CMMC Technical Architecture & Audit-Ready Deliverables
This is the deliverable hub for CMMC Level 1, Level 2, and Level 3 implementations. CUI enclave architecture, GCC High and Microsoft 365 hardening, SIEM and log retention build-outs, MFA and PIV deployment, FIPS 140-2 validated encryption, incident response runbooks, evidence repositories, and POA&M trackers. Built and operated by Petronella Technology Group, a CyberAB Registered Provider Organization (RPO #1449) with a North Carolina Digital Forensics Examiner on staff (DFE #604180) and 23+ years running regulated infrastructure for the defense industrial base.
CMMC Level 1 Basics
17 practices, annual self-assessment, FCI-only contracts. The starter level every DoD prime asks about first. Plain-English breakdown of each practice family.
Explore Level 1CMMC Level 2 (CUI)
110 NIST 800-171 controls, triennial C3PAO assessment, mandatory for anyone handling Controlled Unclassified Information. Cost, timeline, evidence depth.
Open Level 2 guideCalculate SPRS Score
Free interactive tool scores all 110 NIST 800-171 controls and outputs the SPRS value DoD primes verify in the Supplier Performance Risk System.
Run the calculatorTalk to a CMMC RP
Skip the framework reading. Book 30 minutes with a Registered Practitioner from RPO #1449 to scope your assessment, enclave, and POA&M.
Meet the consultantsThe technical deliverables behind a CMMC certification
This page is the deliverable hub for organizations that already know they need CMMC and want to see what is actually deployed, configured, and handed to a C3PAO assessor. If you want CMMC framework basics, the regulatory story, the RPO credential narrative, and CMMC fit by industry, see our CMMC compliance services overview.
/compliance/cmmc/) answers "what does Petronella actually deploy in our environment, what evidence will the C3PAO see, and what are the integration specifics?" Both pages are self-canonical. Pick the one that matches the question you are answering today.
What you get on this page
- Eight deliverables. CUI enclave, GCC High M365 setup, SIEM and log retention, MFA and PIV, FIPS 140-2 encryption, incident response runbook, evidence repository, POA&M tracker. Each mapped to the 800-171 control families it satisfies.
- Three-stage methodology. Architect (boundary, gap, design), Deploy (build, harden, integrate), Evidence (collect, narrate, hand to C3PAO).
- Integration specifics. Microsoft GCC High and Government Community Cloud, M365 E5, Intune, Defender for Endpoint, Azure Sentinel, Microsoft Purview, Yubikey, PIV-I smartcards.
- SLAs and operating model. 24x7 SOC monitoring tier, evidence collection cadence, quarterly POA&M reviews, annual SSP refresh.
- Spoke deliverables. CMMC gap assessment, CMMC Level 2 readiness, remediation services, C3PAO assessment support, and SSP development.
Eight CMMC deliverables, mapped to 800-171 control families
Each row is a discrete artifact or system Petronella designs, deploys, and documents. Use the matrix to size a CMMC engagement and figure out which deliverables apply to your boundary.
Architect, Deploy, Evidence
Three stages, sequenced. Each stage produces artifacts the next stage builds on. The C3PAO walks through Stage 3 output during the formal assessment. When you are ready to move from preparation to formal assessment, see our C3PAO selection guide for the comparison framework, vetting checklist, and lead-time analysis required to choose the right assessor.
Boundary, gap, design
We scope the CMMC assessment boundary, classify where CUI and FCI actually live, and pick the architecture that minimizes scope. The output is a target-state design, a gap report against the 110 NIST SP 800-171 controls, and a roadmap with timelines.
- CUI flow mapping (origin, processing, storage, transit, destruction)
- Assessment boundary diagram with enclave option
- Gap assessment against 110 controls with SPRS pre-score
- Tenant decision: GCC vs GCC High vs hybrid
- POA&M seed with timeline and dependencies
Build, harden, integrate
We build the CUI enclave, provision the GCC High tenant, deploy SIEM and log retention, roll out phishing-resistant MFA and PIV smartcards, configure FIPS-validated cryptography, and integrate the technical-control layer with your existing identity, ticketing, and asset systems.
