Data Systems Analysts Inc. (DSA) is a Department of Defense (DoD) contractor with a uniquely structured workforce, where approximately 75% of employees operate at client locations. As a result, only a limited subset of staff required access to environments processing Controlled Unclassified Information (CUI).
This operating model created both an opportunity and a challenge:
DSA needed to achieve CMMC Level 2 compliance without over-scoping systems, users, or driving unnecessary costs in secure environments.
The Challenge
CMMC compliance is complex for any organization, but particularly difficult for small and mid-sized defense contractors with:
- Limited internal IT and compliance resources
- The cost impact of GCC High licensing and setup
- Evolving regulatory guidance and auditor expectations
- A shift from self-attestation to mandatory third-party audits
DSA faced several key hurdles:
- Defining the minimum viable compliance scope to meet requirements without over-engineering systems or expanding scope unnecessarily
- Aligning policy documentation with technical implementation
- Supporting a novel technical architecture unfamiliar to auditors
- Preparing for an audit environment transitioning from self-attestation to mandatory third-party assessments
The Solution
Hartman partnered with DSA leadership to guide the organization through compliance in a practical, cost-conscious, and audit-ready manner.
Hartman served as an advisory and implementation partner, supporting readiness, documentation, and technical alignment, while DSA engaged an independent Certified 3rd Party Assessor Organization (C3PAO) for for assessment.
Early Preparation & Pre-Assessment
Before formal assessment, DSA:
- Procured Microsoft GCC High licenses
- Engaged an external auditor for a pre-assessment
- Began assembling required CMMC documentation
Hartman supported DSA by:
- Clarifying how CMMC Level 2 controls applied to DSA’s environment
- Translating CMMC requirements into actionable documentation
- Guiding technical implementation to align with policy expectations
The Results
The organization moved beyond post-merger uncertainty, strengthened its technology leadership posture, and positioned IT as a strategic enabler of global growth and long-term value creation.
Passed CMMC Level 2 C3PAO audit
DSA successfully passed its CMMC Level 2 C3PAO audit with no conditions or Plans of Action and Milestones (POAMs).
Key success factors included:
- Tight scope definition
- Strong alignment between documentation and implementation
- Rapid, informed responses to auditor questions
- Early investment in readiness rather than reactive remediation
Ongoing Compliance & Advisory Support
CMMC compliance does not end at certification. After achieving certification, DSA elected to engage Hartman for ongoing compliance advisory support, including:
- Annual self-attestation preparation
- Yearly review and updates to the SSP and policies
- Advisory support as regulations and auditor interpretations evolve
This ongoing engagement helps DSA remains compliant while avoiding unnecessary expansion of scope or cost.
