Manufacturer's U.S. site learns its biggest CMMC gap is who runs its IT, not which controls it has
The U.S. manufacturing site of a global industrial group. Outcome verified
The problem
The U.S. manufacturing site of a global industrial group held federal contracts with export-control obligations and needed to reach CMMC Level 2. Its IT and security operations came from the parent's global shared services, so staff outside the United States ran systems touching regulated data. The site could not tell how much of that model would survive an assessor.
Why it mattered
Federal contracts were a significant share of the site's revenue. A failed assessment or an export-control violation would put that work, and the company's standing with the government, at risk.
What we did
Vizius read the requirements to the letter and named the uncomfortable finding plainly: the shared-services model itself was the primary gap, not any single control. It then costed two paths, the whole site under CMMC or a tightly scoped, U.S.-administered compliant environment, and estimated the scoped path at four to six months against 14 to 18.
What changed
Leadership chose a modified version of the scoped environment and received a phased implementation plan with resource, cost and timeline estimates and an early-2026 target.
- Manufacturing
- Enterprise company
- CMMC
- NIST 800-171
- ITAR/EAR