- GCC High M365 tenant build with Conditional Access baseline
- Intune device baselines, Defender for Endpoint hardening
- SIEM rollout with 90-day hot + 365-day cold log retention
- Yubikey / PIV-I smartcard deployment for privileged users
- Microsoft Purview labels and DLP for CUI handling
- Network segmentation, FIPS 140-2 VPN, encrypted backup chain
Collect, narrate, defend
Controls do not pass assessments. Evidence does. We assemble the SSP, the POA&M, and the artifact repository in the format C3PAOs expect, then run mock assessments and interview rehearsals so your team is fluent before the real visit.
- System Security Plan (SSP) with implementation narratives
- Evidence repository, control-by-control, version-controlled
- Mock C3PAO assessment with finding remediation
- Personnel interview preparation
- SPRS score upload and DoD submission
- Quarterly POA&M reviews after certification
CUI enclave architecture, the scope-reduction pattern
The single biggest decision in a CMMC Level 2 engagement is whether to harden the entire corporate network to 800-171 or to fence Controlled Unclassified Information into an enclave. The enclave pattern reduces the CMMC assessment boundary by 40 to 60 percent in most engagements Petronella has scoped, which compresses both the remediation budget and the C3PAO assessment hours.
What the enclave actually looks like
A CMMC CUI enclave is a logically isolated workspace where every user who touches CUI does the work. The enclave has its own identity boundary, its own device baseline, its own logging, its own network egress controls, and its own physical or virtual perimeter. Two architectures dominate.
Pattern A. Virtual desktop infrastructure on GCC High
Users access CUI through Windows 365 Cloud PC or Azure Virtual Desktop hosted in GCC High. Endpoints are kept clean. CUI never lands on the corporate laptop. Cost lands in the $300 to $700 per user per month range for the underlying Microsoft licensing and infrastructure, before Petronella professional services.
Pattern B. Dedicated physical or virtual workstations
A small CUI team gets dedicated GCC High workstations that never leave the enclave. Useful when a specific engineering function (CAD, weapons-system data, ITAR technical data) needs local compute and the VDI latency is unacceptable. Higher per-user capex, lower ongoing licensing.
Why GCC High and not GCC or commercial
Commercial M365 cannot legally hold DoD CUI under DFARS 252.204-7012 in most scopes because of data-sovereignty and personnel-screening requirements. Government Community Cloud (GCC) is closer but still does not satisfy ITAR. Government Community Cloud High (GCC High) is the cloud Microsoft purpose-built for the defense industrial base with US-citizen personnel, sovereign data residency, and FedRAMP High plus DoD IL4 and IL5 baselines. For most regulated defense suppliers, the GCC High decision is binary.
What we hand to the C3PAO
- An assessment-boundary diagram with the enclave clearly delineated
- The Conditional Access policy set scoped to the enclave
- The Intune device baselines (CIS or DoD STIG aligned)
- The Defender for Endpoint device-onboarding evidence
- Network egress logs showing the enclave is not exfiltrating CUI to the corporate side
- A CUI flow narrative inside the SSP that the assessor can validate against system behavior
Microsoft GCC High stack components Petronella deploys
The reference stack for CMMC Level 2 implementations. Components map to the 800-171 control families they cover. Not every engagement uses every component; the matrix exists so buyers can map cost and time against a known target.
