Thank you for Subscribing to CIO Applications Weekly Brief
Scott Lumpkin, DirectorQuantum AI Security, a managed security service provider specializing in CMMC readiness, helped the manufacturer reassess the requirements. Working with the client’s head of IT, Quantum traced the movement of Controlled Unclassified Information (CUI) and identified just 15 employees across sales, engineering and fabrication who would access, process or store it.
The findings revealed a far more manageable path to compliance. Instead of undertaking a company-wide technology overhaul, the manufacturer could focus its preparation on the CUI environment supporting those 15 employees, including the associated systems and security controls.
Led by Scott Lumpkin, director and Certified CMMC Professional (CCP), Quantum AI Security helps defense contractors define their CUI assessment boundaries, implement appropriate safeguards and prepare for CMMC Level 2 assessments. Lumpkin draws on assessor-focused training, experience supporting engagements involving third-party assessors and relationships with CMMC Third-Party Assessment Organizations (C3PAOs) to guide clients through complex compliance decisions. Based at Central Florida Research Park, Quantum AI Security participates in the University of Central Florida’s Business Incubation Program, ranked Florida’s top business incubator by TIME in 2026.
“Our goal is to help businesses unlock government contract opportunities by building stronger security without compromising the way they operate,” says Lumpkin.
Defining Scope for Effective Compliance
Quantum primarily serves small and midsize defense contractors and supports larger organizations facing CMMC challenges that exceed their internal capabilities. Each engagement begins with an examination of the client’s operations, existing security measures and progress toward compliance.
A critical part of this assessment involves tracing how CUI moves across the organization. Information received through a prime contractor’s portal may be downloaded to employee computers, stored in the cloud, printed for production or shared with engineering teams and subcontractors. Each interaction can bring additional personnel, systems and processes within the scope of a CMMC assessment.
Quantum maps these information flows and evaluates the associated technologies, access controls and operating procedures against applicable NIST SP 800-171 requirements. The findings help define the appropriate assessment boundary and identify security gaps needing remediation. Quantum describes its approach as “Scope Before Stack”: define the CUI boundary before deciding which technologies to retain, replace or add.
We help clients make informed investment decisions, ensuring their resources go toward the security measures that matter most.
To meet the security requirement, the contractor could secure the rack’s key in a cabinet accessible to two authorized employees and document the arrangement in its policies and procedures.
Across dozens of engagements involving third-party assessors, Quantum AI Security has helped contractors achieve savings exceeding its service fees by correcting overly broad assumptions about assessment scope. These savings are particularly significant for smaller businesses, which may also face additional preparation expenses that include independent assessment fees of about $50,000.
“We help clients make informed investment decisions, ensuring their resources go toward the security measures that matter most,” says Lumpkin.
Preserving Critical Operational Capabilities
Safeguards must also accommodate the specialized applications, large datasets and high-performance computing demands of engineering and manufacturing contractors, which can make conventional security solutions impractical.
A fully remote contractor conducting advanced 3D modeling and simulations for DARPA faced this challenge when another cybersecurity provider recommended migrating its computing workloads to cloud-based virtual machines. Employees relied on powerful, on-premise computers to process complex engineering models and run data-intensive simulations. Moving these workloads to the cloud risked introducing bandwidth limitations and performance bottlenecks that could interfere with project delivery.
Quantum AI Security identified a software-based alternative that addressed the security requirements associated with working remotely while handling protected information. Employees could continue performing their engineering work on existing computers, preserving essential computing performance without the need for cloud migration.
Contractors also need secure access to company resources from networks outside their control. Employees working from home, hotels or public locations rely on networks that lack the protections of company-managed infrastructure. This makes identity verification and access restrictions particularly important when handling CUI.
Quantum’s zero trust network access (ZTNA) capabilities address this challenge. A software agent supports authentication by validating the user’s identity, device identifiers, assigned permissions and configured location restrictions before establishing access through a FedRAMP-authorized gateway using an encrypted connection. The authentication process takes approximately five seconds and gives authorized employees secure access to designated resources.
