MacDonald-Miller is now certified at CMMC Level 2, the Department of Defense standard for contractors that handle Controlled Unclassified Information. We earned it through an independent assessment against all 110 security controls in NIST SP 800-171, conducted by an accredited third-party assessor. As far as we are aware, we are the only mechanical contractor in the Pacific Northwest that holds it. 

CMMC is how the Department of Defense verifies that its contractors protect sensitive government information rather than simply saying they do. Level 2 is the tier for Controlled Unclassified Information, which covers technical drawings, system layouts, equipment data, and schedules that aren’t classified but are still controlled for good reason. 

Reaching it is not a self-graded checklist. An accredited assessor organization, authorized through the Cyber AB, evaluated us against all 110 controls. The assessment process and the annual affirmation that follows are written into federal regulation at 32 CFR Part 170.

Only a few hundred organizations of any kind have reached Level 2 so far, against an anticipated eighty thousand that will eventually need it. 

Mechanical work on vessels and in shipyards arrives with an extensive amount of controlled information. Ship drawings, system layouts, equipment specifications, and the schedules attached to them are frequently CUI, and the rules governing that data do not soften because the scope happens to be piping or HVAC.

In practice, that has left program offices, primes, and shipyard facility teams choosing between the contractor who knows the mechanical work and the contractor cleared to hold the information.

We do this work ashore and afloat, and we can now hold the data while we do it. For a facility team planning mechanical work on a controlled site, or a prime assembling a team for a vessel package, that removes a real constraint from the front end of the job. The same is true in Mission-Critical and data center work, where customers require their partners to safely handle information long before anyone signs a contract.

We finished this work at a moment when nobody was forcing us to. In July, the Department of Defense suspended the Phase 2 transition that would have made third-party Level 2 certification mandatory on most CUI contracts, to further evaluate how to improve the program. Certifications issued remain valid, accredited assessors remain authorized, and we continue to follow the requirements as contractually obligated.

Despite the pause, we completed the assessment anyway. The underlying safeguarding obligations, along with the standard, are the right ones. Customers who need their projects completed now shouldn’t have to wait on a rule change – they should be able to pick a partner capable of delivering with distinction both on the boat and when it comes to securing their information.

Our mission is to make buildings, and even boats, work better, and that includes protecting the information that describes how they work.

If you have mechanical work coming on a facility or a vessel that touches Controlled Unclassified Information, we’ve got a team of highly qualified experts to connect with.

Despite the pause, we completed the assessment anyway. The underlying safeguarding obligations, along with the standard, are the right ones. Customers who need their projects completed now shouldn’t have to wait on a rule change – they should be able to pick a partner capable of delivering with distinction both on the boat and when it comes to securing their information.

Our mission is to make buildings, and even boats, work better, and that includes protecting the information that describes how they work.

If you have mechanical work coming on a facility or a vessel that touches Controlled Unclassified Information, we’ve got a team of highly qualified experts to connect with.