A defense supplier had the controls but not the paperwork; scoring first showed where the points were
A global additive-manufacturing equipment maker. Outcome verified
The problem
A global additive-manufacturing equipment maker had built a compliant cloud environment whose technical controls satisfied most of NIST 800-171, but it had almost none of the documentation it needed to self-attest to a CMMC score: no system security plan, policies, plan of action or training record. The environment was still changing, and leadership wanted 'essentially compliant' quickly rather than a gold-plated program.
Why it mattered
Defense customers require an attested score, and a third-party audit was expected. Without the documentation the company could not credibly attest, and a weak score put contracts at risk.
What we did
Rather than start writing, Vizius scored the environment against all 320 assessment objectives first. Only 18 controls were unmet, but a handful of heavily weighted ones accounted for most of the lost points. Documentation was aimed at the few items that moved the score while still producing the full attestation set.
What changed
The interim score was 68 of 110, with three control families identified as the path to 100; by September 2025 most open items in the heaviest family were met. The engagement reached interim close in October 2025, with Vizius on standby for the audit.
- Manufacturing
- Large company
- NIST 800-171
- CMMC
- ITAR/EAR