA Did
TRANUSA came in first as an advisor, engaged to review what the client was already doing on their CMMC journey and map it against the framework, control by control. That review is what made the picture legible: which objectives the tooling on the table genuinely satisfied, and which parts of the program no product was going to answer. It moved the conversation from which solution to buy to what a compliant operation has to look like.
By the client’s own account, that is what decided the engagement. The alternative in front of them was another point solution and an assurance that it would be enough.
TRANUSA arrived with a plan instead of an assortment of products: a tiered, sequenced approach setting out what had to be true at each stage to reach compliance and, ultimately, certification. Behind the plan was a partner prepared to manage the whole of security compliance as an ongoing responsibility: scoping, remediation, evidence, and the daily operations underneath it. Compliance ownership stays with the client, as it always does; what changes is who is accountable for running the program.
Scoping the enclave
Because the client was already on Microsoft 365 GCC High, TRANUSA scoped the CUI enclave enterprise-wide from the outset: every user inside the boundary rather than a subset of them.
A narrower enclave looks cheaper until you ask who maintains it. Keeping controlled data inside a partition, keeping everyone else out of it, and being able to prove both is the client’s responsibility. Physical and logical access segregation is a business function, not something a compliance partner performs on their behalf. Scoping wide removed that standing job rather than creating it, and removed the scoping rework that otherwise arrives every time the business changes shape.
The licensing review nobody quoted
About a month in, with the environment understood well enough to be worth examining, TRANUSA reviewed the client’s GCC High licensing. Microsoft had by then released GCC High Business Premium tiers carrying the feature set a CMMC Level 2 program needs, at close to half the per-seat cost of what the client was paying. Those tiers did not exist when the engagement was signed. Moving the client onto the appropriate SKUs cut their Microsoft licensing spend by roughly half, and those savings went on to cover most of the cost of the compliance program.
No one had promised that going in, and no one could have: it was not a discount available to quote. It came from continuing to watch the licensing landscape on the client’s behalf after the engagement was already underway, and acting on it when it moved.
The program itself
From there the engagement ran end to end: scoping, a gap assessment against NIST SP 800-171, a full POA&M, and remediation of every item on it, alongside deployment of TRANUSA’s security tool stack. Several tools the client was already paying for were retired where ours covered the same ground, streamlining their spend further. We built the compliance-driven operations they did not have: auditing and logging across mission-critical and privileged access, and a formal service desk in place of the informal one.
The division of labor is deliberate. TRANUSA sits behind the client’s own IT as escalation rather than in front of it. We run their compliance program. We are not their operational IT department, and the engagement was structured that way on purpose.
Application control was introduced the way it has to be in a production environment. The Zero Trust platform spends roughly thirty days learning what normal operation looks like before enforcement begins, so day-to-day work is part of the baseline rather than blocked by it. System-level changes go through whitelisting after that. The friction is real, and it is a requirement of the framework rather than a preference of ours. The job is to sequence it so it never lands on the floor unannounced.
The ticketing system mattered more than anyone expected. The client had none. TRANUSA stood ours up for the compliance work and then extended it across IT operations, so user onboarding and offboarding, change management, incident response and security events all run through a single system of record. Security awareness and phishing training moved onto our platform in the same pass.
The Outcome
The client reached a Supplier Performance Risk System score of 110 out of 110, a full NIST SP 800-171 implementation with no open deductions, and continues to win Department of Defense work on the strength of that self-attestation. Defense contracts account for roughly a quarter of their business today, and that share is growing.
Over the year of the engagement the shop doubled its revenue while headcount grew by only about a fifth. Output scaled well ahead of hiring. In the client’s view, a settled compliance posture is part of what made that possible. A shop unsure of where it stands bids carefully, because winning work it cannot support in a compliant way is how a prime relationship gets damaged. A shop that knows exactly where it stands can go after the work in front of it.
Growth of that kind is also the harder test of a compliance program. Doubling output means more jobs, more people touching controlled data, and more change moving through the environment every week. A program that only holds at low volume is not a program. It is a snapshot that survives until the business gets busy. Because the enclave was scoped enterprise-wide from the outset and the operational work already ran through a single system of record, the program absorbed that growth without the boundary moving and without the process reverting to a fire drill.
The clearest signal of how the engagement has gone is that the client has referred TRANUSA to a number of the contractors and vendors in their own supply chain.
