Case 00: inDirectIT itself
We ran the method on ourselves before we sold it. Our SSP, POA&M, evidence package, and GCC High tenant were assessed under CMMC Level 2 (32 CFR Part 170), the same way yours will be. The certified environment is the one this firm works in every day, and we keep it current under our own managed-compliance discipline.
Read Case 00 in full: what we assessed and how it shapes your engagement
Case 01: Allyon, CMMC Level 2, June 2026
Allyon ran the full Factory sequence, from gap assessment and boundary definition through SSP and POA&M development, evidence collection, and mock-assessment preparation, to its own CMMC Level 2 certification in June 2026. People across the company worked on it, using the same runbook we ran on ourselves, and the assessment closed at 110/110.
"Achieving CMMC Level 2 certification was a cross-functional, company-wide effort that required disciplined execution across every control. inDirect IT was an outstanding partner throughout the entire journey — from gap assessment and boundary definition through SSP/POA&M development, evidence collection, and mock assessment preparation. Their practitioner-led approach, deep Microsoft GCC High and Azure Government expertise, and commitment to objective-level evidence made the difference. We couldn't have hit 110/110 with the same confidence without them. Highly recommend inDirect IT to any defense contractor serious about building a defensible, operational compliance program."
Read Case 01 in full: the four stations, one at a time
What made the difference
- The boundary came before the budget. Scope was defined and verified at Station 01, so remediation money went only to systems that belonged in the assessment.
- The SSP was written against the live configuration, which is why it held up under assessor testing.
- Evidence was organized by assessment objective, the way a C3PAO tests it.
- The mock assessment worked as a gate. Findings were raised and closed internally before the certification window, so assessment week held no surprises.
Your company could be Case 02. We run the same runbook on your environment. Start with a gap assessment or a strategy call.
Put a certification on this page.
Tell us where your program stands and a practitioner will map the path from there to a defensible certification. You can also email rj@indirectit.com directly.