CMMC Consultant Cherry Point NC: FRC East MRO 2026
Posted: December 31, 1969 to Compliance.
Marine Corps Air Station Cherry Point in Havelock, NC (Craven County) hosts the 2nd Marine Aircraft Wing and operates across 29,000+ acres. Fleet Readiness Center East (FRC East), located on MCAS Cherry Point, is the Navy's premier aviation maintenance, repair, and overhaul (MRO) depot for the AV-8B Harrier, F-35B/C Lightning II, H-1 helicopters, and other Navy and Marine Corps platforms - operating with a workforce of 4,200 and annual revenue exceeding $720 million (source: Wikipedia, Fleet Readiness Center East).
If your business holds an MRO, parts manufacturing, engineering services, or sustainment contract supporting FRC East or MCAS Cherry Point, you are likely subject to both CMMC and AS9100 obligations. This guide walks naval aviation MRO contractors through level selection, the AS9100 stacking question, and how to choose a CMMC consultant who understands the depot maintenance ecosystem.
Who needs CMMC compliance at Cherry Point and FRC East
The naval aviation MRO ecosystem at Cherry Point includes a long tail of specialized contractors. Common types in scope:
- Airframe and engine component MRO contractors performing depot-level work on Harrier, F-35, H-1 (UH-1Y / AH-1Z), V-22 Osprey, KC-130J, or other platforms.
- Aerospace parts manufacturers producing FAA / Navy-approved spare parts, replacement components, or sub-assemblies.
- Engineering services firms providing reverse engineering, obsolescence management, or technical data management for legacy platforms.
- NDT, calibration, and metrology contractors supporting depot quality assurance.
- Avionics, EW, and sensor contractors handling sensitive system data marked CUI under ITAR or under specific DoD Distribution Statements.
- 2nd Marine Aircraft Wing logistics, training, and base support contractors.
- Construction, hangar, and facility contractors performing MILCON on aviation facilities.
- Software development, predictive maintenance, and AI/ML contractors handling sustainment data flows.
If your contract or subcontract carries DFARS 252.204-7012, 7019, 7020, or 7021, or if your engineering data is marked with a Distribution Statement (A through F), Export Control Classification Number, or CUI banner, you are in scope.
The naval aviation stack: CMMC + AS9100 + ITAR + NIST 800-171
Naval aviation MRO contractors at Cherry Point and FRC East often manage four overlapping compliance frameworks:
- CMMC 2.0 - cybersecurity maturity per 32 CFR Part 170
- AS9100D (or AS9110 for MRO depot) - aerospace quality management system
- ITAR - International Traffic in Arms Regulations for export-controlled defense articles
- NIST SP 800-171 Rev 2 - the underlying 110 controls CMMC Level 2 audits against
A consultant who only knows CMMC will miss interactions between these frameworks. AS9100 documentation often satisfies portions of CMMC documentation requirements, and ITAR adds additional access-control rules CMMC alone does not capture. Choose a consultant who can map across all four.
What CMMC level your Cherry Point/FRC East contract requires
CMMC 2.0 defines three levels under 32 CFR Part 170 and the contract rule at 48 CFR / DFARS 252.204-7021. Your contracting officer specifies the required level in the solicitation. Naval aviation MRO contracts skew toward Level 2 because most CUI engineering data and ITAR materials require it.
Level 1 - Federal Contract Information (FCI) only
15 controls from FAR 52.204-21. Annual self-assessment. Typical scope for Cherry Point: commodity goods providers, basic services without CUI exposure. Engagement length: ~30 days of focused consulting time.
Level 2 - Controlled Unclassified Information (CUI)
110 controls from NIST SP 800-171 Rev 2. Most aviation MRO, parts manufacturing, and engineering services contracts require triennial third-party assessment by a C3PAO. A narrow subset of low-risk Level 2 contracts may allow annual self-assessment. Engagement length: 60 to 90 days for gap assessment phase, 6 to 9 months for full readiness depending on starting maturity. AS9100-certified firms often see compressed timelines because some quality documentation overlaps with CMMC.
Level 3 - Highest-sensitivity CUI
110 NIST 800-171 controls plus selected NIST SP 800-172 enhanced controls. Triennial DIBCAC-led government assessment. Common scope: depot work on classified-adjacent platforms, advanced sensor work, or operationally sensitive sustainment data. Engagement length: scope-dependent, typically 9 to 18 months.
