ThreadBridge Solutions — CMMC Level 2 Case Study

⚠ Educational Use Only — Fictional Scenario

All company names, personnel, contract numbers, CAGE codes, and data in this case study are entirely fictional and created for educational purposes. This material is part of the SANDS/MVCC CMMC Program curriculum. Do not use any information herein as actual legal, compliance, or cybersecurity guidance.

Case Study Metadata

Version	1.0 — June 2025
Scope	CMMC Level 2 — 110 NIST SP 800-171 practices across 14 domains
Learner Level	Intermediate — assumes basic familiarity with CMMC/DFARS
Deliverables	11 practitioner documents (SSP, POA&M, SAR, IRP, and more)
Educational Use	SANDS/MVCC CMMC Program — not for commercial distribution

About This Case Study

ThreadBridge Solutions, LLC is a fictional small business that manufactures both combat utility uniforms for the Department of Defense and sells commercial office supplies to federal agencies via GSA Schedule. This dual-revenue model places ThreadBridge at the intersection of two distinct compliance regimes: CMMC Level 2 (for CUI-laden defense contracts) and CMMC Level 1 (for commercial GSA supply). Learners will analyze the company's technical environment, identify security gaps, evaluate two real security incidents, and produce the eleven practitioner documents required for a CMMC Level 2 assessment. The scenario deliberately embeds multiple realistic compliance failures common in small-to-midsize defense contractors.

Case Study Documents — Click to Open

Each card opens the corresponding document workspace in the Documents tab.

Doc 01

System Security Plan (SSP)

Doc 02

Plan of Action & Milestones (POA&M)

Doc 03

Asset Inventory

Doc 04

Security Assessment Report (SAR)

Doc 05

Incident Response Plan (IRP)

Doc 06

Access Control Matrix

Doc 07

Audit Log & Monitoring Report

Doc 08

Configuration Management Plan

Doc 09

Vulnerability Scan Report

Doc 10

SPRS Score Worksheet

Doc 11

Maintenance Report

Industry Context

Defense Textile & Apparel — DoD Uniform Manufacturing Sector

The defense uniform manufacturing sector is a specialized niche of the broader defense industrial base (DIB). Companies operating in this space typically hold Defense Logistics Agency (DLA) contracts for combat utility uniforms, physical fitness uniforms, and service dress components. The sector is characterized by high volume, tight delivery schedules, strict technical specifications, and substantial CUI obligations—particularly around material composition and camouflage pattern data that DLA provides to contractors. Below are five representative companies operating in adjacent or overlapping market segments to ThreadBridge Solutions.

Company	Location	Primary Products	Contract Vehicle	CUI/Compliance Notes
American Apparel Inc.	Selma, AL	Combat utility uniforms for all branches	DLA Troop Support IDIQ ($48M)	CUI Uniform specs
Bluewater Defense	Corozal, PR	Major military uniforms, ~$1B DoD revenue	DLA multiple-award IDIQ	CUI Specs + delivery data
Crye Precision	Brooklyn, NY	Premium military uniform/equipment, ~150 employees	Direct DoD + DLA	ITAR-adjacent; CUI threshold applies
Propper International	St. Charles, MO	Full-line military uniforms	DLA + GSA accessories	FCI CUI Both apply
Staples Inc.	Framingham, MA	Office supplies to DoD via GSA MAS	GSA MAS Contract 47QSEA19D008T	FCI Only — Level 1

ThreadBridge's Unique Position: Unlike pure-play defense apparel manufacturers or pure commercial suppliers, ThreadBridge occupies the intersection of both product lines—manufacturing combat utility uniforms under a DLA IDIQ (triggering CMMC Level 2 obligations) while simultaneously supplying office materials via GSA Schedule (Level 1 only). This dual exposure creates compliance complexity: different data classification requirements, different flow-down clauses, and different assessment timelines must be managed simultaneously within a single 82-person organization.

