# Small IT Team Achieves CMMC Level 2 Certification

A small IT team successfully achieved Cybersecurity Maturity Model Certification (CMMC) Level 2 by designing and implementing a secure enclave environment over a 6-9 month period. This effort involved rebuilding all systems from the ground up, extensive automation, and in-house management of patching and Security Information and Event Management (SIEM) tools, specifically using ManageEngine and Wazuh. The case highlights the significant resource commitment and technical expertise required for small contractors, especially those managing multiple subsidiaries, to meet CMMC compliance requirements.

- **Why this matters:** CMMC Level 2 certification is increasingly critical for contractors seeking to participate in Department of Defense (DoD) and federal IT procurements involving controlled unclassified information (CUI).
- The demonstrated approach underscores the complexity and resource intensity of achieving compliance, particularly for small teams with limited personnel.
- Procurement professionals should recognize the challenges small contractors face in meeting cybersecurity mandates and consider these factors in vendor evaluations and contract planning.
- Companies aiming for CMMC certification can benefit from leveraging automated patching and SIEM tools like ManageEngine and Wazuh to streamline compliance efforts.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** September 20, 2026

### Vendors
- ManageEngine (patching tool provider)
- Wazuh (SIEM tool provider)

### Key Quotes
> I inherited an environment that was unfixable and the only path forward was to build an enclave.
> — Original poster

> Three years and two people is pretty good friend.
> — Commenter

### Sources
- [Passed the 3rd party cmmc level 2 and received our cert. Will answer questions.](https://www.reddit.com/r/CMMC/comments/1wlvonp/passed_the_3rd_party_cmmc_level_2_and_received) - reddit-cmmc