| Component | Vendor / surface | Primary control families covered | What evidence it produces |
|---|---|---|---|
| Identity baseline | Microsoft Entra ID in GCC High, Conditional Access, PIM | IA, AC | Sign-in logs, Conditional Access reports, privileged-access reviews |
| Phishing-resistant MFA | Yubikey 5 FIPS, PIV-I smartcards, Windows Hello for Business | IA | FIDO2 registration records, PIV issuance log, MFA enforcement policy |
| Endpoint management | Microsoft Intune GCC High | CM, SC, SI | Device-compliance reports, configuration profiles, BitLocker key escrow |
| Endpoint protection | Microsoft Defender for Endpoint Plan 2 | SI, SC, IR | Onboarding inventory, alert timelines, threat-hunting query history |
| SIEM and audit logging | Microsoft Sentinel in GCC High, Log Analytics workspace | AU (entire family) | 12 months of correlated logs, custom analytics rules, incident workbooks |
| Data classification | Microsoft Purview, sensitivity labels, DLP | MP, SC, AC | Label policies, CUI auto-classification rules, DLP incident reports |
| CUI enclave compute | Windows 365 Cloud PC GCC High, Azure Virtual Desktop GCC High | AC, SC, MP, PE | Cloud PC inventory, session recordings, peripheral redirection settings |
| Email and collaboration | Exchange Online GCC High, SharePoint GCC High, Teams GCC High | SC, AC, MP, AU | Mail-flow rules, external-share policies, retention labels, eDiscovery cases |
| Cryptography modules | FIPS 140-2 validated modules for VPN, BitLocker, backup, TLS | SC | NIST CMVP certificate numbers, module inventory, key-rotation log |
| Vulnerability management | Defender Vulnerability Management, Tenable Security Center where required | RA, SI, CM | Quarterly scan reports, remediation tickets, exception register |
| Backup and recovery | Azure Backup GCC High, immutable vault, geo-redundant storage | CP, MP | Backup job logs, restore-test records, retention policies |
| Network and perimeter | Azure Firewall GCC High, FIPS-validated site-to-site VPN, segmented vNets | SC, AC | Firewall rule sets, NSG flow logs, change-management approvals |
| Physical access (on-prem) | Badged perimeter, visitor log, locked media disposal, surveillance | PE, MP | Visitor logs, badge audit, media-destruction certificates |
SLAs, evidence cadence, and what post-certification life looks like
CMMC is not a one-time project. The certification is valid for three years, but the evidence underneath has to keep flowing. Petronella offers two operating models after Stage 3 (Evidence) wraps and your C3PAO assessment is on the calendar.
Model 1. Co-managed CMMC operations
Your internal IT or compliance lead owns the day-to-day. Petronella owns the architecture, the SSP, the POA&M, the SIEM tuning, and the quarterly evidence reviews. Best fit when you have a security-aware internal team and want to retain control of operational decisions.
- Quarterly evidence-quality review (4 hours)
- Quarterly POA&M reconciliation
- Annual SSP refresh, semi-annual tabletop drill
- SIEM analytics-rule tuning, monthly
- Incident-response on-call (4-hour acknowledgement SLA)
Model 2. Fully managed CMMC operations
Petronella runs the regulated stack end-to-end. Your team focuses on delivering the contract; we keep the controls alive. Best fit for sub-50-person defense suppliers who do not have the headcount for a dedicated security engineer.
- 24x7 monitored SIEM with hybrid AI plus human analyst tiers
- Identity and Conditional Access policy ownership
- Intune baseline ownership and quarterly drift reviews
- Evidence collection automation; assessor-ready repository at all times
- Incident response retainer with DFARS 252.204-7012 reporting integration
Service-level commitments
- Incident acknowledgement: 30 minutes for SIEM-detected critical events, 4 hours for client-reported events.
- DFARS 72-hour reporting: incident assessment, DC3 reporting evidence, and contract-officer notification packaged within the 72-hour clock.
- SSP and POA&M turnaround: initial revision within 5 business days of a request, annual full refresh.
- Evidence-repository freshness: control evidence updated quarterly or after any qualifying environment change.
- Recertification window: readiness review 6 months before three-year certification expiry, full reassessment support included.
For organizations that also want documentation-platform tooling alongside Petronella's deployment, see how ComplianceArmor automates SSP, POA&M, and policy-set generation against the same control library.
