RESTON, Va. — Nov. 4, 2025 — CyberSheath, the largest CMMC managed service vendor, partnered with Kampi Components Co., Inc., a leading military distributor, to achieve CMMC Level 2 certification after addressing complex challenges involving multiple managed service providers. The certification comes as a recent Cyber AB town hall highlighted ongoing confusion about external service provider compliance requirements across the defense industrial base.
Kampi’s certification followed an unannounced DIBCAC High assessment that revealed compliance gaps requiring immediate remediation. During the assessment, CyberSheath identified that several of Kampi’s managed service providers were not meeting applicable cybersecurity requirements. Based on their access and functions within the environment, these providers were determined to operate as external service or cloud providers. To support a compliant CMMC Level 2 outcome, such providers must adhere to applicable NIST SP 800-171 requirements and, if handling Controlled Unclassified Information (CUI) in the cloud, maintain FedRAMP Moderate authorization or an equivalent level of protection.
“When service providers touch CUI environments but lack required attestations and controls, they become weak links in the supply chain, creating risks and roadblocks that can derail certification for their upstream customers,” said Emil Sayegh, CEO of CyberSheath. “Our team partnered with Kampi to map and validate every one of their providers’ access, remove or replace noncompliant services, and deploy compliant alternatives, all without interrupting operations. That is the difference between a vendor and a partner. It is how our clients achieve CMMC Level 2 and strengthen their supply chains.”
CyberSheath’s gap assessment aligned closely with the DIBCAC High assessment findings, establishing a clear compliance roadmap that addressed cloud migration, service provider remediation, and comprehensive physical security controls across Kampi’s distribution facility in Fairless Hills, Pennsylvania.
“CyberSheath became a true extension of our team throughout this process,” said Penny Jackson, Information Technology Operations Security & Compliance Manager at Kampi Components. “When we discovered the extent of our service provider challenges, our partners at CyberSheath rolled up their sleeves and worked alongside us to solve them. Through their managed compliance and security services, they provided hands-on remediation, day-to-day guidance, and continuous monitoring. Their expertise and ongoing managed support gave us confidence that we were making the right decisions for our business while meeting every compliance requirement.”
The certification assessment was conducted by Cybersec Investments, a Certified Third-Party Assessor Organization (C3PAO). The certification ensures Kampi can continue serving its defense contractor customers as CMMC requirements take effect across Department of Defense contracts.
Learn more about how CyberSheath helps defense contractors achieve CMMC compliance.
About CyberSheath
Established in 2012, CyberSheath is one of the most experienced and trusted IT security services partners for the U.S. defense industrial base. From CMMC compliance to strategic security planning to managed security services, CyberSheath offers a comprehensive suite of offerings tailored to clients’ information security and regulatory compliance needs. Learn more at www.cybersheath.com.
About Kampi Components Co.
Kampi Components Co., Inc. is a military parts distributor based in Fairless Hills, Pennsylvania. Founded in 1984, Kampi provides distribution and logistical support for government and defense contractors, including procurement, inspection, testing, packaging, and transportation of military equipment and replacement parts. Learn more at https://kampi.com/.
Contact
CyberSheath
Kristen Morales
Kristen.Morales@cybersheath.com
Lexie Capperella
Gregory FCA for CyberSheath