Company Background

ThreadBridge Solutions, LLC — Organizational Profile

Key Personnel — Click a card to view system access

Margaret Holloway

Chief Executive Officer

FCICUI

Dennis Park

IT Manager / de facto CISO

FCICUI⚠ Risk

Sandra Ybarra

Contracts Manager

FCICUI

Robert Chen

Production Manager

FCICUI

Lisa Nguyen

HR Manager

FCICUI

Marcus Webb

Warehouse Supervisor

FCI

Organization Profile

Legal Name	ThreadBridge Solutions, LLC
CAGE Code	7T4X2 (fictional)
DUNS/UEI	08-347-2198 / TBS22CUMBERLAND
Founded	2004
Ownership	Privately held; WOSB
HQ	1148 Industrial Parkway, Cumberland, MD 21502
Satellite	88 Commerce Drive, Frostburg, MD 21532 Warehouse — 12 miles from HQ
Employees	82 total
Annual DoD Revenue	~$14.2M

Active Contracts

Contract #	Agency	Type	Value	Data	Renewal
FA4890-25-D-0014	DLA Troop Support	IDIQ FFP	$11.2M / 5yr	CUI	18 months URGENT
GS-02F-8847X	GSA MAS Sch 75	MAS	$3.2M annual	FCI only	Annual renewal

Technical Environment

Asset Inventory, MFA Status, and Third-Party Providers

Asset Inventory

Asset ID	Description	OS/Platform	Location	Function	FCI	CUI
SRV-001	ERP Server (Epicor 10.2)	Windows Server 2019	Cumberland server room	Production scheduling, inventory, contracts	YES	YES
SRV-002	File Server TBS-FS01	Windows Server 2022	Cumberland server room	Centralized file storage	YES	YES
SRV-003	Domain Controller TBS-DC01	Windows Server 2019	Cumberland server room	AD, DNS, DHCP, Group Policy	YES	Indirect
SRV-004	Backup NAS (Synology DS1821+)	Synology DSM 7.2	Cumberland server room	Veeam backup target; NO offsite backup	YES	YES Often Overlooked!
WRK-001–040	Windows Workstations (40)	Win 10/11 Pro	Cumberland (30) / Frostburg (10)	Office use, ERP, email	YES	PARTIAL (8 of 40)
MOB-001–008	Android Tablets (8)	Android 12 Samsung	Manufacturing floor	Production tracking via ERP web client	YES	NO Same LAN as CUI servers
NET-001	Sophos XG 310 Firewall	Sophos SFOS 19.5	Cumberland server room	Perimeter, VPN gateway, IDS/IPS	N/A	N/A
NET-002	Cisco SG350 Switches (3)	Cisco IOS	Cumberland (2) / Frostburg (1)	LAN NO VLANs	N/A	N/A
CLO-001	Microsoft 365 Business Premium	Cloud (Azure)	Microsoft-hosted	Email, Teams, SharePoint, OneDrive	YES	YES — SharePoint folders
CLO-002	QuickBooks Enterprise	Win 10 (ACCT-WRK-01)	Accounting office	AP/AR, payroll support	YES	NO Orphaned admin account
PRN-001–003	Ricoh IM C4500 MFPs (3)	Ricoh OS	Cumberland (2) / Frostburg (1)	Print, scan-to-email, copy	YES	POTENTIAL — can scan to any email
VPN-001	Sophos SSL VPN (12 users)	Embedded in NET-001	Remote access	Remote workers	YES	YES — tunnels CUI traffic NO MFA

MFA Status by System

System	MFA Enforced?	Method	Gap Reference
M365 (Email/SharePoint/Teams)	YES	Conditional Access — Azure AD	—
ERP (Epicor 10.2)	NO	Local password only	⚠ Gap G-01
File Server (TBS-FS01)	NO	AD credentials	⚠ Gap G-01
Domain Controller (RDP)	NO	AD credentials	⚠ Gap G-01
Sophos VPN	NO	AD credentials	⚠ Gap G-01
QuickBooks Enterprise	NO	Local QB database	⚠ G-01 + orphaned account
Backup NAS (Synology)	NO	Shared local account	⚠ Gap G-01

Third-Party Service Providers

Provider	Location	Services	CUI Access?	Contract Status
TechServ LLC	Frederick, MD	ERP maintenance; monthly on-site + remote VPN	YES — ERP (CUI)	Basic MSA only NO CUI clause
Cascade Networks	Local	ISP + managed firewall	Firewall access only	ISP agreement — no security addendum
ADP	Cloud	Payroll processing	Employee PII = CUI-Privacy	Standard ADP agreement — no flow-down clause
Ricoh USA	National	Printer maintenance (quarterly)	Physical MFP access	Standard maintenance contract
Microsoft	Cloud	M365 cloud services	All email + SharePoint data	FedRAMP Moderate ✓

Data Classification

Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) at ThreadBridge

FCI Federal Contract Information

Contract Pricing Data

Bid data, cost proposals to DLA/GSA

Location: File Server + SharePoint

Access: Holloway, Ybarra

Production/Delivery Schedules

Manufacturing timelines, lot quantities

Location: ERP + File Server

Access: Ybarra, Chen, Webb

Contract Performance Reports

Monthly metrics to DLA COR

Location: SharePoint + Email

Access: Ybarra, Holloway

Purchase Order Data (GSA)

