Contractor turns its mobile device settings into CMMC Level 1 evidence by mapping each one to a control
A national commercial construction and renewable-energy contractor. Outcome verified
The problem
A national construction contractor pursuing CMMC Level 1 had to show it governed the phones and tablets its people used for company data. It had no device management baseline and no way to prove compliance, though it already owned the licensing. Devices mixed personal and corporate-owned, and enforcing conditional access wrongly can lock out a workforce.
Why it mattered
Without device governance the firm could not demonstrate the practices required to protect federal contract information, and the first office had to go live within weeks.
What we did
Vizius designed device management and conditional access together, piloted with IT staff and friendly users, then rolled out in waves, moving conditional access from report-only to enforced behind a break-glass account. Every setting was mapped to the control it satisfies, so the configuration itself became the audit evidence.
What changed
Within about a quarter all eight deliverables were complete: device management and conditional access configured to Level 1 requirements, corporate-owned enrollment supported, an internal app catalog published, and a control-to-setting evidence mapping, with administration handed to the client.
- Construction and engineering
- Large company
- CMMC
- FAR 52.204-21