ALCON DTS helps defense suppliers get ready for CMMC and stay ready. We assess your systems against NIST SP 800-171, help you build the system security plan and plan of action, close the gaps, and run the technical controls every day so your evidence stays current. You keep the compliance decisions. We run the technical controls.
CMMC applies when a Department of Defense contract or subcontract asks for it and your company handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on its own systems. We work with:
Wondering whether CMMC applies to you? Read our CMMC guide or take the free Compliance Check.
We start with what your contracts require and where your contract information lives, then build and run the program with you.
We review the systems that handle CUI against the 110 requirements in NIST SP 800-171 Revision 2, the version CMMC Level 2 uses today. You get clear findings, a draft score, and a prioritized list of what to close first. For companies that handle only FCI, we review the Level 1 safeguards.
We help you write a system security plan (SSP) that describes how your environment actually runs, and a plan of action and milestones (POA&M) that tracks open items to closeout. You review and approve both.
We close the gaps on identity and access, devices, email, logging, backups, and network segmentation. That includes keeping shop floor and production systems apart from office IT when they are part of your environment, and writing the procedures that match.
On your ALCON DTS plan, we run the controls every day and keep the evidence current: access reviews, device status, backup and restore records, and change history. Your regular reviews show where the program stands.
We help you calculate your score with the DoD assessment methodology and prepare the details for your SPRS entry. Your company enters the score and your senior official signs the affirmation, with a clear picture of the controls behind it.
Before a self-assessment, a prime’s review, or a government assessment, we organize your evidence and walk your team through each control family. Joining you on assessment day to explain how the systems run can be part of the engagement.
You request a CMMC readiness review. We talk through your contracts, the clauses they include, the information you handle, and your deadlines.
We identify which people, systems, and locations handle FCI or CUI, so the program covers the right systems and only those.
We run the gap assessment against NIST SP 800-171 and score it with you.
Together we draft the SSP and POA&M and set a work plan with priorities and dates.
We implement the technical controls as part of Secure IT, and the documentation work continues in your CMMC compliance engagement.
We run the controls, keep the evidence current, and help you prepare for each annual affirmation and each assessment.
| Your company keeps | ALCON DTS runs and supports |
|---|---|
| Which systems, people, and locations handle CUI | The technical controls on those covered systems |
| Approval of the SSP and POA&M | Drafting and upkeep of the SSP, POA&M, and procedures |
| SPRS entries and the annual affirmation by your senior official | Score preparation and a current status on every control |
| Choosing and contracting your assessor when your contract calls for one | Evidence, walkthroughs, and assessment-day prep |
The controls an assessor reviews are the systems your team uses every day, so we run them in the same relationship as your managed IT. CMMC compliance consulting (gap assessment, SSP and POA&M support, and readiness guidance) is a separate engagement on top of Secure IT. Implementing the technical controls is included in Secure IT.
Your designated contact keeps the work moving and brings you status on each control.
Our CMMC experience includes a multi-state manufacturer in the defense supply chain with more than 150 users, a long-standing ALCON DTS client. We manage its IT and built and run its CMMC Level 2 program on top of it, including the system security plan, policies, evidence, and an incident response plan tested with leadership.
Tell us what your contracts require. We will map the systems that handle your contract information, show what is already in place, and lay out the work that closes the gaps.
General information only. Your contract sets your CMMC level, and your company makes its own compliance decisions and affirmations.
© 2026 ALCON DTS.