Office supply orders, billing codes

Location: ERP + Email

Access: Sales team, Ybarra

Subcontractor Pricing

Vendor bids, raw material pricing

Location: File Server + Email

Access: Ybarra, Chen

CUI Controlled Unclassified Information

Critical Technology — Uniform Technical Specs

Material composition, camo patterns, Army/AF OCP tolerances

Location: /CUI/Contracts/DLA/Specs + SharePoint

Access: Chen, Park, Ybarra

CTI — Delivery Destination Data

Military unit locations, installation addresses for shipments

Location: ERP delivery module + File Server

Access: Ybarra, Chen, Webb

Privacy—Personnel — Employee Clearance Submissions

SF-86 data, personnel security questionnaire responses

Location: /HR/Clearances + SharePoint

Access: Nguyen, Holloway

Export Controlled (EAR) — Synthetic Fabric Data

EAR-controlled synthetic material specs (not ITAR)

Location: /CUI/Materials/EAR + encrypted email

Access: Chen, Park

NOT ALL SENSITIVE DATA IS CUI: Production labor hours, employee payroll, and commercial vendor invoices are sensitive business data but do NOT meet the CUI definition under 32 CFR Part 2002 or the CUI Registry. Misclassifying non-CUI data as CUI creates unnecessary compliance burden without legal basis.

Interactive Quiz: FCI or CUI?

Classify each data item. You'll receive immediate feedback after each answer.

Question 1 of 6

Unit pricing submitted to DLA contracting officer

POA&M ID	Gap	Priority	NIST Control
POA-001	G-01 — MFA Gaps	CRITICAL	IA.L2-3.5.3
POA-002	G-02 — Access Control Matrix	CRITICAL	AC.L2-3.1.1/1.2
POA-003	G-03 — Audit Log Review	HIGH	AU.L2-3.3.1/3.2
POA-004	G-04 — Vuln Scanning	CRITICAL	RA.L2-3.11.2
POA-005	G-05 — Incident Response Plan	CRITICAL	IR.L2-3.6.1/6.2
POA-006	G-06 — Config Management	HIGH	CM.L2-3.4.1/4.3
POA-007	G-07 — Third-Party Maintenance	CRITICAL	MA.L2-3.7.5
POA-008	G-08 — SSP Missing	CRITICAL	PL.L2-3.12.1
POA-009	G-09 — Network Segmentation	HIGH	SC.L2-3.13.3
POA-010	G-10 — Removable Media	HIGH	MP.L2-3.8.7
POA-011	G-11 — Security Training	MEDIUM	AT.L2-3.2.2
POA-012	G-12 — Physical Access Logging	MEDIUM	PE.L1-3.10.3
POA-013	G-13 — SPRS Score Missing	CRITICAL	DFARS 252.204-7019

POA&M ID

Gap

Priority

NIST Control

Recommended Remediation STUDENT

Target Date STUDENT

POA-001

G-01 — MFA Gaps

CRITICAL

IA.L2-3.5.3

POA-002

G-02 — Access Control Matrix

CRITICAL

AC.L2-3.1.1/1.2

POA-003

G-03 — Audit Log Review

HIGH

AU.L2-3.3.1/3.2

POA-004

G-04 — Vuln Scanning

CRITICAL

RA.L2-3.11.2

POA-005

G-05 — Incident Response Plan

CRITICAL

IR.L2-3.6.1/6.2

POA-006

G-06 — Config Management

HIGH

CM.L2-3.4.1/4.3

POA-007

G-07 — Third-Party Maintenance

CRITICAL

MA.L2-3.7.5

POA-008

G-08 — SSP Missing

CRITICAL

PL.L2-3.12.1

POA-009

G-09 — Network Segmentation

HIGH

SC.L2-3.13.3

POA-010

G-10 — Removable Media

HIGH

MP.L2-3.8.7

POA-011

G-11 — Security Training

MEDIUM

AT.L2-3.2.2

POA-012

G-12 — Physical Access Logging

MEDIUM

PE.L1-3.10.3

POA-013

G-13 — SPRS Score Missing

CRITICAL

DFARS 252.204-7019

Asset ID	Description	FCI	CUI
SRV-001	ERP Server (Epicor 10.2)	YES	YES
SRV-002	File Server TBS-FS01	YES	YES
SRV-003	Domain Controller TBS-DC01	YES	Indirect
SRV-004	Backup NAS (Synology DS1821+)	YES	YES
WRK-001–040	Windows Workstations (40)	YES	PARTIAL
MOB-001–008	Android Tablets (8)	YES	NO
NET-001	Sophos XG 310 Firewall	N/A	N/A
NET-002	Cisco SG350 Switches (3)	N/A	N/A
CLO-001	Microsoft 365 Business Premium	YES	YES
CLO-002	QuickBooks Enterprise	YES	NO
PRN-001–003	Ricoh IM C4500 MFPs (3)	YES	POTENTIAL
VPN-001	Sophos SSL VPN (12 users)	YES	YES

