CMMC Compliance for Camp Lejeune Marine Corps Contractors

Marine Corps Base Camp Lejeune is a 246 square mile training and operations installation in Onslow County, North Carolina. The base and its surrounding community include an active duty, dependent, retiree, and civilian-employee population of roughly 170,000 people. The largest single command on the installation is II Marine Expeditionary Force (II MEF), the wartime headquarters for the East Coast Marine Air Ground Task Force, supported by the 2nd Marine Division, 2nd Marine Logistics Group, and the Naval Hospital Camp Lejeune.

The main base is supplemented by six satellite facilities: Marine Corps Air Station New River, Camp Geiger, Stone Bay, Courthouse Bay, Camp Johnson, and the Greater Sandy Run Training Area. Marine Corps Air Station New River sits inside the Camp Lejeune contracting catchment and adds a heavy rotary-wing footprint - MV-22B Osprey, CH-53E Super Stallion, AH-1Z Viper, and UH-1Y Venom squadrons. A Camp Lejeune CMMC engagement almost always involves both base postures.

For your business, that mix produces an unusual contractor blend. Camp Lejeune subs are rarely the SOF-heavy intel integrators you find around Fort Bragg. They skew toward logistics, expeditionary engineering, amphibious systems integration, MV-22 sustainment, range and training systems, family services, and the Marine Corps health system - a steady, contract-heavy, mid-volume DIB market that has been on the receiving end of the CMMC rollout for the last 24 months.

Petronella Technology Group works with Onslow and Carteret county subs from a Raleigh headquarters that is roughly two hours by car from the Camp Lejeune main gate. On-site visits, classified workspace coordination, and unclassified-network remediation can all run from Raleigh. The firm is a Cyber AB Registered Provider Organization (RPO #1449) and every consultant holds the CMMC Registered Practitioner credential.

The Camp Lejeune supply chain divides into six recurring contractor profiles.

Expeditionary logistics and supply integrators

Marine Expeditionary Unit (MEU) deployment cycles drive a constant logistics tempo at Camp Lejeune. Subcontractors providing forward-deployable shelter systems, expeditionary power, water purification, ration logistics, or mission-support sustainment carry CMMC flowdown clauses on most option-year RFPs. Boundary scoping for these firms typically centers on the engineering, drawing, and supply-chain data shared with 2nd Marine Logistics Group.

Aviation sustainment supporting MCAS New River squadrons

The MV-22B, CH-53E, AH-1Z, and UH-1Y fleets stationed at MCAS New River drive a deep aviation-sustainment supplier base across eastern North Carolina. AS9100 quality posture intersects with NIST SP 800-171 controls in nearly every Tier 2 supplier we engage - parts, ground support equipment, calibration, and avionics testing all carry CUI exposure.

Amphibious systems and Marine combat vehicle vendors

Amphibious Combat Vehicle (ACV) and Light Armored Vehicle (LAV) maintenance, parts, and upgrade work runs through the Camp Lejeune supply chain. Engineering drawings and depot-level work orders are routinely CUI.

Range, training, and live-fire support contractors

Stone Bay and the Greater Sandy Run Training Area run continuous live-fire and pre-deployment training rotations. Range support, target systems, instrumentation, and after-action data carry mixed FCI and CUI footprints.

Naval Hospital, family services, and Marine and Family Programs vendors

Naval Hospital Camp Lejeune is a major regional healthcare provider with extensive contractor support. TRICARE-adjacent providers, behavioral health, family advocacy, and child and youth program contractors face the same layered HIPAA-plus-CMMC posture we discussed for the Fort Liberty Womack Army Medical Center supply chain.

Construction, engineering, and base operations support firms

NAVFAC Mid-Atlantic and Marine Corps Installations East drive a continuous stream of MILCON, sustainment, and base operations support contracts. Architecture-engineering and design firms routinely handle as-built drawings, security system diagrams, and base utility maps that meet the CUI definition.

The Department of Defense will phase in all three CMMC levels under the 32 CFR 170 Final Rule. The cost, evidence burden, and assessment cadence are different at each tier. Camp Lejeune subs systematically overshoot Level 2 - we estimate roughly one in three of our intake calls is from a sub being pushed toward Level 2 when a well-scoped Level 1 boundary would have satisfied the prime. Read our CMMC 2.0 complete guide for the full level-selection framework.

The Camp Lejeune intake calls produce a consistent pattern - the same seven issues account for the majority of a sub-110 SPRS score.

1. Commercial Microsoft 365 or commercial Google Workspace holding CUI

Standard commercial cloud tenants do not satisfy DFARS 252.204-7012 data residency. Migration to Microsoft 365 GCC High is the most common high-impact remediation. We have shipped GCC High migrations for Onslow County subs in 60 to 90 days.