Cost considerations: what drives the engagement length for MRO contractors
Petronella Technology Group does not publish fixed CMMC pricing because every scope is different. Five drivers shape your engagement profile:
- Number of in-scope assets. A 25-person specialty parts manufacturer with one CUI workstation differs from a 400-person depot maintenance contractor with CUI across the enterprise.
- Starting maturity. If you already operate in Microsoft 365 GCC High with documented quality management and ITAR-segregated environments, your gap is in hours. If you are starting from commercial M365 with shared drives, your gap is months.
- AS9100 overlap. Firms already certified to AS9100D (or AS9110 for MRO) frequently have documentation foundations that map to CMMC. A consultant who can leverage that overlap saves you months.
- Enclave vs. full-scope architecture. Aviation MRO contractors often segment CUI handling to a dedicated GCC High enclave with strict role-based access, rather than certifying their entire IT estate.
- ITAR interactions. If you handle export-controlled defense articles, your CMMC scope must include the additional access controls ITAR demands - this is not "free" overlap.
Ballpark engagement lengths (not prices):
- Level 1 self-assessment: ~30 days of consulting time
- Level 2 gap + readiness (AS9100-certified firm): 60 to 90 days for gap, 4 to 7 months for full readiness
- Level 2 gap + readiness (no AS9100 baseline): 60 to 90 days for gap, 6 to 9 months for full readiness
- Level 3 (advanced sustainment data): 9 to 18 months including DIBCAC scheduling
For an actual scoped quote, request a free CMMC scoping consultation. We ask 20 scoping questions and return a fixed-scope proposal within five business days.
How to choose a CMMC consultant for Cherry Point and FRC East work
11-point consultant checklist for naval aviation MRO contractors
- CMMC-RP credential on every assigned consultant. If the firm cannot name your assigned Registered Practitioner by ID, walk away.
- RPO listing on the Cyber-AB Marketplace. Search at cyberab.org/Marketplace. Petronella Technology Group is RPO #1449.
- AS9100 stacking expertise. Critical for Cherry Point and FRC East work. Your consultant should be able to map AS9100 documentation against CMMC controls and avoid duplicative work.
- ITAR awareness. Many aviation MRO contractors handle ITAR-controlled technical data. Your consultant should know how ITAR access rules interact with CMMC access controls.
- NC presence or proven naval aviation DIB experience. CMMC interviews, tabletop exercises, and physical security walkthroughs benefit from in-person facilitation.
- NIST 800-171 experience predating CMMC. The 110 controls existed under DFARS 7012 since 2017.
- C3PAO relationships without C3PAO conflict. The CMMC Code of Professional Conduct prohibits the same firm from consulting AND assessing.
- GCC High and Microsoft 365 deep expertise. Most aviation MRO enclaves run on GCC High. Generic IT consultants burn budget figuring it out.
- Realistic documentation timelines. SSP, POA&M, and 110 control narratives are not produced in a one-week sprint.
- SPRS score uplift methodology. A consultant who cannot explain how they will raise your score from a negative baseline to a passing posture is selling vapor.
- Fixed-scope, 100% upfront proposal. Hourly engagements blow past CMMC budgets routinely. Insist on milestones and a fixed fee.
Common pitfalls for Cherry Point and FRC East contractors
- Assuming AS9100 covers CMMC. It does not. AS9100 is a quality management framework; CMMC is a cybersecurity maturity framework. There is overlap, but AS9100 alone will not get you through a C3PAO interview.
- Ignoring ITAR access controls in the CMMC scope. ITAR-controlled technical data demands US-person access enforcement that CMMC alone does not specify. Your consultant must address both.
- Underestimating engineering data flows. Drawings, manuals, technical orders, and modification documents flow between primes, depot, and subcontractors. Each handoff is an in-scope CUI event.
- Treating reverse engineering or obsolescence work as outside CMMC. If you receive a Distribution Statement-marked drawing for reverse engineering, the resulting workproducts are CUI.
- Ignoring SPRS until bid submission. A stale SPRS score is the most common award ineligibility cause.
- Buying a "CMMC in a box" platform without scoping. Scope first, then platform.
- Hiring an IT MSP to write the SSP. MSPs run infrastructure. Compliance writers produce narratives that survive C3PAO interviews. These are different skill sets.
- Letting a C3PAO consult AND assess your firm. Hard-prohibited by the CMMC Code of Professional Conduct.