Asset ID

Description

FCI

CUI

In Boundary? STUDENT

Sensitivity STUDENT

Owner STUDENT

SRV-001

ERP Server (Epicor 10.2)

YES

SRV-002

File Server TBS-FS01

YES

SRV-003

Domain Controller TBS-DC01

YES

Indirect

SRV-004

Backup NAS (Synology DS1821+)

YES

WRK-001–040

Windows Workstations (40)

YES

PARTIAL

MOB-001–008

Android Tablets (8)

YES

NET-001

Sophos XG 310 Firewall

N/A

NET-002

Cisco SG350 Switches (3)

N/A

CLO-001

Microsoft 365 Business Premium

YES

CLO-002

QuickBooks Enterprise

YES

PRN-001–003

Ricoh IM C4500 MFPs (3)

YES

POTENTIAL

VPN-001

Sophos SSL VPN (12 users)

YES

User/Role	M365	ERP (Epicor)	File Server	Domain Controller	QuickBooks	NAS
M. Holloway (CEO)	User	Read-only	Exec share	None	View-only	None
D. Park (IT Mgr) ⚠	Admin	Domain Admin	Domain Admin	Domain Admin	Admin	Admin
S. Ybarra (Contracts)	User	Contracts module	CUI folder	None	None	None
R. Chen (Production)	User	Production module	Specs folder	None	None	None
L. Nguyen (HR)	User	None	HR folder	None	HR view	None
M. Webb (Warehouse)	User	Inventory module	Delivery folder	None	None	None
Mfg. Floor Staff (32)	User	Tablet web only	None	None	None	None
Remote Sales (12)	User	None	None	None	None	None
TechServ LLC (3rd party) ⚠	None	VPN + Admin	None	None	None	None
ORPHANED — QB Admin	None	None	None	None	Admin (active)	None

User/Role

M365

ERP (Epicor)

File Server

Domain Controller

QuickBooks

NAS

Access Level STUDENT

Notes STUDENT

M. Holloway (CEO)

User

Read-only

Exec share

None

View-only

None

D. Park (IT Mgr) ⚠

Admin

Domain Admin

Admin

S. Ybarra (Contracts)

User

Contracts module

CUI folder

None

R. Chen (Production)

User

Production module

Specs folder

None

L. Nguyen (HR)

User

None

HR folder

None

HR view

None

M. Webb (Warehouse)

User

Inventory module

Delivery folder

None

Mfg. Floor Staff (32)

User

Tablet web only

None

Remote Sales (12)

User

None

TechServ LLC (3rd party) ⚠

None

VPN + Admin

None

ORPHANED — QB Admin

None

Admin (active)

None

Log Source

Log Type

Currently Enabled?

Retention Period STUDENT

Review Frequency STUDENT

Gap? STUDENT

Gap Description STUDENT

Windows Event Logs (Servers)

Authentication, privilege use, policy change

YES

Windows Event Logs (Workstations)

YES

Sophos XG 310 Firewall Logs

Inbound/outbound traffic, IDS alerts, VPN sessions

YES

M365 Unified Audit Log

Email, SharePoint, Teams, login events

YES

ERP (Epicor) Application Logs

User logins, data access, report generation

Partial

Synology NAS Access Logs

File access, authentication, admin changes

Unknown

Physical Security Cameras

Facility footage (30-day retention)

YES

VPN Session Logs

Connection attempts, session duration, source IPs

YES (Sophos)

