HOW THE ENVIRONMENT IS RUN
Three commitments the compliant environment is built around.
Certification is a formal third-party (C3PAO) assessment against NIST SP 800-171. ADAPT has not completed that step. What we have built is the environment those 110 controls describe, staffed and operated as if we already had.
NETWORK AND ENDPOINT
Segmented from general engineering.
The compliant environment runs on separate infrastructure from our general-purpose engineering network. CUI-touching work never leaves it. Endpoints, storage, and identity are aligned to NIST SP 800-171 rev 2 practices.
PERSONNEL AND ACCESS
U.S. persons, logged and audited.
Access is restricted to U.S. persons. Every session is logged. Every export-controlled program has a personnel list on file and a data-handling addendum on top of the standard NDA.
WORK AND DELIVERABLES
Everything stays in Auburn Hills.
No offshore engineering, no offshore data storage, no offshore build partners for CUI-adjacent work. Simulation runs, CAD source files, release packages, and inspection records stay on U.S. infrastructure start to finish.
WHERE THIS SHOWS UP IN A DEFENSE PROGRAM
Program work the compliant environment supports.
Same discipline the OEMs run. Applied to defense-prime and Tier 2 supplier programs.
Reverse Engineer
3D scan legacy DoD platforms. Rebuild the CAD in CATIA or NX with full documentation.
Simulate
Occupant protection, crashworthiness, structural. FMVSS, MIL-STD, TARDEC-adjacent.
Qualify
AS9102 first-article inspection and PPAP support for aerospace, defense, and hybrid programs.
Place
Contract engineers on customer paper, on-site at DoD prime and Tier 1 locations.
THE ONE STATUS TO KNOW
Compliant environment. Not certified.
CMMC Level 2 certification is a formal C3PAO assessment against all 110 NIST SP 800-171 controls, resulting in a numeric SPRS score posted to the DoD supplier system. ADAPT has not completed that assessment.
What we have built is the environment the standard describes. The infrastructure, the personnel policy, the data-handling addendum, and the U.S.-only workflow are in place today. Programs that need a CMMC-track supplier for CUI-adjacent engineering work can start now under our current posture. Programs that require a certified supplier will need one.
We say this plainly on this page because the wrong assumption is expensive. Our goal is not to blur the line. Our goal is to be a good option for the programs where “compliant environment” is the right answer.
Brian Smith, Director of Engineering
FREQUENTLY ASKED
Questions and answers
Is ADAPT CMMC Level 2 certified?
No. ADAPT has built and operates the environment the 110 NIST SP 800-171 controls describe, but the formal C3PAO assessment has not been completed. The infrastructure, the personnel policy, the data-handling addendum, and the U.S.-only workflow are in place today. Programs that require a certified supplier will need one.
What is the difference between CMMC compliant and CMMC certified?
Certified means a third-party C3PAO has assessed a supplier against all 110 NIST SP 800-171 controls and a numeric SPRS score is posted to the DoD supplier system. Compliant environment means the controls, policies, and infrastructure the standard describes are built and running without that assessment on file. ADAPT is in the second category, and the certification path is under evaluation.
Can ADAPT support ITAR programs?
Yes. Controlled programs are supported under the same compliant environment. Access is restricted to U.S. persons, every session is logged, and each export-controlled program has a personnel list on file plus a data-handling addendum on top of the standard NDA.
Does ADAPT accept CUI today?
Yes, inside the compliant environment. CUI-touching work runs on infrastructure segmented from our general-purpose engineering network and never leaves it. Simulation runs, CAD source files, release packages, and inspection records stay in Auburn Hills on U.S. infrastructure, with no offshore engineering, storage, or build partners.
TALK TO AN ENGINEER
Tell us what you are building.
Send the program brief. An engineer on our team will read it and respond within one business day. Not a sales coordinator. Not a routing form.