Case study
CMMC Assessment Case Study: How ITG’s Own SENTRE Passed 110 of 110
ITG built SENTRE for its own operations and had it assessed by a C3PAO: CMMC Final Level 2, 110 of 110 NIST SP 800-171 requirements, enterprise scope, assessed December 16, 2025. SENTRE is built from that assessed design, documentation and operating model.
110/110
NIST SP 800-171 requirements met
10+ months
4 dedicated consultants, 5 part-time staff
Dec 2025
C3PAO assessment, enterprise scope
What did it take ITG to pass a CMMC assessment?
More than 10 months of work. ITG built its own environment with 4 dedicated IT and business consultants and 5 part-time staff, implemented all 110 NIST SP 800-171 requirements, updated its SPRS record and passed a C3PAO assessment on December 16, 2025: CMMC Final Level 2 (C3PAO), 110 of 110, enterprise scope.
ITG is a federal IT integrator. Like its customers, it works on contracts for the Department of War (DoW, also DoD) that require it to protect Controlled Unclassified Information (CUI), and it needed NIST SP 800-171 Rev 2 implemented across its operations, with evidence that would hold up in an independent assessment. ITG chose to build its own enclave so it would be independent of recurring cloud costs and continual cloud platform changes, and so its CUI would stay in the United States, on infrastructure ITG controls.
That environment is SENTRE. Customers receive the same assessed design, documentation and operating model, adapted to each organization during implementation. ITG did the long build once, so a customer’s enclave starts from a working, documented environment instead of a blank page.
The Solution
ITG’s own build went through more phases than a customer’s, because ITG evaluated several solutions and options along the way, using the CMMI Decision Analysis and Resolution (DAR) practice to compare them and record each decision. The build followed ITG’s CMMI-DEV Maturity Level 3 development practices, with ISO/IEC 27001:2022 as the security management basis. Customers follow only the five phases they need: workflow configuration, users and governance, system configuration and CUI workstations, training and monitoring, and documentation and evidence.
Dedicated Enclave
Servers, networking and CUI workstations inside one defined boundary, with FIPS-validated cryptography and multi-factor authentication.
CENTRE as System of Record
Contracts, orders, supply chain, IT service requests and document control, linked to the requirements they support.
What were the assessment results?
| Item | Result |
|---|---|
| Status | CMMC Final Level 2 (C3PAO), CMMC UID L200001152 |
| Standard and score | NIST SP 800-171 Rev 2, 110 of 110 requirements |
| Scope | Enterprise: the whole company, CAGE 1EJ55 |
| Assessment date | December 16, 2025 |
| Build effort before the assessment | 10+ months; 4 dedicated IT and business consultants, 5 part-time staff |
| Build framework | CMMI-DEV ML3 practices, incl. Decision Analysis and Resolution (DAR); ISO/IEC 27001:2022 security basis |
| Affirmations | Initial January 5, 2026; next due December 16, 2026 |
| Status valid to | December 15, 2028, subject to annual affirmations |
Why does an enterprise-scope assessment matter to customers?
Because the result covers the way ITG actually operates, not a narrow test boundary. The C3PAO assessed the whole company under one CAGE code, so the documentation, the work instructions and the operating model that SENTRE customers receive have all been through an independent assessment in daily use.
The status runs to December 15, 2028, and it holds only while each annual affirmation is filed; the next is due December 16, 2026. That is the same discipline a SENTRE customer follows after go-live: keep the environment matched to the documentation, and affirm only what is in place.
ITG’s certification covers ITG. A customer’s status comes from its own self-assessment and affirmation or, where a contract requires it, its own assessment. What ITG’s result gives a customer is a starting point that has already been tested against all 110 requirements, in daily use rather than in a lab.
“By implementing and validating all 110 CMMC Level 2 controls in our own SENTRE environment, we’ve proven that our architecture, processes, and documentation can withstand independent assessment.”
Michael P. Angelakis, CEO, Integration Technologies Group, Inc.
Case study FAQs
Who assessed ITG?
An authorized C3PAO, on December 16, 2025, against all 110 NIST SP 800-171 Rev 2 requirements, with enterprise scope. The result is recorded in SPRS under CMMC UID L200001152, and it can be checked there by the government users who rely on it.
How long did ITG’s build take?
More than 10 months, with 4 dedicated IT and business consultants and 5 part-time staff. That covered building the environment, implementing all 110 requirements, updating ITG’s SPRS record and passing the C3PAO assessment. Customers start from the finished environment rather than repeating that work.
Is our environment the same as ITG’s?
It starts from the same assessed design, documentation and operating model, and is adapted to your contracts, systems and placement during implementation. After go-live ITG manages it: maintenance, change management, service desk support and annual control audits. Your team does its CUI work inside it.
Does this certify our company?
No. CMMC status belongs to the assessed organization. Yours comes from your own self-assessment and annual affirmation or, where a contract requires it, your own C3PAO assessment. ITG’s result shows that the environment you start from has already passed one, with enterprise scope. CMMC Level 2 →
See how the environment ITG had assessed would work for your contracts. Discovery is a no-obligation fit and integration review.