Case Study: Local Tool Company Navigates CMMC Compliance Process
CMMC Compliance Process
Doing business with the U.S. Federal Government has always required diligence, but with the rise of cybercrime in recent years, new cybersecurity requirements have introduced new challenges for vendors pursuing federal contracts. In particular, the Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) has introduced an extensive array of requirements that vendors must adopt just to be allowed to bid on defense projects. Up against this exact challenge, a returning TechSolve client, Able Tool Corporation, contacted TechSolve in late 2023 to help them navigate the CMMC compliance process.
Challenge
During the initial discovery discussion, team members at Able Tool, a women-owned business specializing in high-precision machining services for a diverse range of industries. explained that they were facing three separate challenges simultaneously:
- Multiple business entities: Able Tool is a premiere machine shop known for its precision machining, milling, turning and 3D printing services. In 2021, Able Tool acquired Planet Products Corporation, a manufacturing company that sells machined parts to a wide variety of OEMs. As the companies merged managerial structures, it was determined that not just one but both companies needed to obtain CMMC Level 2 compliance.
- Time-sensitive market demands: As active suppliers to defense contractors and OEMs, Able Tool and Planet Products were faced with a hard deadline to obtain CMMC compliance by 2025 in order to retain DoD contracts and solicit new contracts.
- Technical complexity: Able Tool desired to reach CMMC Level 2 compliance, which asserts that they must meet or exceed 110 individual technical requirements and apply for rigorous third-party verification. Meeting these goals would require extensive technical expertise in cybersecurity and the CMMC documentation process.
Client Feedback
“For companies that need to tackle CMMC and are not intimately familiar with what that will take, your best bet is to work with a consultant to save time and avoid issues. TechSolve made the whole process so seamless and took all the time in the world to walk us through the details. Without TechSolve, there is no way we would make it through the third-party audit and are so thankful for their help.”
Nina Bullock
Joint Project/Office Manager
Able Tool and Planet Products Corporations
Solution
While every project is unique, TechSolve has developed a standardized approach to CMMC projects that helps us structure and map the road ahead with our clients. With this methodology in hand, we started work following these steps:
- Project proposal, budget and schedule: We find that the most responsible starting point for technology enhancement projects is to establish a preliminary budget and schedule right away. With this documentation, Able had full visibility of what was to come.
- Initial gap analysis: Once engaged, we performed a multi-pronged initial gap assessment that covered both Able and Planet’s physical properties, digital information ecosystem, upstream and downstream vendor workflows, and workforce preparedness.
- Quantifiable control metrics: While the CMMC framework lays out very specific security controls, it leaves most quantifiable metrics up to the applicable organization. For this reason, we next canvassed Able’s leadership team, their customers, and their vendors to quantify applicable hard metrics.
- Supplier Performance Risk System (SPRS) score: the DoD’s SPRS platform is an online vendor management portal that assigns each vendor a score based on their overall performance (which includes cybersecurity). We pulled both companies’ scores to see how they ranked.
- Plan of action and milestones (PoAM): This type of strategic plan puts the above findings into prioritized perspective. For Able and Planet, our PoAM specifically targeted actions that would protect their ability to bid and carry contracts with DoD buyers while we worked toward full CMMC completion.
- Ongoing technical consulting: At this point, all tasks were assigned and in motion toward completing the CMMC process, which spun up different workflows all running concurrently. TechSolve provided ongoing consulting, guidance, best practices, and documentation review through this execution phase, tracking all activity to the PoAM, budget, and schedule accordingly.
- External facilitation: Throughout the entire engagement, we supported Able Tool’s project manager by facilitating outside parties where our expertise could help reach faster conclusions. For example, TechSolve directly interfaced with Able’s outside IT resources, domain provider, contractors, and third-party auditors (including the final Certified 3rd Party Assessor Organization or C3PAO), taking that load off Able’s project manager and leadership team.
By combining these steps into a cohesive, client-focused process, TechSolve positioned Able Tool and Planet Products for success, ensuring they’re fully prepared for their upcoming certification audit and poised to capture new opportunities in the defense market.
Results That Matter
At the time of this writing, Able Tool and Planet Products have both completed all the necessary preparations for obtaining their CMMC Level 2 Certification. We’ve helped schedule their C3PAO assessment for Q1 2025, and will continue to support their preparation.
Even better, Able and Planet have both surpassed their key customers’ minimum vendor scoring to ensure that they’ll receive both extended and new contracts in 2025 ahead of final certification. All in all, this project has been a perfect showcase of how TechSolve helps manufacturers reach their operational goals, and we send our whole-hearted thanks to Able and Planet for letting us tell the story here.
Key Impact Metrics
- 500 Able/Planet staff hours saved using TechSolve’s services
- 1-year CMMC audit and certification timeline
- $20 million in potential new Able/Planet sales after CMMC certification is complete
About TechSolve
As a mission-driven nonprofit company, TechSolve helps Ohio manufacturers meet the technical and operational imperatives of tomorrow. Our Cincinnati-based team of manufacturing executives, engineers, and subject matter experts serves clients with professional consulting services, including operational planning, cybersecurity compliance, process improvement, and workforce development.
TechSolve is an official partner of Ohio’s Manufacturing Extension Partnership (MEP), a state and federal initiative sponsored by the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST). We’re committed to guiding manufacturers through challenges like CMMC compliance with confidence and care. To learn how we can support your business, please visit our website, call us at (513) 948-2000, or email us at info@techsolve.org.