Liberty Business Associates
Earns CMMC Level 2 certification with A-LIGN and CyberSheath.
CASE STUDY
Client
Liberty Business Associates is a Woman-Owned Small Business (WOSB) delivering professional, technical, logistics, and business operations services to government and commercial clients across the Southeast and Midwest, including more than a decade of continuous prime contractor support to Army and Navy customers.
As a trusted partner in the defense supply chain, Liberty recognized that earning Cybersecurity Maturity Model Certification (CMMC) Level 2 would be a defining step in protecting the controlled unclassified information it handles and unlocking new business opportunities that increasingly require certified suppliers. To achieve certification, Liberty selected A-LIGN as their trusted CMMC Third-Party Assessor Organization (C3PAO) and CyberSheath as their CMMC readiness partner.
Situation
Liberty has pursued compliance with NIST SP 800-171 for more than a decade, completing three previous iterations of compliance work along the way. When CMMC was announced, Liberty’s leadership team made an intentional decision: rather than wait, Liberty would pursue certification as early as possible to position themselves ahead of competitors when contracts requiring Level 2 certification came to market.
To kick off the preparation process, Liberty selected CyberSheath to prepare its environment and processes, operationalize required controls, and establish a sustainable compliance program. With deep expertise in CMMC and long track record of supporting customers across the defense industrial base, CyberSheath was an obvious choice early in Liberty’s competitive evaluation process. Their customer and compliance support proved to be best in class throughout the engagement, providing a comprehensive readiness program with a repeatable, defensible cybersecurity operating model that supports long-term compliance sustainability.
The path to get certified, however, was not something a small business could navigate alone. Liberty was then tasked with selecting their authorized C3PAO to conduct their first CMMC assessment.
For Liberty, selecting an audit provider with the right credentials, process discipline, and auditor support was critical to making certification attainable without an in-house compliance team.
Process
Liberty’s C3PAO selection process included three highly recommended audit providers. From the start of the quoting process, A-LIGN stood out for being highly engaged, responsive, and clear about expectations — setting the tone for what would become a fruitful working relationship and partnership.
A-LIGN’s decades of federal experience and established reputation as a proven audit partner gave Liberty assurance that its first CMMC certification was in capable hands.
From day one, Liberty found that A-LIGN’s expert team provided clear goals and objectives, with timely and consistent communication throughout their CMMC engagement. The process moved forward predictably, and on the rare occasions an issue surfaced, the A-LIGN team resolved it quickly and professionally.
The combination of CyberSheath’s readiness work helped set the company up for success and A-LIGN’s structured assessment approach gave Liberty confidence that certification was achievable on schedule.
Liberty ultimately chose A-LIGN as its C3PAO based on three key factors:
- The best overall value among the C3PAOs evaluated
- Ease of access and consistent communication with their account and audit teams
- A detailed, well-defined certification process from kickoff through final assessment
“We chose A-LIGN because they’re the market leader in federal compliance. We needed an audit provider with deep expertise to guide us through our first CMMC assessment, and they provided a top-notch certification experience.”
– Dean Fowler, SSO, Liberty Business Associates
Results
With A-LIGN as their trusted C3PAO, Liberty achieved CMMC Level 2 Certification — a milestone that places the company among the first organizations of its size qualified to pursue new business at this level.
The value of CMMC extends well beyond contract eligibility. In an environment where data breaches and supply chain attacks pose ongoing threats to national security, third party-validated certification is a powerful signal that an organization takes its responsibility to protect Controlled Unclassified Information (CUI) seriously. For Liberty’s customers, primes, and partners across the DIB, it confirms that the security practices required to safeguard sensitive federal data are not only in place, but operationalized — strengthening trust, deepening relationships, and differentiating Liberty in a market where security maturity is increasingly a precondition for doing business.
“As a small business, we couldn’t navigate CMMC certification alone. Selecting CyberSheath as our readiness partner and A-LIGN as our trusted C3PAO made our very first — and successful — CMMC certification attainable with their deep federal experience and expertise.”
– Beth Robertson, President, Liberty Business Associates
In addition to certification, Liberty walked away with a defensible, well-documented compliance posture aligned to NIST SP 800-171 and CMMC Level 2, long-term partners in A-LIGN and CyberSheath who understand its environment and goals, and a strong foundation for future cybersecurity milestones.
That foundation is already in motion. With ISO certification on the horizon, Liberty plans to engage A-LIGN again as its audit partner of choice, while CyberSheath continues to support ongoing monitoring and annual recertifications. Backed by A-LIGN’s federal expertise, a small DIB business has successfully navigated one of the most demanding certifications in its market — and is ready to grow.
This case study was originally published by A-LIGN: Liberty Business Associates earns CMMC Level 2 certification with A-LIGN and CyberSheath