The engagement
Allyon ran the full Factory sequence to its own CMMC Level 2 certification in June 2026 and finished at 110/110. Teams across the company took part, working from the same runbook we used for our own certification.
How the production line ran
The sequence is fixed: the same order of operations, and the same standard each station has to clear before the next one starts. Only the environment going into it changes from one engagement to the next.
Scope & Assess
The CUI boundary was defined and data flows mapped before any remediation money moved. All 110 controls were scored against the DoD Assessment Methodology, which produced the gap register that drove everything downstream.
Architect
The target state was designed across the Microsoft security planes: GCC High and Azure Government, Entra ID Conditional Access, Intune baselines, Purview CUI labeling and DLP, Defender, and WDAC.
Implement & Document
Deployment and hardening ran while the SSP, policies, and POA&M were written against the live configuration. The documents described the environment as it existed, which is why they held up when assessors tested them.
Evidence & Sustain
Evidence was collected at the assessment-objective level, which is how a C3PAO tests. A mock assessment was the release gate before the certification window opened.
In the client’s words
"Achieving CMMC Level 2 certification was a cross-functional, company-wide effort that required disciplined execution across every control. inDirect IT was an outstanding partner throughout the entire journey — from gap assessment and boundary definition through SSP/POA&M development, evidence collection, and mock assessment preparation. Their practitioner-led approach, deep Microsoft GCC High and Azure Government expertise, and commitment to objective-level evidence made the difference. We couldn't have hit 110/110 with the same confidence without them. Highly recommend inDirect IT to any defense contractor serious about building a defensible, operational compliance program."
What made the difference
- Scope was defined and verified at Station 01, so remediation money went only to systems that belonged in the assessment.
- The SSP was written against the real configuration, which is why it held up under assessor testing.
- Evidence artifacts were organized by assessment objective, the way a C3PAO tests.
- The mock assessment surfaced findings that were closed internally before the certification window, so assessment week held no surprises.
- The practitioners who scoped the work also built it and defended it, with no hand-off to a bench.
Your name could be Case 02. The runbook stays the same, and your environment is the input. Start with a gap assessment or a strategy call.
Put a certification on this page.
Tell us where your program stands and a practitioner will map the path from your current state to a defensible certification. Or email rj@indirectit.com directly.