Where Things Stand Today
The client is compliant and certification ready at 110 out of 110 on SPRS, and has not been certified by a C3PAO. Those are different claims: the compliance work is done and evidenced, and no third party certification has been issued.
That distinction changed shape in 2026. The Department of War suspended CMMC Phase 2 in July, and a September memorandum directed contracting officers to strip third party assessment requirements out of contracts. What did not change is the part that binds a supplier: DFARS 252.204-7012, the 110 requirements of NIST SP 800-171, SPRS scoring, the annual affirmation, and the System Security Plan and POA&M obligations all still apply, and enforcement has continued throughout. Removing independent verification makes documentation and defensibility more important, not less.
Approaching a year into the engagement, TRANUSA still runs the program and maintains the evidence locker continuously, so the SPRS score reflects a live program rather than a point-in-time push. The remaining step is the assessment itself, not further remediation.
The Decision That Carried It
What used to be a fire drill, chasing down the accounts, hoping nothing was missed, reconstructing after the fact if anyone asked, is now a workflow that captures its own evidence as it goes. Come assessment time the evidence is already there, because it is a by-product of how the work gets done rather than a project that starts when the assessor calls.
What the Client Actually Bought
What a client buys from TRANUSA is a compliance program. These are the parts of it. Every artifact on this list belongs to the client, in the client’s name, and stays with them whether or not the relationship continues.
- A documented assessment boundary, and the reasoning behind where it sits
- A System Security Plan mapped to all 110 requirements, kept current
- A live Plan of Action and Milestones, actively managed rather than filed
- An evidence repository built continuously, with collection dates and the control objective each artifact supports
- A monthly change advisory board, so change is reviewed before it moves the boundary
- Audit defense: TRANUSA at the table when an assessor asks
- A posted score, and the documentation behind it, owned by the client
What Runs Underneath
The platform sits underneath the program as the mechanism by which it is operated, not as the thing being sold. Every engagement is backed by the same stack and operating model regardless of client size. TRANUSA does not operate a staffed watch floor and does not describe itself as one.
- Continuous SIEM alerting with 24/7 escalation to TRANUSA on-call engineering
- Threat intelligence and log aggregation hosted on U.S. private cloud infrastructure
- Zero Trust endpoint defense with default-deny application control
- Continuous vulnerability management, prioritized by risk and CUI proximity
- SLA-driven patch management, with critical patches deployed to defined, reportable targets
- Enterprise GRC practice, including System Security Plan and POA&M management
- 100% U.S. Persons, with no offshore personnel or subcontractors inside the compliance boundary
What We Learned
A tool is not a program, and the market is full of quotes that blur the two.
EDR and SIEM are real controls and they do real work, but they answer a fraction of the assessment objectives in NIST SP 800-171. No product satisfies the policy, process, evidence, SSP and POA&M obligations that make up the rest of it. When a prospect says they already have a CMMC solution, the useful next question is which controls and objectives it actually covers, and the answer is usually a short list.
Having on-site IT is not the same as having security operations.
The difference stays invisible until someone asks for evidence. An operations team is measured on uptime; NIST SP 800-171 is measured on records: who accessed what, when, and whether anyone reviewed it. Shops with IT staff are often the most confident that they are covered, and the most surprised by the gap.
Licensing is not a one-time decision, and the savings that matter most may not exist yet.
The tiers that halved this client’s Microsoft spend were released after the engagement was already running. Nobody could have quoted that discount at signing, and nobody would have found it by checking once and moving on. Compliance is almost always sold as fixed cost stacked on top of what a shop already pays, and it is worth more when it occasionally hands budget back.
About This Case Study
About this document. TRANUSA Case Study TUSA-CASE-001, version 1.1, issued 12 September 2026 by TRANUSA, LLC, Buford, Georgia. Public; may be forwarded freely.
Basis. TRANUSA engagement records and the client’s own account of the engagement, reviewed with the client before publication. Client identity, location and exact figures are withheld under the engagement agreement.
Limitations. This describes one engagement and is not a prediction of results for any other organization. TRANUSA is not a C3PAO and cannot issue a CMMC certification. “Compliant and certification ready” and “certified by a C3PAO” are different claims and are distinguished above. Current as of the issue date.
Book a CMMC Readiness Call
Thirty minutes. We review your contract requirements, identify your top compliance gaps, and give you a realistic timeline to audit readiness. No pitch decks, no obligation.
Book Your Call →