PM2NET used a phased cybersecurity and infrastructure modernization approach that addressed governance, compliance, cloud architecture, and technical controls together.

Security Policy and Governance

PM2NET developed and reviewed security policies and supporting documentation aligned with CMMC requirements. Coverage included:

• Access control

• Security awareness

• Incident response

• Identification and authentication

• Media protection

• Personnel security

• Risk assessment

• Configuration management

• Physical protection

• System and information integrity

• Data classification

• Information flow control

A roles and responsibilities matrix was also established to clarify ownership and accountability for security requirements.

CMMC Gap Assessment

PM2NET used CMMC control checklists to review areas including access control, awareness and training, identification and authentication, risk assessment, system and communications protection, and audit and accountability.

The assessment helped identify gaps between existing practices and the controls needed to support CMMC readiness.

Secure Cloud Infrastructure

PM2NET supported the procurement and configuration of a Microsoft Azure Government GCC High environment. The work included:

• GCC High tenant procurement

• Credential and tenant configuration

• Domain configuration

• Subdomain integration

• Domain verification support

• Microsoft support escalation

• Troubleshooting tenant and validation issues

This established a secure cloud foundation intended to support government-related collaboration and Controlled Unclassified Information requirements.

Infrastructure Hardening

PM2NET strengthened technical controls within the existing environment by:

• Configuring systems and CGI shares for required log retention

• Implementing Security Group Policies

• Strengthening access-control configurations

• Assessing VPN infrastructure

• Investigating two-factor authentication options

This work helped connect documented security requirements with practical controls in the operating environment.

Security Awareness and User Enablement

PM2NET identified a security awareness training platform and initiated training activities for the initial user group. The effort supported employee understanding of cybersecurity responsibilities and reinforced the broader CMMC readiness program.

Data Flow and Security Architecture

PM2NET developed data architecture and CUI flow diagrams to document how sensitive information moves through the environment.

The team also assessed whether existing infrastructure could satisfy encryption and classification requirements or whether additional reliance on GCC High would be necessary.

Result

The engagement established a stronger cybersecurity and infrastructure foundation for the manufacturing organization.

The organization gained a structured documentation and control framework aligned with CMMC Level 2 and Level 3 considerations, along with a clearer roadmap for addressing remaining gaps. Technical safeguards around access, logging, governance, and incident response were strengthened, while the GCC High implementation created a foundation for secure cloud collaboration involving sensitive information.

Defined security responsibilities improved accountability, and security awareness activities helped users better understand their role in supporting the organization’s compliance objectives.

Key Outcomes

• Established a structured CMMC readiness framework

• Strengthened access, logging, and security governance controls

• Created a secure Azure Government GCC High foundation

• Clarified CUI data flows, classification, and protection needs

• Improved security ownership and audit preparation

• Initiated security awareness training for users