Cybersecurity Built for Defense Contractors and DIB Suppliers
Petronella Technology Group serves DoD primes, defense subcontractors, and federal civilian suppliers operating under CMMC 2.0 (Levels 1, 2, and 3), DFARS 252.204-7012, NIST SP 800-171 Rev 2 and Rev 3, and ITAR. Twenty-three years of experience helping North Carolina contractors win awards, survive flow-down clauses, and protect Controlled Unclassified Information.
Federal contractors live with a different kind of risk
If you handle Controlled Unclassified Information for a Department of Defense prime, hold a federal civilian contract that touches FCI, or sit anywhere in the Defense Industrial Base supply chain, your cyber posture is no longer just a security question. It is a contract eligibility question, a False Claims Act question, and an export-control question all at once. We work with companies that have already been hit by all three.
The defense buyers we talk to every week are running engineering shops, machine shops, software teams, integration vendors, R&D suppliers, IT subcontractors, and professional services firms feeding Fort Liberty, Camp Lejeune, Cherry Point MCAS, Seymour Johnson AFB, MCAS New River, the SOFWERX ecosystem, and the broader RTP federal civilian footprint. They share three traits: a prime contract requirement they can read but cannot operationalize, a 90-day flow-down notice in the inbox, and a leadership team that knows non-compliance is now an existential business problem.
Lockheed, RTX, Northrop, BAE, GD, L3Harris, and the second-tier integrators are pushing CMMC 2.0 expectations down their supply chain ahead of the official rule clock. You have one quarter to produce an SSP, an SPRS score, and a defensible POAM or you lose the work.
SAM.gov contracting officers are pulling the Supplier Performance Risk System score before they award. A blank score, a stale score from 2024, or a self-assessment with implausible "implemented" answers all kill the bid before it gets to price.
DCMA reviewers and prime-led pre-award assessments compare your stated SPRS score to your control evidence. A 110 implementation claim with 35 unimplemented controls is a False Claims Act exposure, not a paperwork mismatch.
ITAR and EAR limit who can touch defense articles and technical data. Offshore IT, foreign nationals on the network, and unscoped cloud admins all create reportable violations. Most contractors discover this during their first audit.
Why nation-state actors target your supply chain
The Defense Industrial Base is the persistent number-one target of state-sponsored cyber actors. APT groups attributed to China (APT41, APT10, MUSTANG PANDA), Russia (APT28, APT29), Iran (APT34, APT35), and North Korea (Lazarus, APT37) hunt CUI with patience that small commercial businesses rarely encounter. They do not phish for crypto-clipper paydays. They want your CAD files, your test data, your contract specs, your supplier list, your engineering change orders, and the credentials of the engineer cleared to read all of it.
The damaging campaigns of the last several years (SolarWinds, MOVEit, Sunburst-derivative supply chain attacks, the wave of compromises against Tier 2 and Tier 3 DIB suppliers, and the steady drumbeat of MSP intrusions used to pivot into defense customers) all share the same playbook: compromise the smallest reachable supplier, dwell quietly, and exfiltrate enough technical data to short-circuit a foreign program. Pre-award due diligence has tightened in response. Primes now ask for evidence, not attestations. The federal civilian agencies (DHS, DOE, GSA) are following the same path under NIST SP 800-53 alignment requirements.
Petronella Technology Group runs incident response engagements every quarter that involve at least one DIB supplier breach. The pattern is consistent: a Tier 3 subcontractor with a flat network, a single MSP with offshore admins, no network forensics capability, and no segmented enclave for CUI. By the time their prime calls them, the dwell time is measured in months. Our work as data breach forensics investigators on these cases informs every assessment we run for defense contractors today.
CMMC, NIST, DFARS, ITAR: what actually applies to you
Federal cyber compliance is a stack, not a checklist. Each layer answers a different contract question, and missing one collapses the others. We map every client to the layers that actually apply (most contractors carry three or four simultaneously) so the program covers eligibility without paying for capability you do not need.
CMMC 2.0 Levels 1, 2, and 3
Level 1 covers Federal Contract Information with 17 basic safeguarding practices and an annual self-assessment plus an executive affirmation in SPRS. Level 2 applies whenever you handle CUI: 110 NIST SP 800-171 Rev 2 controls plus a triennial third-party assessment by a C3PAO, with annual affirmations in between. Level 3 sits on top of Level 2 for the most sensitive programs (a subset of NIST SP 800-172 enhanced security requirements) and requires a government-led DIBCAC assessment. We support readiness work across all three, including the few clients staring down a Level 3 trigger.
CMMC compliance overviewDFARS 252.204-7012, -7019, -7020, -7021
The 7012 clause requires "adequate security" (NIST SP 800-171 Rev 2 today, transitioning to Rev 3) plus a 72-hour incident report to DoD via DIBNet and 90-day media preservation. The -7019 clause requires SPRS posting. -7020 forces government access for verification. -7021 introduces the CMMC requirement directly into solicitations. If you have read your contract and are not sure which clauses you are bound by, that is exactly the conversation we have on the first call.
