They already had a program. The question was whether to trust it.
A manufacturer in the defense industrial base — 150–500 employees, carrying NIST SP 800-171, DFARS 252.204-7012, and a CMMC Level 2 obligation — had already been through one fractional CISO. Leadership wanted an independent read on the decisions that engagement had left behind, and an honest answer to a harder question: was the program actually in place adequate for a Level 2 assessment?
This is the first record on our representative experience page, told as a narrative. Same anonymization rules: no client name, no geography, no calendar dates; every number below is real and substantiable in conversation under NDA.
An inherited program is a set of unexamined decisions.
Taking over security leadership after someone else is different from starting fresh. The predecessor’s choices are already budgeted, already contracted, already habits. Some are right. The expensive question is which ones — because a wrong inherited decision doesn’t look wrong; it looks like the plan.
We took the security leadership seat under an initial twelve-month term and reviewed the entire program — digital and physical — against what the company’s contracts actually require: the 110 requirements of NIST SP 800-171 Revision 2, the DFARS clauses that flow them down, and the Level 2 assessment the business was heading toward.
What the review changed.
Five decisions carried the engagement. The first one paid for all of it.
01A $350,000 program, stopped before implementation
A physical monitoring program carrying roughly $350,000 in annual cost had been specified and budgeted before we arrived. Reviewed against the actual requirements and the actual risk, it did not justify itself — and stopping a budgeted program takes more evidence than never proposing it. It was stopped before implementation. Killing a funded initiative is the least popular deliverable a security leader can produce, and one of the most valuable.
02The managed security provider, reassessed
The MSSP relationship had been assumed rather than examined: what the provider actually covered, what it could evidence, and what the contract held it to. The reassessment led to a provider transition — and a further reduction of about $20,000 per year that has remained in place since the transition completed.
03Scoping decided deliberately, including what to leave out
Every system was placed inside or outside the assessment boundary on recorded reasoning — including deliberate de-scopes. A boundary that grows by accident is the most common way a Level 2 effort becomes a whole-company project with a whole-company price.
04Two remediation plans, kept honestly separate
Eligible CMMC POA&M items were scheduled for closeout within the 180 days the program’s rules allow, with a separate security-program roadmap extending through 365 days. Blending those two plans is how contractors accidentally represent long-term improvement work as open assessment findings — we kept them distinct on paper because they are distinct in the rules.
05The assessment package, rebuilt to survive an assessor
System Security Plan describing the environment actually run. Risk register. Policy revisions matched to practice. The control set rebuilt where the gap analysis demanded it — specified by us, implemented by the client’s team and providers.
Net-neutral against the budget. Certified against the standard.
The stopped monitoring program and the vendor and program rationalization together covered the cost of the engagement itself, leaving it net-neutral against a security budget of roughly $1.2M — before counting the continuing $20,000-a-year reduction. The engagement has renewed annually since its initial term.
And the result that matters most: the organization subsequently completed a CMMC Level 2 certification assessment conducted by an accredited third-party assessment organization. The assessment was theirs, not ours — readiness work is deliberately separate from certification so the assessor stays independent. What we built was the program and the evidence that the assessment was conducted against.
Where our role stopped.
We did not select final products — every recommendation was an analysis and an opinion on fit, and the purchasing decision stayed with the client. We did not conduct the certification assessment, and we are not a C3PAO. We did not implement controls; we specified them, and the client’s team and providers performed the work. Those lines are why the numbers above can be published: the person who recommended stopping a $350,000 program had nothing to sell in its place.
Inheriting a program you’re not sure you trust?
This engagement ran as fractional CISO work with CMMC readiness inside it. Thirty minutes establishes whether the shape fits.