Not sure which fits? Tell us about your business and we’ll talk it through.
CMMC readiness for defense suppliers
For aerospace, machining, manufacturing and other defense suppliers that need CMMC Level 1 or Level 2. Retrisa scopes the work, closes the gaps and prepares you for assessment.
Who it’s for
Aerospace maintenance and repair shops, precision machine shops, manufacturers and engineering firms that work on Department of Defense contracts or subcontracts.
Most of these businesses already run on Microsoft 365 and a handful of computers. That is a good starting point: the work is making it provably secure, and keeping it that way.
If you handle FCI
Level 1
The 15 basic safeguards in FAR 52.204-21, confirmed by a yearly self-assessment. We get them in place and documented so a senior official can affirm them with confidence.
If you handle CUI
Level 2
The 110 requirements of NIST SP 800-171, self-assessed or assessed by a C3PAO as your contract states. We close the gaps and prepare the documentation and evidence an assessor will ask for.
Why FCI, CUI and ITAR matter
- FCI
- Non-public contract information. Almost every DoD contractor holds it, and it sets the Level 1 baseline.
- CUI
- Information the government requires you to protect, such as marked drawings and specifications. It brings Level 2.
- ITAR
- Export controls on defense technical data. Not part of CMMC, but it limits who can access the data and where it can be stored.
Retrisa’s role
Step 1: Scoping
Find where FCI and CUI actually live, and keep the scope as small as the work allows.
Step 2: Remediation
Close the gaps in Microsoft 365, devices and access: MFA, encryption, logging, backups and access control.
Step 3: Assessment preparation
Write the System Security Plan and supporting policies, and collect the evidence an assessor will ask to see.
Retrisa is not a C3PAO and does not issue CMMC certifications. We prepare your environment and your documentation; formal Level 2 certification assessments are carried out by an authorized C3PAO. This page is general information, not legal advice: your contract and contracting officer set your requirements.
Request a CMMC Quote
CMMC work depends on how many people and devices are in scope, where your data lives today and the level your contracts require, so it is quoted rather than listed. After a short scoping call you receive a written quote for the readiness project, and for keeping it current on the Managed Compliance plan if you want us to.
Rather email? sales@retrisa.com