CMMC Level 2 requires an organization to implement the 110 security requirements of NIST SP 800-171 and prove it to a certified third-party assessor, a C3PAO. For TRSS, the practical question was scope. Running every corporate system through a CMMC assessment would have multiplied cost and drag without improving the protection of Controlled Unclassified Information. TRSS needed a defined boundary where CUI lives, an environment built to hold it, and documentation that maps each of the 320 assessment objectives to something an assessor can verify.
BD Emerson scoped the CUI boundary first, then built the environment to match it: an Azure Government enclave engineered for the 800-171 control set, so the assessment surface is the enclave rather than the entire company. With the boundary fixed, the team authored the System Security Plan control by control, using the Paramify platform to structure the SSP and correcting default control statements where they drifted from the assessment objectives. Gaps went onto a Plan of Action and Milestones with owners and dates, and evidence was collected against each objective as controls came online. An independent firm ran a pre-assessment against the draft SSP, which confirmed the approach and sharpened the remaining items.
BD Emerson is not a C3PAO, and does not need to be. The certification assessment belongs to an independent assessor, which is exactly why the engagement was built around what that assessor will test.
TRSS now holds an assessment-ready CMMC Level 2 posture: a defensible CUI boundary, an Azure Government enclave built for the control set, a complete SSP, a managed POA&M, and evidence organized by assessment objective. When the C3PAO arrives, the work is already in the shape the assessment demands.
