Want to learn more about our services? Book a free introductory call - "Here"
Case Studies
Drawing the CUI Boundary for a German-Owned U.S. Supplier
When a German-owned manufacturer picks up its first DoD subcontract, the CMMC flow-down clause often surfaces after the ink is dry, and the instinct is to assume the entire facility is in scope. This case study walks through how disciplined, bilingual CUI boundary scoping narrows that down to what actually matters: the specific systems and production areas that touch Controlled Unclassified Information, not the whole company.
Finding the ITAR Line in a German-Owned U.S. Supplier
When a German-owned manufacturer receives its first defense subcontract, familiar ways of sharing drawings with headquarters can raise new export control questions. This illustrative case study follows a supplier as it maps where technical data could go, who could access it, and how to design practical controls for its U.S. and German teams - with export control counsel handling the legal determinations.
CMMC Level 1 for Construction Contractors: From Jobsite to Self-Assessment
When a small construction contractor pursues its first defense subcontract, cybersecurity requirements become part of the job. This fictional case study follows the company as it identifies Federal Contract Information in office and field workflows, addresses gaps in everyday safeguards, and gathers evidence for its CMMC Level 1 self-assessment- showing why written policies alone are not enough.
Preparing a German-Owned Supplier for a TISAX® AL3 Assessment
When a Tier 1 automotive customer requires TISAX® labels before releasing more prototype work, a German-owned Michigan supplier discovers that preparation goes far beyond locks and IT settings. This fictional case study follows a 45-person company as it traces prototype parts and sensitive drawings through production, shared systems, and outside vendors. It shows how a practical gap assessment turns everyday weaknesses into a prioritized readiness plan, with clear responsibilities for the U.S. site and concrete decisions for its German parent.