CMMC · Dayton, Ohio
CMMC Level 2 compliance for Dayton contractors
Wright-Patterson anchors a supplier base that mixes aerospace engineering with research collaboration, which makes the CUI boundary harder to draw than the technology suggests.
What the Dayton supplier base looks like
Aerospace engineering firms, sustainment and modification contractors, research organisations, and small technology businesses working alongside university and laboratory programmes.
The programmes and commands that shape it:
- Wright-Patterson Air Force Base, host to Air Force Materiel Command
- The Air Force Research Laboratory
- Aerospace sustainment and life-cycle engineering activity
We work with contractors in this region remotely, from South Florida. We do not have an office here, and we would rather say so on the page than have you find out on the call — almost all of this work is delivered remotely regardless of where the provider sits.
Research collaboration makes the boundary porous
The distinguishing feature of this region is not the technology, it is who else is in the room. Research and sustainment work draws in university partners, laboratory collaborators, subcontracted specialists and academic staff — and collaboration is the natural enemy of a controlled boundary.
The awkward cases are consistent: a graduate researcher who is not a US person, a shared drive set up for a joint programme, a conference paper drawing on work that turned out to be controlled. None of that is negligence. It is what research looks like, and it sits badly with requirements written on the assumption that information stays inside one organisation.
So the work here starts earlier than usual. Before any control is configured, somebody has to decide which collaborations can continue as they are, which need to move inside the boundary, and which cannot involve controlled information at all. That is a business decision with real consequences, and it is not one a technology provider should be making on your behalf.
What the engagement involves
The same work wherever you are, in the same order — what changes by region is which part turns out to be the hard one.
- Establishing scope first. How much of your business sits inside the boundary moves the cost more than everything else combined.
- Assessing against all 110 requirements of NIST SP 800-171, producing a System Security Plan and a POA&M.
- Closing the gaps, most of which are configuration rather than purchase.
- Getting the environment right — which for some contractors means Microsoft 365 GCC High and for others does not.
- Keeping it true. The affirmation is annual and the environment keeps changing, so this is operational rather than a project that ends.
Related: whether Level 1 is all you need, what this costs and why we scope before quoting, and which controls stay yours.
Questions from Dayton contractors
We collaborate with a university. Does that break our compliance?
Not by itself, but it does need designing rather than discovering. The questions that matter are what information the collaboration touches, whether any of it is controlled, and who has access — including researchers who may not be US persons, which becomes decisive if anything is export-controlled. It is far cheaper to establish this at the start of a programme than to unpick it after controlled data has already been shared.
Does fundamental research count as CUI?
Often not, and the distinction matters a great deal. Work genuinely conducted as fundamental research with the results intended for publication sits in a different category from controlled technical data. The trouble is that a single programme can contain both, and the boundary between them is a contractual question rather than a technical one. Read what the award actually says, and if it is unclear, ask the contracting officer in writing and keep the answer.
Other defense industrial base regions
-
Huntsville, Alabama
Missile, aviation and space programmes, and the densest concentration of export-controlled technical data in the country. The region where GCC High is most often genuinely required rather than defensively bought.
-
San Diego, California
Naval shipbuilding, repair and maritime systems — a supplier base heavy on fabricators and machine shops, where the hardest CMMC problem is usually equipment that cannot meet the requirements.
-
Northern Virginia
Services, IT and professional-services contractors clustered around the Pentagon. Usually already cloud-first, which makes scoping a question about people and documents rather than machinery.
-
Colorado Springs, Colorado
Space and missile-warning systems, with a supplier base skewing toward newer and smaller technology businesses meeting CMMC for the first time.
Start with a real assessment
We offer a free CMMC gap assessment for qualifying contractors — where you stand against all 110 requirements, and what your scope would actually be.
Schedule a call