CMMC Level 2 certification in three months

The challenge

Policies alone weren’t going to pass an assessment

The client needed to prove that the environment where it handles Controlled Unclassified Information (CUI) met CMMC Level 2 requirements. Writing policies wasn’t enough. To pass an independent C3PAO assessment, the client needed a clearly defined scope, safeguards that were actually implemented, evidence an assessor could verify, and an operating model it could sustain.

Bringing the entire company into scope would have expanded the effort and delayed readiness. Instead, FirstCall Federal proposed a dedicated VDI enclave on Microsoft GCC High that isolates CUI work in one controlled environment, so security and compliance requirements apply to a single, well-defined boundary.

The FirstCall Federal approach

One coordinated program, not separate projects

FirstCall Federal delivered the entire engagement: advisory, technology, documentation, training, and assessment support. The client didn’t have to coordinate multiple vendors or piece together a compliance program on its own. The work was organized around the assessment scope and clearly shared responsibilities.

1. 1
   Define the boundaryMap the users, systems, data flows, external services, and connections that belong in scope, and lead the scoping discussions with the C3PAO.
2. 2
   Build the enclaveRecommend the right GCC High licensing, then configure a VDI environment for CUI work with security controls aligned to Level 2 requirements.
3. 3
   Document how it operatesWrite the System Security Plan, policies, procedures, asset inventory, and responsibility matrix to match the environment as built.
4. 4
   Prepare evidence and peopleOrganize and test evidence, validate that controls work as documented, and train users and interviewees for the assessment.
5. 5
   Support the assessmentProvide hands-on support throughout the C3PAO assessment, including responding to evidence requests and working directly with the assessment team.

The three-month journey

From kickoff to assessment

The result

Assessment passed, three months after kickoff

Three months after kickoff, the client passed its CMMC Level 2 assessment. The GCC High VDI enclave gave the client a secure, contained environment for CUI, and FirstCall Federal supplied the supporting documentation, evidence, and trained users. The client also came away with an operating model built to keep it compliant well after assessment day.

The outcome shows what’s possible when scope, technology, documentation, and training are delivered as one coordinated program rather than separate projects.

The CMMC Level 2 assessment was performed by an independent, authorized C3PAO. FirstCall Federal prepared the client and supported it during the assessment; it did not assess or certify the client.

Why a managed enclave

A smaller boundary is easier to secure and maintain

Organizations that need to protect CUI don’t have to apply CMMC requirements across the whole enterprise. A managed enclave confines the assessment to a single, well-defined boundary, which reduces cost, effort, and risk. Success still depends on accurate scoping, documented data flows, clearly assigned responsibilities, compliant services, and disciplined use by authorized users. The enclave doesn’t eliminate a client’s compliance obligations, but it makes them far easier to define, implement, and maintain.