Case 00 — inDirectIT itself
Before we sold the method, we ran it on ourselves. Our SSP, our POA&M, our evidence package, our GCC High tenant — assessed under CMMC Level 2 (32 CFR Part 170), the same way yours will be. The certification isn't a badge on a slide; it's the operating environment this firm runs in, renewed continuously under our own managed-compliance discipline.
Read Case 00 in full — what we assessed and why it changes your engagement
Case 01 — Allyon: CMMC Level 2, June 2026
The engagement: Allyon ran the full Factory sequence — gap assessment and boundary definition through SSP and POA&M development, evidence collection, and mock-assessment preparation — to its own CMMC Level 2 certification in June 2026. A cross-functional, company-wide effort, executed on the same runbook we ran on ourselves, closing at 110/110.
"Achieving CMMC Level 2 certification was a cross-functional, company-wide effort that required disciplined execution across every control. inDirect IT was an outstanding partner throughout the entire journey — from gap assessment and boundary definition through SSP/POA&M development, evidence collection, and mock assessment preparation. Their practitioner-led approach, deep Microsoft GCC High and Azure Government expertise, and commitment to objective-level evidence made the difference. We couldn't have hit 110/110 with the same confidence without them. Highly recommend inDirect IT to any defense contractor serious about building a defensible, operational compliance program."
Read Case 01 in full — the four stations, station by station
What made the difference
- Boundary before budget — scope defined and verified at Station 01, so remediation spend landed only on systems that belonged in the assessment.
- SSP from the live environment — documentation written against real configuration, which is why it held up under assessor testing.
- Objective-level evidence — artifacts organized the way a C3PAO tests, not the way a binder is organized.
- The mock-assessment gate — findings surfaced and closed internally before the certification window, so assessment week held no surprises.
Your name could be Case 02. The runbook is fixed; the input is your environment. Start with a gap assessment or a strategy call.
Put a certification on this page.
Tell us where your program stands and a practitioner will map the path from your current state to a defensible certification. Or email rj@indirectit.com directly.