Private AI inside a CUI boundary
DoD suppliers increasingly want AI assistants, retrieval-augmented search, and document summarization on engineering data that includes CUI or export-controlled material. Public AI is off-limits. Petronella deploys private LLM inference inside the same boundary that carries the rest of the CMMC controls.
The integration pattern keeps inference, vector storage, retrieval, and prompt logs entirely inside the CMMC assessment boundary. No public API calls. No CUI sent to a vendor. Audit logging into the same Sentinel workspace the C3PAO will review. Identity tied to the same Entra ID and Conditional Access that gate the rest of the enclave.
Components we wire in
- On-prem or sovereign-cloud GPU inference (NVIDIA reference channels through approved partner programs)
- Vector store with CUI-aware access control inheriting from SharePoint or Purview labels
- Retrieval pipeline that respects document labels and refuses to surface labeled CUI to unauthorized users
- Full prompt and completion logging to the SIEM, tagged for AU.L2-3.3.x evidence
For the broader AI services lineup, see our private AI hub or the deliverable-level AI services hub. For how AI fits the rest of the security program, see our cybersecurity services.
Existing CMMC deliverable pages
Each spoke goes deeper on a single deliverable inside this hub. Use them when you have already scoped the engagement and want to read the spec for a specific artifact.
CMMC Gap Assessment
Control-by-control 110 NIST 800-171 evaluation. Produces validated SPRS pre-score, gap report, remediation roadmap, and POA&M seed. Typical delivery 4-6 weeks.
deliverable spec →CMMC Remediation Services
Hands-on technical-control implementation, policy and procedure authoring, SSP build, and closure of every gap before the C3PAO walks in. Stage 2 of the methodology.
deliverable spec →CMMC Level 2 Certification
End-to-end Level 2 readiness covering all 110 controls. CUI enclave decision, GCC High provisioning, SIEM build, and C3PAO-ready evidence packaging.
deliverable spec →C3PAO Assessment Readiness
Mock assessments, evidence-walkthrough rehearsal, interview preparation, and assessor-week support. The last stage before the formal certification visit.
deliverable spec →CMMC Levels 1, 2, and 3
Reference breakdown of which control set, which assessment type, and which evidence model applies at each level. Petronella consults all three.
deliverable spec →CMMC Level 1 Self-Assessment
The 17-control Basic Safeguarding ruleset for organizations that only handle Federal Contract Information. SPRS attestation workflow and annual recertification cadence.
deliverable spec →C3PAO Selection Guide
Vendor-neutral checklist for choosing a CMMC Third-Party Assessment Organization. Capacity, geography, sector experience, and ethical separation from your RPO.
read the guide →Best CMMC Compliance Consultants 2026
Vendor-neutral ranking of CMMC RPO firms. Scope, pricing model, RPO numbers, sector experience, and ethical-separation posture compared side by side.
read the ranking →All Compliance Programs
HIPAA, GLBA, ITAR, FTC Safeguards, NIST 800-53, FINRA, FedRAMP. Cross-framework engagements where CMMC sits alongside one or more other regimes.
compliance hub →North Carolina defense-industrial-base coverage
Petronella is a Raleigh-based firm. We work on-site across the Research Triangle and remote across the United States. CUI engagements use US-citizen personnel and FedRAMP-authorized infrastructure regardless of where the buyer sits.
REGIONS See North Carolina coverage detail
CMMC technical-stack questions
How is this page different from your /cmmc-compliance/ page?
This page (/compliance/cmmc/) is the deliverable hub. It documents what Petronella actually builds, configures, and hands to a C3PAO, with control-family mapping, integration specifics, and SLAs.
Our CMMC compliance services hub is the buyer-identity hub. It documents the regulatory story, the CyberAB RPO credential, the framework basics, the vertical fit, and the consulting offer. Different question, same engagement.
Do I need GCC High, or can I do CMMC on commercial Microsoft 365?
