CMMC does not change by industry.
Where CUI lives does.
The Cybersecurity Maturity Model Certification (CMMC) requirements are the same for every organization that holds Controlled Unclassified Information (CUI). What changes is what that information looks like, where it is received, stored, processed and transmitted, who and what touches it, the gaps that turn up again and again, and the objection we hear when we point them out. Six pages, one for each kind of organization we work with.
Defense & Aerospace
CUI spreads across programs, engineering and suppliers
The challenge isn't simply protecting CUI. It's knowing everywhere your CUI goes.
Read →Manufacturing
Controls that hold on the shop floor, not just on paper
CMMC has to work on the shop floor, not just on the assessor's checklist.
Read →Engineering & Technical Services
Simple IT, serious CUI, and a cloud that is not a program
A compliant cloud platform does not automatically create a compliant organization.
Read →Construction, Facilities & Infrastructure
CUI leaves the office and reaches the field. Then what?
Collaboration doesn't eliminate the CUI boundary. It makes defining and controlling that boundary more important.
Read →Professional Services & Consulting
CMMC is about the information you hold, not your headcount
CMMC isn't determined by how many employees you have. What matters is the information you are contractually required to protect and the systems that handle it.
Read →Research, Science & Technology
A controlled environment in which research can continue
The objective isn't to restrict research. It's to design a controlled environment in which research can continue.
Read →
The Resource Library follows the same path.
Every industry page ends with the documents to open first: identify the information, map where it goes, draw the boundary, then check readiness. All nine working documents, in the order an engagement uses them, are in the CMMCg Resource Library →
Recognize your organization on one of these pages?
The readiness call starts from your environment, not a template. Bring the page that fits; an engineer runs the call.
- Your CUI boundary sketched on the call
- The requirements costing you the most points, named
- A written summary afterward, yours to keep
NDA signed before anything technical. No cost, no obligation.