CMMC Level 2 program leadership for defense construction contractors
A CMMC program that moves from jobsite to jobsite.
Construction projects start, mobilize, build and close out, and your CUI boundary has to do the same. We run the program from first gap assessment to whichever assessment your contract requires, built around that cycle. Capital Cyber, based in Leesburg, Virginia, provides CMMC Level 2 program leadership for defense construction contractors and works on-site across Northern Virginia.
For construction contractors with a Level 2 requirement and projects that each bring marked drawings to a new site.
Why does a construction program need a mobilization checklist?
Because every new project creates new places for CUI. A trailer, a network connection, a plotter, a few tablets and a set of trades all appear within weeks of award. If the program only covers the office, each project quietly sits outside it.
Part of program leadership is building the repeatable step: what gets set up at mobilization, who checks it, and what evidence is kept. Then each project starts inside the boundary instead of being pulled into it later.
What gets fixed first?
Whatever lets marked drawings travel without control. In construction that is usually tablets and phones that are not enrolled in device management, plan-sharing platforms nobody has checked against FedRAMP Moderate equivalence, printed sets with no storage or destruction routine, and shared trailer laptops with one login.
Shared logins deserve their own mention. A single account on the trailer laptop means no one can tell who opened which drawing, and individual accountability is a basic expectation in the audit requirements.
How is evidence kept when the jobsite is gone?
A trailer that closes out takes its paper trail with it unless someone collects it first. Visitor logs, destruction records for printed sets, device returns and account removals for trade staff all need to come back to the office.
We organize evidence control by control, with project closeout treated as a step that produces evidence rather than a step that loses it.
Where do the trades fit into the program?
They sit just outside your boundary, but what you send them is inside it. The program tracks which trades receive marked drawings on each project and what the subcontract requires of them, so that flow-down is part of the work rather than an afterthought at award.
Which requirements does this touch?
NIST SP 800-171AU.L2-3.3.2
User Accountability
Actions on systems holding drawings can be traced to one person. On a jobsite that means individual accounts on trailer laptops and the plan platform, not a shared site login. Evidence is the account list and logs showing named users.
CM.L2-3.4.1
System Baselining
A baseline configuration and inventory that includes jobsite equipment: tablets, trailer laptops, plotters and network gear. Evidence is the inventory updated at mobilization and closeout.
MP.L2-3.8.5
Media Accountability
Printed marked sets and drives that travel from office to site stay accounted for in transit. Evidence is a sign-out record for sets leaving the office and a destruction record when they come back or are disposed of on site.
AC.L2-3.1.18
Mobile Device Connection
Only approved, enrolled tablets and phones reach the platform holding marked drawings. Evidence is the device management report and the conditional access rule that blocks unenrolled devices.
What do you receive?
SCOPED PER CLIENTA scoped CUI boundary, written down
Covering the office, each active jobsite, and the platforms where marked drawings live.
A remediation sequence
Starting with the paths marked drawings already travel without control: mobile devices, platforms and printed sets.
Evidence collection started early
Including jobsite records that would otherwise be lost at closeout.
An evidence package organized control by control
Ready for whichever assessment your contract requires.
Support through the assessment
We prepare you for it and support you through it. We do not perform it.
What does this service not include?
We prepare you for the assessment; we do not perform it, and a self-assessment does not produce a certification. Whether we attend a C3PAO assessment is between you and the C3PAO, and we are not an Authorized C3PAO ourselves.
The full service, for any industry: CMMC Level 2 program leadership. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Where does program leadership start for a construction contractor?
With a gap assessment, the $5,000 published one if you do not have a recent one, covering your office and at least one active jobsite. If you have recent findings, the program starts from them.
Do you visit jobsites?
We are based in Leesburg and work on-site across Northern Virginia. Whether a jobsite visit is part of the program is agreed when the work is scoped.
Will you perform our CMMC assessment?
No. We are not an Authorized C3PAO. Program leadership prepares you for whichever assessment your contract requires and supports you through it. A self-assessment does not produce a certification.
What happens when a new project starts mid-program?
It goes through the mobilization step: what information it brings, which sites and trades it involves, and what equipment is set up. The boundary and documents are updated before marked drawings reach the new site.
More for defense construction contractors
CMMC Level 2 program leadership in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.