Education Services

Education Services’ path to CMMC certification started with a different challenge. The company was concerned with data collection from Microsoft products sitting in the cloud and wanted to migrate to GCC High for privacy assurance. Leadership recognized that achieving full, documented compliance with NIST SP 800-171 and DFARS 252.204-7012, formalized through CMMC Level 2 certification, would be even more valuable.

The timing proved fortunate. A few months after Education Services contracted with CyberSheath, the CMMC Program Rule was published, establishing the rules and phase-in schedule for mandatory Level 2 assessments. Within weeks, its prime contractor imposed the flow-down requirement on contracts supporting programs of record. Education Services was already well into the compliance process by then. By contracting with CyberSheath, the company gained access to a full team of specialists instead of hiring a single IT generalist. 

CyberSheath migrated Education Services into GCC High and deployed management and monitoring tools across the company’s environment, taking on IT operations responsibilities that had previously been handled internally. The engagement covered the full enterprise rather than an enclave, which the company’s structure required since its work doesn’t segregate cleanly enough to isolate controlled unclassified information in a separate environment.

An initial gap assessment showed that the biggest area of improvement was documentation, creating the necessary policies and procedures in the required format. But there were also areas where CyberSheath engineered new technical solutions to close compliance gaps.

The implementation had to account for several complicating factors beyond a standard IT migration. Education Services operates a physical facility where CUI may be present. The company uses specialized photography, video, and printing equipment that had to be brought into the compliant environment. And because only some of its work falls under CUI and ITAR regulations — other projects serve commercial and international markets — the company needed a way to accommodate file exchange of unregulated materials alongside its controlled environment.

One of the company’s priorities throughout the process was avoiding overcommitment. Drawing on experience with other compliance frameworks like SOX, PCI DSS, FERPA, and GDPR, the company’s founder was wary of consultants guiding organizations to declare commitments to expensive and unnecessary controls that were never required until the company put them in its own documentation.