2. No System Security Plan, or a stale 2019 SSP that no longer matches the network

Either condition fails a Level 2 assessment. The fix is a refreshed SSP built from the current boundary diagram. Read our CMMC Final Rule implementation guide for the phased calendar driving this requirement.

3. SPRS score with no calculation trail

The number landed in SPRS when the prime asked for it years ago. No one can show how it was derived. The DoD now expects an evidence trail behind every SPRS posting.

4. No 72-hour DFARS incident reporting plan

DFARS 252.204-7012 requires reporting to DoD Cyber Crime Center (DC3) within 72 hours. We almost never see a documented and tested reporting workflow on intake.

5. AS9100 quality system disconnected from the security boundary

Aviation sustainment subs frequently have a mature AS9100 quality posture but a CMMC boundary discussion that has never happened. The two posture documents need to be reconciled - the CUI flowing through AS9100 work orders is governed by both.

6. No CUI inventory and no CUI marking discipline

Drawings, work orders, contract attachments, and program briefings that clearly meet the CUI definition are stored unmarked. Without a CUI inventory the assessment cannot be scoped, and without marking the workforce has no way to handle the data correctly.

7. Backup and disaster recovery outside the CUI boundary

Backups on a commercial cloud tier or a NAS in a closet extend the CUI boundary to the backup target without anyone realizing it. We rebuild backup posture inside the CMMC enclave during every Level 2 engagement.

The threat picture for an Onslow County DIB sub is shaped by the East Coast Marine missions Camp Lejeune supports - expeditionary deployment, amphibious operations, and rotary-wing aviation sustainment.

People's Republic of China collection against amphibious and rotary-wing sustainment

FBI and Cybersecurity and Infrastructure Security Agency joint advisories have documented persistent intrusion campaigns against U.S. defense industrial base companies in the amphibious-systems and rotary-wing sustainment markets. MV-22 maintenance data, ACV upgrade timelines, and parts-supply forecasts are explicit collection targets.

Russian and DPRK ransomware against expeditionary logistics

Defense subcontractors face higher ransom demands than commercial firms of equivalent size because contract delay carries liquidated damages. Expeditionary logistics subs are an especially attractive target during MEU deployment workup cycles.

Insider risk from cleared-workforce churn

The Jacksonville and Wilmington corridors have an active cleared-workforce job market. Without a tested off-boarding process, departing engineers leave with VPN credentials, persistent OneDrive sync, or personal-device residue.

Phishing themed around II MEF, MEU deployment, and Marine and Family Programs cycles

Targeted phishing kits exist that mirror unit reorganizations, MEU deployment workup events, and Marine and Family Programs payment cycles. A back-office accountant at an 8 person sub clicks one MEU-themed payment update and the firm has a confirmed CUI incident inside 24 hours.

Petronella Technology Group does not publish a fixed CMMC price because scope drives cost. A 10 person back-office sub with one CUI workflow is fundamentally different from a 60 person aviation sustainment firm with three program offices. Every engagement starts with scope and ends with a SPRS score we can defend.

Stage 1 - Free scoping consultation

A 45 minute call. We map your prime contracts, flowdown clauses, current SPRS posture, and existing AS9100 or ISO 27001 footprint. You leave with a written scope summary and a typical engagement length estimate. No charge, no obligation.

Stage 2 - Boundary and CUI inventory workshop

Two to four weeks. We document where CUI lives, who touches it, and which systems are in scope. The deliverable is a defensible boundary diagram and a CUI inventory.

Stage 3 - Gap analysis against all 110 NIST 800-171 controls

Three to six weeks. Each control is scored. Evidence is collected. A prioritized remediation plan with realistic dates is produced.

Stage 4 - Remediation, GCC High migration, and SSP build

30 to 90 days for most subs. The System Security Plan, Plan of Action and Milestones, and supporting policies are all built or refreshed during this stage.

Stage 5 - Pre-assessment dress rehearsal and C3PAO selection

Mock C3PAO assessment using the same methodology a third-party assessor will use. Findings drive a final remediation sprint. We help you select and contract a C3PAO from the Cyber AB Marketplace.

Stage 6 - Continuous monitoring and SPRS maintenance

Annual self-affirmation requires defensible evidence. We keep your SPRS posture continuously current with managed detection, vulnerability scanning, and a quarterly evidence review.

