CMMC · Northern Virginia
CMMC Level 2 compliance for Northern Virginia contractors
A services and IT contracting economy where the technology is rarely the obstacle — the scoping is, because here CUI lives in documents and inboxes rather than on a shop floor.
What the Northern Virginia supplier base looks like
Consultancies, systems integrators, software and analytics firms, and professional-services contractors — typically knowledge businesses with laptops and cloud tenants rather than production equipment.
The programmes and commands that shape it:
- The Pentagon and the concentration of defense agencies around it
- A dense professional-services, IT and systems-integration contracting sector
- Substantial intelligence-community-adjacent contracting
We work with contractors in this region remotely, from South Florida. We do not have an office here, and we would rather say so on the page than have you find out on the call — almost all of this work is delivered remotely regardless of where the provider sits.
Scoping people is harder than scoping machines
Contractors here usually arrive in reasonable technical shape. The environment is often already Microsoft 365, the workforce is mobile, and there is no legacy machinery holding anything back. It is tempting to conclude the work will be small.
The difficulty is different in kind. When CUI arrives as documents, briefings, spreadsheets and email attachments, it spreads the way documents spread — into personal OneDrive folders, into Teams channels created for one project, into an inbox belonging to somebody who has since moved to a different contract. Establishing a boundary around that is a question about how people work, and people are harder to fence than machines.
The other complication is common here and rare elsewhere: staff working across several contracts with different obligations, sometimes at client sites, sometimes on client-owned systems. Working out whose environment is in scope is a real exercise, and it is not answerable from an architecture diagram alone.
What the engagement involves
The same work wherever you are, in the same order — what changes by region is which part turns out to be the hard one.
- Establishing scope first. How much of your business sits inside the boundary moves the cost more than everything else combined.
- Assessing against all 110 requirements of NIST SP 800-171, producing a System Security Plan and a POA&M.
- Closing the gaps, most of which are configuration rather than purchase.
- Getting the environment right — which for some contractors means Microsoft 365 GCC High and for others does not.
- Keeping it true. The affirmation is annual and the environment keeps changing, so this is operational rather than a project that ends.
Related: whether Level 1 is all you need, what this costs and why we scope before quoting, and which controls stay yours.
Questions from Northern Virginia contractors
Our staff work on client systems. Whose CMMC obligation is that?
It depends on where the controlled information is processed and stored, and the answer is regularly split. Work performed entirely inside a client's own environment, on their systems, typically sits within their boundary. The moment anything is copied into your tenant, downloaded to your laptop or discussed in your email, it is in yours. That distinction is worth settling in writing with the prime rather than assumed, because both parties often assume the other holds it.
We are already fully cloud. Is this mostly done?
Being cloud-first genuinely helps, and a well-configured Microsoft 365 tenant addresses a meaningful share of the 110 requirements before anyone starts. What it does not do is answer scoping. The most common finding in a services business is not a missing control, it is controlled information in more places than anyone expected — which is a governance problem rather than a technical one, and no amount of configuration fixes it retrospectively.
Other defense industrial base regions
-
Huntsville, Alabama
Missile, aviation and space programmes, and the densest concentration of export-controlled technical data in the country. The region where GCC High is most often genuinely required rather than defensively bought.
-
San Diego, California
Naval shipbuilding, repair and maritime systems — a supplier base heavy on fabricators and machine shops, where the hardest CMMC problem is usually equipment that cannot meet the requirements.
-
Dayton, Ohio
Air Force research and sustainment, with a supplier base spanning aerospace engineering and university research — where the boundary question is complicated by collaboration.
-
Colorado Springs, Colorado
Space and missile-warning systems, with a supplier base skewing toward newer and smaller technology businesses meeting CMMC for the first time.
Start with a real assessment
We offer a free CMMC gap assessment for qualifying contractors — where you stand against all 110 requirements, and what your scope would actually be.
Schedule a call