If your contract involves DFARS 252.204-7012 CUI, you almost certainly need GCC High. Commercial M365 does not satisfy the DFARS clause for most CUI categories because of data-residency and personnel-screening rules. GCC (Government Community Cloud, the non-High version) covers some FCI scopes but does not handle ITAR. The architecture decision happens in Stage 1 (Architect) of our methodology.
How long does a typical CMMC Level 2 deployment take?
Six to eighteen months from kickoff to C3PAO-ready, depending on your starting posture, headcount, and whether you go with a CUI enclave or full-network hardening. Organizations that have an existing NIST SP 800-171 self-assessment with a reasonable SPRS score generally land closer to the six-month end. Greenfield engagements with no prior 800-171 work land closer to the eighteen-month end.
What is in the SSP you deliver?
Our System Security Plan covers every applicable 800-171 control with a four-part narrative: control text, implementation description, responsible role and surface, and pointer to the evidence artifact. We use the NIST-recommended format and align with the C3PAO assessment workbook. The SSP is version-controlled and updated quarterly during operations.
What evidence does a C3PAO actually look at?
For each of the applicable controls (110 for Level 2), the assessor wants one or more of: technical configuration evidence (a screenshot of the policy, an export of the rule, a config file), a procedural narrative (the SSP entry), an artifact showing the procedure was followed (a log, a ticket, a signed acknowledgement), and a personnel interview confirming the procedure is real and rehearsed. We build the evidence repository so every control has all four where they apply.
How is incident response wired to DFARS 252.204-7012 reporting?
The DFARS clause requires a covered cyber incident affecting CUI to be reported to the DoD via DC3 within 72 hours. Our incident-response runbook codifies the assessment, the data-collection, the DC3 portal submission, and the contract-officer notification on a clock. We rehearse it as a tabletop annually and after any qualifying real-world event.
Can you handle CMMC Level 3?
Yes. Level 3 layers selected NIST SP 800-172 enhanced controls on top of the Level 2 baseline and is assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Petronella scopes Level 3 engagements with the same Architect / Deploy / Evidence methodology and adapts the technical-control deployment to the 800-172 additions, including advanced threat-protection and supply-chain controls.
What does the post-certification cadence look like?
Quarterly POA&M reconciliation, quarterly evidence-repository freshness review, semi-annual tabletop drill, annual SSP refresh, semi-annual sensitivity-label and DLP review, and a readiness review six months before the three-year recertification window opens.
Do you cover CMMC alongside HIPAA, ITAR, or FedRAMP?
Yes. Many defense suppliers also process protected health information for veterans or active-duty members (HIPAA), export-controlled technical data (ITAR), or contract for federal civilian agencies (FedRAMP). The control libraries overlap substantially, and we structure the SSP and evidence repository as a single shared library with framework-specific overlays. See all compliance programs for the catalog.
Ready to scope a CMMC deployment?
Petronella Technology Group is a CMMC Registered Provider Organization (RPO #1449) with 23+ years of regulated-IT delivery. Bring us a contract clause, a SPRS score, a gap report, or just a CUI question. We will tell you which deliverables apply and how the assessment boundary should be drawn.
Federal subcontractors that also touch civilian-agency systems usually pair CMMC with NIST 800-53 compliance and frequently with NIST 800-171 compliance evidence libraries.
CMMC Service in Drivable Southeast and Mid-Atlantic DoD Markets
Petronella Technology Group serves DoD contractors across drivable Mid-Atlantic and Southeast markets from our Raleigh NC headquarters. Most CMMC engagements are delivered remote-first with planned onsite blocks for kickoff, boundary walk, and mock C3PAO assessment.
Evaluating an RPO in the DC, Maryland, or Virginia metro? Read our DMV CMMC RPOs vs National Practice trade-off analysis for a balanced view across six selection criteria. Comparing Petronella against a larger national CMMC practice? See our Summit7 Alternative: 7 Trade-offs analysis.