1. North Carolina firm with a Raleigh headquarters and a Camp Lejeune service radius

Petronella Technology Group is headquartered at 5540 Centerview Drive, Suite 200, Raleigh, NC 27606 and has been in continuous operation since 2002. The firm holds a BBB A+ rating dating to its founding. Camp Lejeune engagements typically run from Raleigh with periodic on-site visits.

2. Entire team CMMC Registered Practitioner

The firm is listed in the Cyber AB Marketplace as Registered Provider Organization (RPO) #1449. Every consultant on staff carries the CMMC-RP credential, including the founder, Craig Petronella, who also holds CCNA, CWNE, Digital Forensic Examiner #604180, and MIT-Certified credentials in Artificial Intelligence and Blockchain. See our team and credentials.

3. Private AI cluster purpose-built for CUI workloads

For II MEF and MARSOC-adjacent contractors that want to use modern AI tools without sending CUI to a public model API, Petronella Technology Group operates a private NVIDIA-based AI cluster sourced through the NVIDIA Elite Partner Channel. Local inference inside a CMMC boundary lets engineers and analysts use modern AI productivity tools without breaching the data handling requirements that govern your contracts.

4. 24/7 hybrid AI and human threat analysis aligned to DFARS reporting

Detection alone is not the obligation. The DFARS 252.204-7012 obligation is to report a cyber incident to the DoD Cyber Crime Center inside 72 hours, and the practical question is whether the people who answer the 2:00 AM alert know how to triage it, contain it, preserve forensic evidence, and write a DC3 submission inside the clock. Petronella Technology Group runs a continuous AI-assisted plus human-analyst SOC purpose-built for the DIB reporting cadence, and Craig Petronella holds Digital Forensic Examiner credential number 604180 in support of the forensic preservation work that follows.

5. Built for the DoD subcontractor market, not retrofitted from commercial MSP work

A meaningful share of MSPs in eastern North Carolina extend their commercial managed services book into the DIB market without rebuilding their stack around CUI handling. The result is recurring SPRS deductions and a fragile audit posture. Petronella Technology Group built the CMMC practice from a DIB-first baseline, and the firm's stack, documentation library, and consultant credential mix reflect that.

Most of our Camp Lejeune area engagements originate from the following municipalities or surrounding counties. Petronella Technology Group does not operate a satellite office in Jacksonville, and we have found the lower overhead of a Raleigh-based delivery model is consistently better for our clients than a posted-rate local office model.

Onslow County: Jacksonville, Richlands, Holly Ridge, Sneads Ferry, Hubert, Swansboro, Maysville. Jacksonville is the dominant origin city for Camp Lejeune intake calls and the single largest concentration of Marine DIB subs in eastern North Carolina.

Carteret County: Morehead City, Beaufort, Newport, Cape Carteret, Emerald Isle. Carteret County subs frequently serve both Camp Lejeune and MCAS Cherry Point on alternating program years.

Pender County: Burgaw, Hampstead, Surf City. The Pender corridor sits on the Wilmington commuting axis and increasingly hosts small precision-manufacturing shops feeding the Marine logistics supply chain.

New Hanover County: Wilmington, Wrightsville Beach. Wilmington-based engineering and software firms regularly support Camp Lejeune programs on a remote-first basis.

Craven County: New Bern, which serves as a shared origin city for both Camp Lejeune and MCAS Cherry Point engagements.

Onsite visits are typically same-week from Raleigh. Remote remediation, managed detection, and SPRS-evidence maintenance are delivered continuously, with no travel-rate surcharge inside North Carolina.

Camp Lejeune has been in the national news cycle for two related contamination stories. The older case covers volatile organic compounds, trichloroethylene, perchloroethylene, and benzene in the base water supply from approximately 1953 through 1987, which is the subject of ongoing Camp Lejeune Justice Act litigation in the Eastern District of North Carolina. The newer story covers per- and polyfluoroalkyl substances (PFAS) detected at the installation in more recent monitoring.

For DIB contractors operating in the Onslow County market, the relevance is reputational rather than technical. Local awareness of the litigation has made base-adjacent businesses more conscious of compliance posture broadly, including in cybersecurity. Petronella Technology Group is not a party to and does not provide counsel on the Camp Lejeune Justice Act litigation. Contractors with personal exposure to the litigation should consult licensed counsel.

CMMC 2.0 Complete Guide 2026 covers the three levels, certification cost ranges, and the full implementation timeline.

CMMC Final Rule Implementation walks the 32 CFR 170 effective date and contract flowdown windows.

CMMC 2.0 Final Rule Released covers what defense contractors must do in the first 90, 180, and 365 days after their first CMMC contract flows down.

For program-level structure, see our flagship CMMC compliance program and the solutions by industry hub.