Map your DFARS exposureNIST SP 800-171 Rev 2 and Rev 3
Rev 2 (110 security requirements across 14 families) is the active baseline for CMMC Level 2. Rev 3 (97 requirements, restructured, with new families and a tighter privacy overlay) becomes the assessment standard on the published transition timeline. We build SSPs to Rev 2 today with explicit Rev 3 traceability so your evidence stays usable when the standard rolls forward.
NIST 800-171 service pageNIST SP 800-53 + FISMA + FedRAMP
Federal civilian contractors (GSA, DHS, DOE, VA, IRS, USDA suppliers) usually fall under NIST SP 800-53 control baselines, FISMA Moderate or High, and FedRAMP-authorized cloud requirements when CUI is in the cloud. We map these against your DoD obligations so a single control set carries multiple authorities.
NIST 800-53 controlsITAR & EAR for Technical Data
If your CUI includes export-controlled technical data (USML categories or EAR 600-series items), you carry an additional layer of access control: U.S.-person-only access, geofencing, no offshore admin, and explicit authorization for foreign nationals. ITAR violations carry criminal penalties; the SEC Section 38 of the Arms Export Control Act is not a paperwork problem.
SPRS scoring & FCA exposure
The 2022 DOJ Civil Cyber-Fraud Initiative made False Claims Act enforcement against contractors with overstated SPRS scores a stated priority. Our SPRS work is conservative on purpose: every "implemented" answer maps to evidence we can show a DCMA reviewer or DoJ investigator without the answer changing.
Defense subcontractors and federal suppliers across North Carolina
Most of our defense work sits in the Tier 2 and Tier 3 supplier band: companies that take subcontract awards from Lockheed, RTX, Northrop, GD, BAE, L3Harris, Booz Allen, Leidos, and SAIC, plus the dozens of smaller integrators flowing work down. Our clients build, design, machine, software-engineer, integrate, test, transport, and consult on defense systems. Their employee counts run from 8 to 800. Their CMMC obligation runs from Level 1 (basic FCI) to Level 2 (the bulk of CUI work) to a small but rising Level 3 trigger for cleared programs.
Special operations support, language services, soldier-systems integrators, and engineering subs supporting USASOC, JFKSWCS, and 18th Airborne Corps program offices.
Aviation MRO, expeditionary logistics, marine systems engineering, and II MEF program suppliers with active DCMA oversight on their CUI handling.
Avionics, ground support equipment, propulsion, and survivability vendors carrying DFARS clauses and ITAR-flagged technical data.
EPA, NIH, USGS, NASA, and DOE national-lab contractors operating in Research Triangle Park under NIST SP 800-53 baselines.
MAS contractors, 8(a) small businesses, SDVOSBs, and HUBZone firms with multi-agency BPA exposure.
Architecture-engineering joint ventures, civil engineering subs supporting USACE, and design-build firms feeding NAVFAC and AFCEC. See our engineering-firm work.
Why federal contracting officers take our calls
Pre-award due diligence is now part of the buying process, and your cybersecurity partner sits inside that diligence package. Petronella Technology Group earned credentials that matter to the people writing the contracts and reviewing the responses, not just the buyers comparing logos.
Three conversations we have every week
"Lockheed gave us 90 days to provide a CMMC L2 readiness plan or we lose the program."
This is the most common opening call. We start with a same-week scoping conversation, define the CUI boundary, run a focused gap assessment against NIST SP 800-171 Rev 2 controls, produce an SSP and POAM that satisfy the prime's pre-award reviewer, and post a defensible SPRS score. The work fits inside the 90-day window when started on day one.
"We bid on a SAM.gov solicitation and the CO disqualified us for a missing SPRS score."
SPRS is now a gating field, not a follow-up. We help contractors stand up an honest self-assessment in two to four weeks, post the score, and then build the remediation plan that supports the next bid cycle. We do not push contractors to inflate scores to win the next opportunity. False Claims Act exposure costs more than the contract.
"Our pre-award DCMA review found 30 control gaps. We have six weeks to close them."
We triage by SPRS impact (negative-value controls hurt your score most), focus the engineering team on the technical controls that move the score, and produce evidence packages auditors accept. Six weeks is tight. Eight weeks is realistic. We will tell you which gaps cannot be honestly closed in your window and how to position the POAM so the prime keeps you in the running.
"We are exporting controlled technical data and our outsourced IT is overseas."
This is an ITAR violation in progress. We help repatriate administration, lock the network to U.S.-person access, set up the enclave so the IT layer cannot see the controlled data, and produce a corrective action plan you can show DDTC if the regulator surfaces. We have run this engagement enough times to know how the disclosure conversation goes.
Want to see exactly what we deploy?
This page is the buyer-identity view. If you want the technical deliverable detail (CUI Enclave Reference Architecture, SSP authoring service, POAM management, SPRS scoring uplift, DFARS 7012 incident reporting workflow, and the per-CMMC-level deliverable matrix) those live on the deliverable companion page. Same firm, deeper technical layer.
