Not sure which fits? Tell us about your business and we’ll talk it through.CMMC readiness · South Florida
CMMC readiness for South Florida defense suppliers
For aerospace, machining, manufacturing and engineering suppliers in Fort Lauderdale, Miami, Boca Raton and Palm Beach that need CMMC Level 1 or Level 2. Retrisa scopes the work, closes the gaps and prepares you for assessment.
South Florida’s defense supply chain
A lot of South Florida’s defense work is carried by smaller companies: aircraft maintenance, repair and overhaul shops around the region’s airports, precision machine shops, electronics and component manufacturers, and engineering firms across Broward, Miami-Dade and Palm Beach counties. Many are subcontractors a tier or two below a prime, and CMMC reaches them through flow-down clauses in the purchase orders and subcontracts they already hold.
Shops like these often have a mix that makes CMMC harder than it looks: an office on Microsoft 365, shared logins on the shop floor, CNC or inspection machines running older versions of Windows, and drawings that arrive by email from a customer. None of that is unusual, and none of it rules you out. The work is finding where FCI and CUI actually go, keeping that scope as small as possible, and making the systems inside it provably secure. Our aerospace and defense suppliers page covers the day-to-day IT side.
How Retrisa helps
Step 1: Scoping
Find where FCI and CUI actually live, and keep the scope as small as the work allows.
Step 2: Remediation
Close the gaps in Microsoft 365, devices and access: MFA, encryption, logging, backups and access control.
Step 3: Assessment preparation
Write the System Security Plan and supporting policies, and collect the evidence an assessor will ask to see.
Readiness is a quoted project. Keeping controls and evidence current every month afterwards is the Managed Compliance plan. Suppliers holding CUI or ITAR technical data may also need a Microsoft 365 GCC High migration, which we recommend only after scoping.
A South Florida detail: backups and storms
Atlantic hurricane season runs from June 1 to November 30, so recovery plans here have to assume the office and the shop floor may be closed for a while. NIST SP 800-171 also expects backup copies of CUI to be protected wherever they are stored. We plan the two together, so the copy you would recover from after a storm does not become a gap in your assessment.
Why this page has no dates
The Department of Defense’s CMMC rollout schedule has changed more than once, so we do not publish program dates or phases here. What sets your level and your timing is the solicitation or contract in front of you, and the flow-down from your prime. If a bid or purchase order mentions CMMC, request a quote and we will go through what it means for your scope on a short call.
Where we work
On-site visits suit scoping walkthroughs of the office and shop floor, and work on shop-floor computers and networks. Documentation, Microsoft 365 configuration and evidence collection are done remotely.
- Fort Lauderdale and Broward CountyOn-site by arrangement
- MiamiOn-site by arrangement
- Boca RatonOn-site by arrangement
- Elsewhere in Palm Beach CountyRemote, as anywhere in the United States
Retrisa is not a C3PAO and does not issue CMMC certifications. We prepare your environment and your documentation; formal Level 2 certification assessments are carried out by an authorized C3PAO. This page is general information, not legal advice: your contract and contracting officer set your requirements.
Start with a short scoping call
Tell us your company, the level you think applies and any deadline you are working to. You receive a written quote for the readiness project after the call.
Request a CMMC Quote