Quantum’s ability to provide pre-vetted security solutions also benefits contractors whose internal IT teams or managed service providers lack the necessary technology or expertise. Clients can avoid lengthy vendor comparisons, unfamiliar product evaluations and deployment delays.
-
Our goal is to help businesses unlock government contract opportunities by building stronger security without compromising the way they operate.
Technology selection also requires interpreting the contractor’s specific compliance obligations. Organizations evaluating Microsoft Government Community Cloud (GCC) and GCC High, for example, must consider the information they handle, contractual provisions and applicable regulatory requirements, including International Traffic in Arms Regulations (ITAR) obligations where relevant.
Quantum AI Security examines these factors to determine which environment meets the contractor’s requirements. It applies similar scrutiny to other proposed technologies, assessing whether or not they address identified security gaps and satisfy applicable NIST SP 800-171 requirements.
Maintaining IT Continuity With Less Risk
Selecting the right security technologies is only part of the equation. Quantum also considers how these solutions fit into existing IT environments. Many defense contractors rely on established managed service providers (MSP) that understand their infrastructure, applications and daily IT requirements. Replacing these providers during CMMC preparation can disrupt familiar support processes and require new teams to learn existing systems.
Quantum works alongside incumbent MSPs to define the client’s responsibilities and access permissions. Routine technical administration does not always require access to CUI, so existing providers can continue managing designated IT functions under appropriate restrictions. These arrangements are documented in the contractor’s policies and procedures to establish clear accountability.
The importance of this approach became evident when a contractor that had achieved CMMC Level 2 certification considered replacing its incumbent MSP with a CMMC Level 2-certified provider. A formal risk assessment was conducted to determine if the proposed change would strengthen the contractor’s security posture.
The assessment identified a potential security risk. The existing MSP could continue providing technical support without access to CUI, but the proposed arrangement would introduce additional privileged identities capable of accessing protected information. These privileges could increase the risk of unauthorized access if credentials were compromised or misused.
The contractor was provided with a clear rationale for keeping its trusted IT provider without introducing additional security risks through a change that offered no demonstrated benefit.
Building Evidence for Assessment Readiness
Implementation of appropriate safeguards does not, by itself, establish readiness for a CMMC assessment. Contractors must also demonstrate that their controls operate as intended through documented procedures, technical configurations and supporting records.
Evidence development is integrated into Quantum’s remediation engagements as security deficiencies are addressed. For example, restricting access to CUI requires more than configuring permissions. Contractors must establish who authorizes access, how privileges are administered and what records demonstrate that these procedures are consistently followed.
Preparing this evidence also requires understanding the evaluation a contractor must undergo. A CMMC certification assessment, a NIST SP 800-171 self-assessment and a government review may involve different procedures and obligations. Quantum reviews each client’s contractual requirements and aligns its assistance with the applicable assessment process.
When unconventional technical arrangements raise questions about assessment expectations, Lumpkin draws on his professional training and relationships with C3PAOs to seek clarification. These discussions help contractors address potential concerns before assessment while leaving certification decisions to independent assessors.
To make evidence management more efficient, Quantum also recommends governance, risk and compliance (GRC) software. One recommended third-party platform offers monthly subscriptions, allowing contractors to evaluate its usefulness without committing to an annual contract.
The July 2026 pause of the scheduled CMMC Phase II rollout did not eliminate Phase I self-assessment requirements or existing contractual NIST SP 800-171 obligations. As CMMC requirements and assessment practices evolve, Quantum AI Security aims to extend its expertise to more defense contractors while adapting its services to changes in assessment and enforcement requirements.
