SEP

The Pentagon suspended CMMC Phase 2 mandatory third-party assessments in July 2026, but the underlying cybersecurity obligations — DFARS 252.204-7012, NIST SP 800-171, and government-led DIBCAC assessments — remain in force. SEP’s leadership pursued certification before the suspension, recognizing that independently verified compliance would distinguish the company from competitors regardless of the program’s timeline. With many contractors now using the pause as a reason to delay, SEP’s early investment in certification has become an even stronger differentiator.

The company began with an internal enterprisewide gap assessment revealing the need for an enclave. SEP sought the assurance of outside expertise to interpret the requirements and execute the implementation on an aggressive timeline. A team conducted a structured evaluation, interviewing potential partners against a defined set of selection criteria.

CyberSheath stood out for its experience in the defense industrial base and its experience preparing clients for assessments with A-LIGN, the CMMC Third-Party Assessment Organization (C3PAO) SEP had selected to conduct its assessment. That familiarity gave SEP’s leadership confidence that CyberSheath understood what A-LIGN’s assessors would expect and could prepare accordingly.

Adhering to NIST framework, CyberSheath designed and implemented the compliance program for SEP’s secure enclave, defining the security controls, access policies, and system configurations needed to meet CMMC standards. The enclave was scoped specifically to SEP’s defense operations, ensuring the company’s commercial work across pharmaceuticals, agriculture, manufacturing, and engineering could continue without disruption. SEP’s technical team supported key elements of the implementation, and both organizations operated under a shared responsibility model that reflected each party’s ownership of specific tools, systems, and infrastructure.

The engagement was a shared effort, with SEP’s technical team taking on significant portions of the implementation rather than relying solely on CyberSheath to manage the environment. CyberSheath adapted its processes to accommodate SEP’s operational preferences and technical capabilities, working through the details of a shared responsibility matrix that defined which party owned which controls. The enclave provided a secure environment for CUI handling while preserving SEP’s existing workflows and operations.