CMMC Foundation case studies
CMMC Foundation · Put your knowledge to work in context.
The CMMC Foundation credential is an entry-level certificate about the Cybersecurity Maturity Model Certification ecosystem, the framework used to manage digital risk across the defense industrial base (DIB). This independent study page is for candidates who want a plain-language orientation before committing to a deeper CMMC role, such as assessor, practitioner, or instructor. The CMMC Foundation case studies are 5 cases and about 3,930 words.
1The Nine-Month Fix and the 180-Day POA&M Window
Northline Optics is a 240-employee manufacturer holding a $14M DoD prime contract for optical assemblies. Engineering drawings and acceptance test data marked CUI sit on a shared file server and on twelve engineering workstations.
898 words, about 4 min2Two Contracts, Two Clocks: Phase-In at Award and at Option
Halcyon Analytics is a 60-person data analytics firm. In February 2026 it wins a $9M DoD contract with a one-year base period and four one-year options; the solicitation includes DFARS 252.204-7021 and specifies CMMC Level 2 with a C3PAO assessment.
800 words, about 4 min3The Consultant Who Wanted to Grade Her Own Work
Ridgeline Advisory is a 30-person security consultancy. It is a CMMC Registered Practitioner Organization and has spent 14 months helping a client, Cascade Fabrication, build its Level 2 program: writing the system security plan, configuring the enclave, and running mock assessments.
793 words, about 4 min4The Flow-Down That May Not Apply
Treeline Machine Works is a 35-person job shop that mills aluminium housings for a Tier 1 prime, Kestrel Systems. The purchase order includes a flow-down clause requiring Treeline to achieve CMMC Level 2 certification within 12 months and to provide a certificate to Kestrel.
821 words, about 4 min5Who Is Actually Inside the Assessment Boundary?
Meridian Engineering is a 90-person firm with CUI in two places: a cloud PLM tool where customer design data lives, and the laptops of 40 engineers who occasionally download drawings. The PLM vendor holds a FedRAMP Moderate authorization.
618 words, about 3 min