VULN ID	System	Vulnerability	CVSS	Severity
VULN-001	SRV-001 (ERP)	Epicor 10.2 — known unpatched RCE vulnerability (CVE published 14 months ago)	9.8	CRITICAL
VULN-002	WRK-001–040	Windows 10 workstations missing 14+ cumulative updates; 6 workstations on EOL Win 10 21H2	7.8	HIGH
VULN-003	SRV-004 (NAS)	Synology DSM running version with known authentication bypass; shared local admin account in use	9.1	CRITICAL
VULN-004	VPN-001	SSL VPN using default TLS 1.0/1.1 settings; no MFA; 12 users on split-tunnel with CUI access	8.1	HIGH
VULN-005	CLO-002 (QuickBooks)	Orphaned admin account active 14 months; no MFA; QuickBooks 2021 — out of mainstream support	7.5	HIGH
VULN-006	PRN-001–003 (MFPs)	Ricoh MFPs configured to allow scan-to-any-email; admin web interface accessible from production VLAN	6.5	MEDIUM
VULN-007	MOB-001–008 (Tablets)	Android 12 tablets not enrolled in MDM; no screen lock enforced; on same LAN as ERP server	6.1	MEDIUM
VULN-008	SRV-003 (DC)	Domain Controller allowing RDP from all internal IPs; no privileged access workstation (PAW) requirement	7.2	HIGH

VULN ID

System

Vulnerability

CVSS

Severity

Remediation Action STUDENT

Assigned To STUDENT

Target Date STUDENT

VULN-001

SRV-001 (ERP)

Epicor 10.2 — known unpatched RCE vulnerability (CVE published 14 months ago)

9.8

CRITICAL

VULN-002

WRK-001–040

Windows 10 workstations missing 14+ cumulative updates; 6 workstations on EOL Win 10 21H2

7.8

HIGH

VULN-003

SRV-004 (NAS)

Synology DSM running version with known authentication bypass; shared local admin account in use

9.1

CRITICAL

VULN-004

VPN-001

SSL VPN using default TLS 1.0/1.1 settings; no MFA; 12 users on split-tunnel with CUI access

8.1

HIGH

VULN-005

CLO-002 (QuickBooks)

Orphaned admin account active 14 months; no MFA; QuickBooks 2021 — out of mainstream support

7.5

HIGH

VULN-006

PRN-001–003 (MFPs)

Ricoh MFPs configured to allow scan-to-any-email; admin web interface accessible from production VLAN

6.5

MEDIUM

VULN-007

MOB-001–008 (Tablets)

Android 12 tablets not enrolled in MDM; no screen lock enforced; on same LAN as ERP server

6.1

MEDIUM

VULN-008

SRV-003 (DC)

Domain Controller allowing RDP from all internal IPs; no privileged access workstation (PAW) requirement

7.2

HIGH

Provider	TechServ LLC (Frederick, MD)
Date	May 14, 2025
Activity	Monthly ERP maintenance — on-site + remote VPN access
Systems Accessed	SRV-001 (ERP Server / Epicor 10.2)
Escort Provided?	Informal — Dennis Park present on-site but no log
Contract Status	Basic MSA only — no CUI clause, no NDA with CUI requirements

Technician	Dennis Park, IT Manager
Date	June 1, 2025
Activity	Quarterly patch cycle on servers SRV-001 through SRV-004; installed 3 software updates on workstations per user requests
Change Request?	None — no formal change request process exists
Baseline Config Used?	No documented baseline — changes made from memory

⚠ Educational Use Only — Fictional Scenario

Case Study Metadata

About This Case Study

Case Study Documents — Click to Open

Key Personnel — Click a card to view system access

System Access

System Access

System Access

System Access

System Access

System Access

Organization Profile

Active Contracts

Asset Inventory

MFA Status by System

Third-Party Service Providers

Interactive Quiz: FCI or CUI?

Dennis Park — IT Manager / de facto CISO

Sandra Ybarra — Contracts Manager

Lisa Nguyen — HR Manager

INC-001 — Phishing / Credential Exposure

Should INC-001 have triggered DFARS 252.204-7012 notification?

INC-002 — Lost/Stolen Device

Should INC-002 have triggered DFARS 252.204-7012 notification?

Incident Analysis — Key Takeaways

Document 1 — System Security Plan (SSP)

Document 2 — Plan of Action & Milestones (POA&M)

Document 3 — Asset Inventory

Document 4 — Security Assessment Report (SAR)

Document 5 — Incident Response Plan (IRP)

Document 6 — Access Control Matrix

Document 7 — Audit Log and Monitoring Report

Document 8 — Configuration Management Plan

Patch Management Timelines STUDENT COMPLETES

Document 9 — Vulnerability Scan Report

Document 10 — SPRS Score Worksheet

Gap-Related Controls — Rate Each

Remaining 94 Controls (not covered by identified gaps)

Document 11 — Maintenance Report

Maintenance Log Entry 1 — TechServ LLC

Maintenance Log Entry 2 — Internal IT (Dennis Park)

SPRS Score Calculator

Remaining 94 Controls

Document Progress Tracker