Why a production line beats a project
Compliance consulting tends to fail in two familiar ways. Big firms bill discovery by the hour, reinvent the approach for each client, and staff delivery through the pyramid. Generic MSPs retrofit commercial tooling to a federal problem and let a policy binder stand in for implementation. Either way, you pay again at assessment time.
The Factory is a fixed sequence with fixed quality gates, run by the practitioners who scoped, built, and defended inDirectIT's own CMMC Level 2 environment under 32 CFR Part 170. We put your environment through it and deliver what your contracts require: a C3PAO-ready CMMC package, an agency authorization package, or an assessment-ready 800-171 program. The method already exists, so you don't pay us to invent it.
The four stations
Scope & Assess
Define the CUI boundary, map data flows, and score all 110 controls against the DoD Assessment Methodology. We fix the boundary before setting a budget, because scope is where certifications are won or lost. Discovery finds the defensible boundary, which depends on your data flows and security dependencies.
Architect
Design the target state across all six Microsoft security planes, in GCC High or an enclave: Entra ID, Intune baselines, Purview CUI labeling and DLP, Defender, WDAC, audit and logging.
Implement & Document
Deploy and harden while the SSP, policies, and POA&M are written against the live configuration. We write the documentation from the running environment, so it describes what is deployed.
Evidence & Sustain
Collect evidence at the assessment-objective level, run a mock assessment as the release gate, then operate under managed compliance so the certification still holds in year two.
One production line serves several assurance lanes.
The stations stay the same and the destination changes. We aim each run of the line at the verification mechanism your customer uses:
| Common production line | Customer-specific outcome |
|---|---|
| SCOPE CUI & SYSTEM BOUNDARIES | DoD, GSA, NASA, DOE, DOJ/FBI contract scope |
| ARCHITECT & IMPLEMENT CONTROLS | Rev. 2, Rev. 3, agency ODPs and overlays |
| DEVELOP SSP & EVIDENCE | Agency authorization or assessment package |
| VALIDATE VIA ASSESSMENT PROCEDURES | CMMC, 800-171A, government or independent assessment |
| SUSTAIN CONTINUOUSLY | Evidence refresh, control validation, POA&M and risk management |
The quality system behind it
- Every engagement runs the same production line we ran on ourselves, with a fixed sequence, tooling, and templates.
- We collect artifacts for each assessment objective, the unit a C3PAO tests, instead of filing them under control titles.
- Nothing goes to a C3PAO until it passes our internal mock assessment. That gate is how we control quality.
- After certification we keep operating the environment. Evidence refresh and control validation run continuously under managed compliance.
Tested on us first, then on a client
inDirectIT's own SSP, POA&M, evidence package, and GCC High tenant were assessed under CMMC Level 2 (32 CFR Part 170), with objective-level evidence for the assessed boundary. In June 2026, Allyon ran the same production line to its own CMMC Level 2 certification. CMMC proved the delivery model, and we apply it across the larger NIST 800-171 and federal CUI market we serve.
How this compares
Most contractors weigh this decision against two alternatives. Both of them cost you twice: once during the engagement and again at assessment time.
| Dimension | Big Consultancies | Generic MSPs | inDirectIT |
|---|---|---|---|
| WHO DELIVERS | Pyramid staffing: partners sell, juniors deliver | Whoever is on the help desk this quarter | The practitioners who scoped, built, and defended our own CMMC Level 2 environment |
| METHOD | Discovery billed by the hour, approach reinvented per client | Commercial-tenant tooling retrofitted to a federal problem | Fixed Factory runbook, GCC High native, with the same sequence on every engagement |
| DOCUMENTATION | Template SSPs written before the environment exists | Policy PDFs on a shelf, untested against objectives | SSP written from live configuration; evidence collected at the assessment-objective level |
| PROOF | References and slideware | Vendor badges | CMMC Level 2 (32 CFR Part 170), held, operated, and renewed in our own tenant |
| ECONOMICS | Open-ended meter; change orders compound | Flat fee, thin scope; gaps surface at assessment | Fixed-scope phases with a mock-assessment gate, then managed sustainment |
Portfolio mode
Running a portfolio? For private-equity firms with defense-exposed holdings, we run the same production line across the portfolio with one runbook, one evidence standard, and one reporting view, so five portfolio companies don't each buy a different compliance program. Book a portfolio briefing →
Questions about the model
Why call it a 'factory'? Compliance isn't manufacturing.
The common failure in compliance consulting is treating every engagement as a bespoke project, so the firm rediscovers, redesigns, and relearns on your budget. A production line keeps the sequence, tooling, and quality gates fixed and changes only the environment going through it. Because the process is fixed, the certification result can be repeated.
Is the Factory only for CMMC?
No. We proved the model on CMMC, first on our own environment and then on Allyon's certification, but the production line builds and operates NIST SP 800-171 environments in general. The final station changes with the customer: a CMMC assessment (self or C3PAO) for DoD work, an authorization package for GSA, or agreement-specific demonstrations for NASA or DOE. See agency lanes.
How long does the Factory take end to end?
Once scope is defined, the technical baseline is a 12 to 14 week build, because the playbook, templates, and evidence structures already exist. Station 01 (scope and assess) comes first and typically runs 4 to 6 weeks as a fixed-scope engagement. Sustainment then runs continuously.
What is 'objective-level evidence' and why does it matter?
Each of the 110 controls breaks down into assessment objectives, roughly 320 across the framework, and a C3PAO tests at that level. An assessor can use evidence collected per objective as it stands. If your evidence is organized by policy binder instead, the assessor will have you redo it.
What happens if we fail the mock assessment?
Then the gate did its job. Findings from the internal mock assessment go back into remediation before anything goes to a C3PAO, so the surprises happen on our clock instead of during your certification window.
Put your environment on the production line.
Tell us where you are and a practitioner will map your entry station, timeline, and fixed scope. You can also email rj@indirectit.com directly.