See the federal-contractor stack we deploy →Defense contractor cybersecurity questions
Do I need CMMC Level 1, Level 2, or Level 3?
Read your contract. If you handle only Federal Contract Information (FCI) without any CUI markings, Level 1 (annual self-assessment, 17 controls) is your obligation. If you handle Controlled Unclassified Information at any point in the contract, Level 2 (110 controls, triennial C3PAO assessment) is the floor. Level 3 (additional NIST SP 800-172 enhanced controls, government DIBCAC assessment) is rare and reserved for the most sensitive programs. We do a contract-clause review on the first call so the answer is not a guess. CMMC overview.
How long does CMMC Level 2 readiness take?
For a contractor with no prior NIST SP 800-171 work, six to twelve months is realistic, with most of that spent on technical control implementation, evidence collection, and policy production. Contractors already running aligned controls can compress to three to six months. We will not promise twelve weeks for a from-scratch L2 program. The C3PAO will see through it and your prime will too.
Are you a C3PAO? Can you give us our certification?
No. CMMC certification (the third-party assessment that issues the certificate) must be performed by a Certified Third-Party Assessment Organization, and the rule prohibits the same organization from doing both readiness work and the assessment for the same client. Petronella Technology Group is a Registered Provider Organization (RPO #1449), which is the role designed for the readiness, gap-assessment, SSP authoring, and remediation work that gets you to assessment-ready. We hand off to your chosen C3PAO when the program is ready.
What is the difference between SPRS, NIST 800-171, and CMMC?
NIST SP 800-171 is the security control standard. SPRS (Supplier Performance Risk System) is the DoD database where you post a numeric score representing your implementation level against those controls. CMMC is the certification framework that requires an independent third party to verify the score for Level 2 and government to verify it for Level 3. Same controls, three different audiences for the answer.
What happens to my SPRS score if I am not fully implemented?
Each unimplemented control deducts points (1, 3, or 5 depending on weight) from a starting score of 110. Negative scores are common for contractors with no prior 800-171 work. The honest SPRS score plus a credible POAM with realistic milestone dates is a far better answer than an inflated 110 that cannot survive a pre-award review. Contracting officers and primes have learned to read the difference.
What is the 72-hour incident reporting clock under DFARS 7012?
If you have a "cyber incident" affecting CUI, you report it to DoD via DIBNet within 72 hours of discovery. You also preserve forensic media for at least 90 days. Most contractors discover during the breach that they have no incident response runbook, no DIBNet account, and no forensic capability. Our DFARS 7012 readiness work covers all three (runbook, DIBNet enrollment, forensic playbook) before the call to DC3 ever happens. Data breach forensics.
Do you work with federal civilian contractors or only DoD?
Both. Federal civilian (GSA, DHS, DOE, NIH, EPA, USDA, NASA) work usually maps to NIST SP 800-53 control baselines plus FISMA categorization, and FedRAMP requirements when the data sits in the cloud. Many of our DIB clients also carry civilian-side awards, and we run unified compliance programs that satisfy both authorities from a single control set.
We do ITAR work. Can you support that?
Yes, with the caveat that ITAR is not the same conversation as CMMC. ITAR adds an export-control overlay (U.S.-person-only access, technical-data segregation, no offshore admin, geofencing, foreign-national authorization). We design CUI enclaves with ITAR controls baked in, and we audit existing environments for the violations most contractors do not realize they carry (offshore MSPs being the most common). We do not provide DDTC legal advice; for the registration and licensing side we coordinate with your trade-compliance counsel.
Are you in Raleigh? Do you travel to my facility?
Yes to both. Petronella Technology Group is headquartered at 5540 Centerview Dr., Suite 200, Raleigh, NC 27606. Most of the technical work runs remote with periodic on-site visits during boundary-definition, evidence-collection, and pre-assessment phases. For Fort Liberty, Camp Lejeune, Cherry Point, and Seymour Johnson supplier work, on-site is the norm. We travel for clients across the Carolinas and nationwide.
Adjacent services for federal contractors
CMMC Compliance Pillar
Levels 1, 2, and 3 readiness program detail.
NIST SP 800-171
Rev 2 control implementation and Rev 3 transition planning.
NIST SP 800-53
Federal civilian baseline and FedRAMP-aligned controls.
Data Breach Forensics
DFARS 7012 incident response and 90-day media preservation.
Network Forensics
Lateral-movement reconstruction for DIB intrusion investigations.
Engineering Firms
Defense-aligned A/E and design-build supplier cybersecurity.
Deliverable View →
The companion page: stack, enclave architecture, deliverables.
All Industries
Other regulated verticals we serve.
Bring us your contract clause and we will tell you what compliance really costs
Forward the DFARS clause, the flow-down notice, or the SPRS request from your prime. We will read it, scope the work honestly, and quote a CMMC readiness path that fits your timeline and budget. No marketing fluff and no inflated SPRS scores.
Petronella Technology Group · 5540 Centerview Dr., Suite 200, Raleigh, NC 27606 · CMMC RPO #1449 · BBB A+ Since 2003