Mock CMMC audit traces most failed objectives to one undocumented decision: where the regulated data lives
A national commercial construction and renewable-energy contractor. Outcome verified
The problem
A national construction contractor had invested heavily in a CMMC Level 1 program and believed it was close to self-attesting. Then its compliance lead left. Leadership needed to know whether the program would survive an assessor's questions, and who would answer them. Seven teams each held part of the evidence; nobody saw the whole.
Why it mattered
Federal contract work depended on the attestation, and a staffing gap risked stalling the program or attesting to controls that would not survive scrutiny.
What we did
Instead of another document review, Vizius embedded a senior compliance engineer part-time and ran a 30-day mock audit, questioning each team as an assessor would. Most unmet objectives shared one root cause: nobody had documented where federal contract information lives, so boundary, monitoring and inventory questions failed even where controls already operated.
What changed
The mock audit produced a prioritized register of 18 unmet objectives, each with an owner, and raised the two cross-cutting blockers, the undefined data boundary and the missing asset inventory, to executives. Several findings should close once the boundary is documented; remediation is in progress.
- Construction and engineering
- Large company
- CMMC
- NIST 800-171
- FAR 52.204-21