STRANTECH has earned CMMC Level 2 certification with a score of 110, the culmination of a years-long effort that exposed gaps in its controls, documentation and disaster recovery planning.
The certification is significant for a business that derives about 90% of its revenue from federal contracts and works mainly for the Department of Defence. A requirement for CMMC in defence solicitations could have affected its ability to compete if it had not completed the process in time.
Michael Cuccia, Chief Operating Officer at STRANTECH, said the certification effort was more complex than a technical upgrade. The company, previously known as AllCom Global Services, began work on CMMC about five years before completing the assessment, but progress was uneven in the early stages.
"If every DoD contract had started requiring a certain level of CMMC before we completed the work, it could have put us at a real disadvantage," Cuccia said.
STRANTECH works on telecommunications, electrical, backup power and precision cooling systems in data centres and other secure facilities. Its project records include site surveys, drawings and system designs, which it treats as sensitive information tied to customer operations.
Early setbacks
At first, the business treated CMMC as a limited IT task rather than a company-wide compliance programme. Cuccia said that approach slowed the work and left it without the structure needed for a formal third-party review.
"We were trying to handle it as a part-time IT project," Cuccia said. "I could see we were not going to be ready at that pace."
It also bought software tools to address individual requirements and later hired an outside provider that did not offer a clear path to assessment readiness. That effort did not resolve broader issues around formal policies, internal procedures and evidence collection.
"They seemed to have more questions than answers," Cuccia said.
An internal self-assessment later showed that substantial work remained. Firewalls, backup systems and intrusion detection all needed attention. Written documentation and disaster recovery planning also required further development.
"The documentation piece was a big lift," Cuccia said. "We needed a lot of help with formal documentation, and we did not have a solid disaster recovery plan."
The task extended beyond putting tools in place. To meet Level 2 requirements, the contractor had to define how each control would operate, assign ownership, train staff and keep records that could show an assessor the controls were functioning as intended.
New approach
The effort shifted after senior leadership made CMMC a business-wide priority and brought in a different Registered Provider Organisation. STRANTECH selected SSE, a cybersecurity and compliance firm that had already completed its own CMMC process.
Cuccia said the new provider reviewed the company's network architecture, policies and procedures, then carried out a formal gap assessment. The work was organised requirement by requirement, with specific assignments and evidence expectations tied to each control.
"We found SSE, which is a defense contractor like us. They had gone through CMMC and earned a perfect score on their assessment," Cuccia said. "They gave us a clear roadmap to prepare for ours."
That structure helped the company move from broad preparation to assessment readiness. After much of the technical and policy work was complete, SSE ran a mock assessment so staff could test their ability to present documents and demonstrate control operation under conditions similar to the formal review.
Cuccia said he had seen differing views on whether such rehearsals were worth the cost, but concluded that the exercise helped reduce uncertainty before the certified third-party assessment.
"It was almost like a rehearsal for what was going to happen in the real thing," Cuccia said. "That was money well spent."
Behaviour changes
The process also changed day-to-day staff behaviour around controlled unclassified information, or CUI. Employees now take a more cautious approach to files and attachments from government customers, especially when information markings are inconsistent.
Staff now pause when they receive questionable material, contact IT and move the information into an approved secure environment before opening or reviewing it. Cuccia said that habit has also influenced broader email practices, including closer scrutiny of unfamiliar links and attachments.
"I know where we came from and where we are now," Cuccia said. "We are 180 degrees in a better direction than we were two years ago."
Wider lesson
The company's experience points to a wider issue for smaller defence contractors preparing for CMMC. Even when firms start years in advance, they may still fall short if they rely on piecemeal tool purchases, fail to document procedures properly or cannot show independent evidence that controls are operating.
That challenge carries extra weight in a defence industrial base where many suppliers are small businesses with limited internal compliance resources. STRANTECH's account suggests the burden lies not only in securing systems, but in demonstrating through policy, process and records that those protections are embedded across the organisation.
Cuccia said the main value of the exercise was not limited to passing an assessment. "I hope the DoD keeps CMMC in place, and I believe it will," he said. "We were a secure company when we started, but the process pushed us to tighten compliance, document what we were doing and prove the protections worked. That level of discipline and accountability is what the defense supply chain needs now more than ever."