Its recognition by CIO Applications as Top CMMC Compliance Solution 2026 reflects a practical approach to resolving compliance challenges without imposing unnecessary changes on contractors. From defining assessment boundaries to selecting safeguards and preparing supporting evidence, Quantum AI Security, LLC helps businesses meet cybersecurity obligations with minimal disruption to their existing systems, resources and trusted IT relationships.
Deep Dive
CMMC Compliance Starts With Accurate System Scoping
A defense subcontractor may assume it needs to upgrade security across the entire company to meet CMMC requirements. But if only certain employees and systems handle controlled unclassified information (CUI), that approach can lead to unnecessary software costs and changes to workflows that are already working well. Missing a system that handles CUI can be just as costly. A file shared through an overlooked application or an account used by several employees may leave important assets outside the assessment scope. The first step is to understand exactly where sensitive information goes before deciding what security changes are needed.
CUI may move through several parts of a business after it is received. Engineering drawings downloaded from a prime contractor’s portal, for example, may be saved on workstations, transferred to production equipment or shared with outside suppliers. Each of these steps needs to be examined to identify who can access the information and where it is stored. This helps determine which accounts and systems must be included in the assessment. It also prevents companies from buying security tools for systems that do not need them. The decisions about what is included or excluded must be documented clearly so an assessor can understand how the scope was established.
Many contractors already have security measures in place. Their existing IT provider may manage access controls or other safeguards that meet some CMMC requirements. Those systems do not necessarily need to be replaced. The more useful approach is to identify what already works, what needs improvement and who will be responsible for each part. This allows the compliance consultant to work alongside the company’s IT team without creating unnecessary disruption.
“Quantum AI Security helps defense contractors prepare for CMMC Level 2 by tracing how CUI moves through their operations and identifying which users and systems need protection.”
Access permissions need particular attention when outside IT technicians have administrative privileges. Managing a system is not the same as needing access to the CUI stored within it. The company must be able to control those permissions in practice, rather than relying only on written policies.
Remote work adds another challenge. Engineers working from home may need specialized applications that do not perform well through remote desktop connections. Employees traveling between facilities may also have to connect through networks outside the company’s control. Security measures such as device authentication and encrypted access can help protect those connections without requiring every location’s network to be rebuilt.
The technology selected must also fit the information being protected and the requirements of the company’s contracts. Government cloud services and security products need to be evaluated for their suitability. A product may claim to address several CMMC controls, but that does not automatically mean those controls are properly implemented in the contractor’s environment. The company still needs evidence showing how its security measures work.
Preparing for an assessment involves more than installing technology. Written policies, system security plans and supporting records must match what employees actually do. If certain roles require exceptions, those arrangements need to be approved and documented. A consultant should also help the company understand which requirements are already satisfied, which gaps remain and what evidence will be needed during the assessment.
The scope of the consulting engagement matters as well. Some providers may stop after identifying gaps, leaving the contractor to handle remediation and gather evidence independently. Others may support the work through assessment preparation. Contractors need to understand what services are included and which responsibilities remain with their internal teams. Readiness consulting is also separate from the independent CMMC assessment, so the roles and fees should be clear from the beginning.
Quantum AI Security helps defense contractors prepare for CMMC Level 2 by tracing how CUI moves through their operations and identifying which users and systems need protection. This allows the company to establish the assessment scope before recommending additional security investments.
It also reviews the safeguards contractors already have in place and works with their existing IT providers instead of requiring them to be replaced. Where security gaps remain, Quantum AI Security can provide managed services, including zero-trust network access and selected FedRAMP-authorized tools. The company also helps develop the policies and supporting evidence needed for assessment preparation.
For small and midsize defense contractors, this approach can make CMMC preparation more manageable. By identifying the systems that genuinely handle CUI and making use of existing safeguards wherever possible, Quantum AI Security helps contractors focus their spending on the controls they need while keeping established business operations running.
...Read more
× 
CIO Applications Weekly Brief
Be first to read the latest tech news, Industry Leader's Insights, and CIO interviews of medium and large enterprises exclusively from CIO Applications
