When a prime contractor sent out letters threatening to pull work from suppliers who couldn’t demonstrate a valid CMMC score, one of their Kansas manufacturers called their MSP. The MSP called us. When we sat down with the client and their MSP, the first question we asked was about scope. They didn’t have one. Their MSP had implemented security controls without it — which meant they had invested in tools they didn’t need, subscriptions they were paying for that didn’t apply to their environment, and a System Security Plan built on the wrong foundation. We started over — the right way. We ran a scoping workshop, mapped their CUI data flow, and immediately identified that their environment was significantly over-scoped. Reducing scope reduced their tool stack, eliminated unnecessary subscriptions, and cut ongoing compliance costs. Then we rebuilt their SSP to match the actual boundary, authored the policies and procedures mapped to their real controls, and walked them through tabletop exercises, a mini mock assessment, and full assessment preparation. They sat for a CMMC Level 2 assessment with a C3PAO and came out the other side certified. Zero findings.