CMMC and IT compliance support for Metro Detroit

Compliance readiness

We support CMMC readiness for defense suppliers: working through the NIST SP 800-171 controls, building your System Security Plan and plan of action, and setting up the technical safeguards an assessor will check. We also help with automotive customer security requirements, the FTC Safeguards Rule for non-bank lenders, HIPAA for medical practices and PCI DSS for anyone taking cards.

We prepare and document; we don't certify. Where a contract requires a formal CMMC Level 2 assessment, an authorized third-party assessment organization performs it, and we'll make sure you know which parts of the process are ours and which are theirs. We'll also help you keep your SPRS score current and honest, since primes and the government both look at it.

CMMC for Macomb and Oakland suppliers

With the Detroit Arsenal in Warren, the Army's ground vehicle programs and the primes that serve them, Macomb County hosts a large concentration of defense suppliers. The CMMC program rule took effect in late 2024, and the requirements are being phased into contracts through the DFARS clause that followed. Suppliers handling CUI need Level 2, which for most means an assessment by a C3PAO.

Readiness starts with scope: where CUI comes in, where it's stored and who touches it. From there we close gaps against NIST SP 800-171, write the System Security Plan, maintain the plan of action, and organize evidence requirement by requirement. We also help you calculate and update your SPRS score accurately, since misstating it carries real legal exposure under the False Claims Act.

Automotive requirements and TISAX

Automotive customers set security expectations through supplier manuals, contract terms and questionnaires, and they increasingly check. Suppliers working with Volkswagen Group, BMW, Mercedes-Benz or other European automakers may be asked for a TISAX label, which is based on the VDA ISA catalog and assessed by approved audit providers. Detroit-based automakers have their own requirements covering similar ground.

We help suppliers build one security program that answers all of them, instead of a separate scramble for each customer. Controls are mapped to the common frameworks, evidence is kept current, and questionnaire answers come from the same source. When a customer changes its requirements, we update the mapping rather than starting over. The same evidence library also serves cyber insurance renewals and CMMC work, so effort spent for one customer keeps paying off elsewhere.

Lenders, insurers and health care

Downtown's large mortgage and finance workforce has produced a long tail of smaller brokers, title agencies and lenders across the metro, many of them covered by the FTC Safeguards Rule. Michigan's Insurance Data Security Law separately requires licensed insurers and agencies to maintain an information security program and report cybersecurity events to the Department of Insurance and Financial Services, with some exemptions for smaller licensees.

Medical practices around the Detroit Medical Center, Henry Ford Health and Corewell Health's southeast Michigan hospitals carry their own HIPAA obligations. For each of these, we implement the technical safeguards, write documentation in plain language and keep evidence ready for examiners and auditors. We don't give legal advice or issue certifications; we make sure the technology behind your program is real.