Representative scenario — a composite of common engagements, not a specific client.
A mid-sized defense manufacturer came to us convinced CMMC was going to be ruinously expensive. They were not wrong about the price of their current plan — they were wrong about the plan. CUI had spread into nearly every system they owned, and they were preparing to protect and assess all of it.
The challenge
When CUI touches everything, everything is in scope — every laptop, every share, every application is dragged into the 110 requirements and has to be evidenced and maintained for the life of the program. The cost is not the assessment; it is carrying an oversized boundary forever.
What we did
We treated scoping as the main event. We mapped every place CUI actually lived, then redesigned workflows so it stopped landing where it did not need to be. A defined enclave took the majority of their systems out of scope entirely. What remained was a smaller, well-understood boundary we could protect properly.
The outcome
Their in-scope system count dropped by roughly half, and with it the number of controls they had to implement, evidence, and sustain. The program went from ‘ruinous’ to ‘manageable’ — not with a discount, but with a smaller boundary. The cheapest control is the one you scoped out.