- Failing to plan for legacy systems. Aviation MRO often involves long-life-cycle systems with legacy software and obsolescence challenges. Your CMMC scope and remediation plan must account for this.
Why Petronella Technology Group for Cherry Point and FRC East naval aviation MRO work
Petronella Technology Group is a Raleigh, North Carolina cybersecurity and compliance firm founded in 2002, with a BBB A+ rating since 2003. Our team is fully CMMC-RP credentialed. We are listed on the Cyber-AB Marketplace as Registered Practitioner Organization (RPO) #1449. Our headquarters at 5540 Centerview Drive, Suite 200, Raleigh, NC 27606 supports field travel to Havelock and Craven County for in-person tabletop work, interview prep, and physical security walkthroughs.
What we bring to a Cherry Point or FRC East naval aviation MRO engagement:
- Full-team CMMC-RP coverage across our consulting staff.
- NIST 800-171 experience predating CMMC enforcement.
- GCC High enclave design that passes C3PAO interviews.
- AS9100 / AS9110 overlap mapping that reduces duplicative documentation work.
- SPRS score uplift methodology documented across multiple NC DIB engagements.
- Our ComplianceArmor platform automates SSP and POA&M generation and ongoing 110-control maintenance.
- Founder Craig Petronella holds CMMC-RP, CCNA, CWNE, MIT-Certified in AI and Blockchain, and DFE #604180.
- 100% upfront fixed-fee engagements with clear milestones.
Get a free CMMC scoping consultation for your Cherry Point or FRC East naval aviation MRO contract.
Schedule scoping consultationOr call (919) 348-4912
Frequently asked questions
What CMMC level do most Cherry Point/FRC East subcontractors need?
Most naval aviation MRO, parts manufacturing, and engineering services contracts handle CUI and require Level 2. Commodity goods providers often land at Level 1. Sustainment work on classified-adjacent platforms can require Level 3.
Does AS9100 certification satisfy CMMC requirements?
No. AS9100 is a quality management framework; CMMC is a cybersecurity maturity framework. There is meaningful documentation overlap (control of records, document control, training, change management), but AS9100 alone will not satisfy CMMC. A consultant familiar with both can leverage the overlap to compress your timeline.
How does ITAR interact with CMMC at Cherry Point?
ITAR-controlled technical data demands US-person access enforcement and export-control segregation that CMMC does not explicitly require. If your scope includes ITAR materials, your access control architecture must satisfy both frameworks. Many MRO contractors implement a dedicated US-person-only GCC High enclave to handle both at once.
How long does CMMC Level 2 readiness take for an AS9100-certified MRO contractor at Cherry Point?
For an AS9100-certified firm with documented quality management, 60 to 90 days for gap assessment and 4 to 7 months for full readiness. Without AS9100 baseline, plan 6 to 9 months for full readiness.
Can my MSP do CMMC compliance for me?
An MSP can implement the technical controls but cannot ethically self-assess them, and most cannot produce the compliance documentation a C3PAO will accept. Most aviation MRO contractors use a compliance consultant alongside their MSP, with clear separation of duties.
Do FRC East subcontractors face additional review beyond CMMC?
Depot subcontractors handling Distribution Statement-marked engineering data face the same CMMC obligations as primes plus any additional contract-specific requirements (e.g., facility security clearance, ITAR registration, supplier quality audits). Always review the full solicitation, not just the CMMC clause.
Is on-site consultant presence required for Cherry Point CMMC engagements?
Remote works for documentation and platform configuration. Tabletop exercises, interview prep, and physical security walkthroughs benefit significantly from on-site presence at your Havelock or Craven County facility. Our Raleigh HQ supports field travel.
What does Petronella Technology Group charge for Cherry Point CMMC consulting?
We do not publish fixed pricing because every scope differs. We provide a free scoping consultation that produces a fixed-fee proposal within five business days. Payment terms are 100% upfront at contract execution.
Related reading
- CMMC Compliance: Complete Guide to Certification (flagship pillar)
- CMMC 2.0 framework overview
- CUI Handler Guide for DoD Subcontractors
- DFARS 252.204-7012 Field Guide
- SPRS Score Calculator and Methodology
- ComplianceArmor - SSP and POA&M automation platform
- Fort Liberty/Fort Bragg CMMC Consultant Guide (sibling)
- Camp Lejeune Marine Corps CMMC Consultant Guide (sibling)
