CMMC Level 2 certification is legally required for any DOD contractor handling CUI. NDAA FY2026 added AI-specific obligations on top. And NSA's post-quantum cryptography mandate is already running. We help you get ready — before it costs you the contract.
→ Not sure where to start? Try our $5,000 PQC Readiness Check firstAfter a Drexis engagement, every line above is resolved and documented.
Under 32 CFR Part 170 (effective November 2024) and DFARS 252.204-7021, any defense contractor handling Controlled Unclassified Information must obtain CMMC Level 2 certification from an authorized C3PAO. You cannot self-attest at Level 2. Period.
That assessment costs $30,000–$150,000 and wait times already exceed 18 months at most C3PAOs. Fail the assessment and you pay again, lose your slot, and risk losing the contract.
Our job is to get you ready before that assessment happens — so you pass on the first attempt. Every dollar you spend here protects a far larger investment downstream.
Most defense contractors are using AI tools, storing CUI, and running encrypted systems — with zero documentation that any of it is compliant. Here's exactly what that costs you.
Microsoft Copilot, AI-assisted ticketing, code review tools, estimating software — most contractors are running 8–15 AI tools with zero documentation. NDAA FY2026 requires a formal inventory with risk classifications. Without it, you fail before the first practice control is reviewed.
NDAA FY2026 RequirementWhen a staff member runs a contract document through an AI tool, CUI may leave your assessed boundary. CMMC Level 2 requires documented control over every system that touches controlled data — including every AI tool your team uses, regardless of who approved it.
CMMC Level 2 · NIST SP 800-171NSA's CNSA 2.0 mandate requires post-quantum algorithm transitions by 2030. AI data pipelines, encrypted CUI storage, and secure communications protecting government information are all in scope. The migration takes years — most contractors haven't started planning it.
NSA CNSA 2.0 · Post-Quantum CryptoI'm Austen, founder of Drexis Technologies. I lead every engagement personally — with a small, focused team of compliance specialists. That means you're on the kickoff call with me. Our team conducts your technical interviews and documentation review. I write and sign every findings report. You're not paying a big firm to hand your case to a junior analyst who read the framework last week.
The CMMC consulting market is filling up with large firms who've discovered there's money in compliance. Their model is volume — your engagement is one of dozens their analysts are running simultaneously. Ours isn't. We take on a limited number of engagements at a time so each one gets the senior-level attention it requires.
I come to this through DOD contracting. Drexis Infrastructure Group holds an active CAGE code and WOSB certification pursuing federal work. We understand what's at stake when a contract requires CMMC compliance — because we live it. That's a different starting point than a firm that's never bid a government contract.
Direct access, no gatekeeping. You have Austen's direct contact from day one. Questions get answered at the principal level — not a ticket system or an account manager.
My name is on every report. Every finding we document, I'm prepared to defend to a C3PAO assessor. We don't produce findings we can't stand behind.
We tell you when you don't need us. If your situation doesn't warrant a full engagement, we'll say so in the discovery call and point you somewhere useful — at no charge.
Remote, nationwide. Jackson, CA is home base. Your location is not a constraint. We serve defense contractors across the DIB wherever they operate.
Most CMMC consultants won't show you their pricing. We do — because you deserve to compare before you get on a call. All engagements are fixed-fee. No hourly billing surprises. No hidden phases.
The NSA's CNSA 2.0 mandate requires defense contractors to transition to post-quantum cryptographic algorithms by 2030. Most contractors don't know it applies to them — and the migration takes 2–4 years to complete properly. This check tells you exactly where you stand and what you need to do.
A complete assessment of your current posture against all 110 NIST SP 800-171 controls, with your AI compliance overlay and SPRS score calculated. You'll know exactly where you stand — and what has to change — before spending $75,000+ on a C3PAO assessment.
The complete readiness package for contractors actively pursuing CMMC Level 2 certification. Covers the full assessment plus documentation a C3PAO assessor will ask for — SSP, POA&M, policy suite, evidence checklist, and AI/PQC compliance overlays built in from the start.
For contractors who need to hand documentation directly to a C3PAO assessor. Includes the complete readiness package, remediation support while you close gaps, a mock assessment interview to prepare your team, and a post-remediation review before your C3PAO assessment date. You go in with verified, defensible documentation — not hopeful guesses.
Ongoing regulatory tracking, quarterly review calls, policy updates as NDAA requirements evolve, and priority access when a compliance question surfaces mid-contract. Available following any initial engagement. 12-month minimum.
Every engagement follows the same structure. You know what we're doing at each stage, why, and what the output is. The final report is built on primary-source evidence — not assumptions and not borrowed templates.
We review your contract landscape, CUI categories, existing security documentation, and compliance history. You brief us on what you know; we identify what we need to verify. This call defines the scope of everything that follows and gives you a realistic timeline.
Prefer to start on your own? Request our structured intake questionnaire — 110 controls, formatted for non-technical staff. We review it before we meet so we arrive focused.
I conduct structured interviews with your IT and operations staff and review your network diagrams, policy documentation, and existing SSP sections. Where documentation isn't enough, I verify controls are actually working — live, via screen share. You share your screen while I observe MFA enrollment, access control configurations, audit log generation, and encryption settings in real time. No travel. No software installed on your systems. This is the "Test" examination method C3PAO assessors use — so when they show up, your team already knows exactly what to expect.
Every system and control is mapped against CMMC Level 2, NDAA FY2026 AI requirements, and CNSA 2.0 cryptographic standards. I walk you through every high-severity finding before the final report is issued — no surprises in the document your C3PAO will see.
You receive a complete, C3PAO-ready documentation package: SSP, POA&M, policy suite, evidence checklist, and executive summary — written in the language of CMMC practice requirements, with every finding documented, risk-rated, and paired with a specific remediation action.
Every CMMC assessment — mine included — uses three official examination methods. Examine: I review your documentation, network diagrams, SSP sections, and policy suite against each control requirement. Interview: Structured sessions with your IT and operations staff to verify they understand and can demonstrate the controls. Test: Live verification that controls are actually operational. For the Test component, you share your screen while I observe — MFA enrollment working, access controls enforcing least privilege, audit logs generating on the right events, encryption configured correctly. No site visit. No third-party software. This is the same methodology C3PAO assessors use when they come to certify you, so your team goes into that assessment knowing exactly what to show and how to show it.
These are the primary frameworks every engagement is assessed against. When requirements change — and they do — your documentation gets updated accordingly.
30 minutes on your contract landscape and compliance posture. If there's a clear risk, I'll tell you what it is and how serious it is. If you don't need a full engagement, I'll say so and point you in the right direction — at no charge.
Prefer to go at your own pace? We offer a structured intake questionnaire — covering all 110 NIST controls, written for non-technical decision-makers. Complete it before our first call and we'll arrive already knowing where to focus.
No obligation. No sales pitch. If we can't help you, we'll tell you who can.