How Kitty Hawk Technologies Achieved CMMC Level 2 Certification on the First Attempt with Planet Technologies

For small and mid-size businesses (SMBs) in the Defense Industrial Base (DIB), CMMC Level 2 certification is quickly becoming the price of admission for U.S. Department of Defense (DoD) work that involves Controlled Unclassified Information (CUI). For lean teams, getting there can feel like a daunting task, but it does not have to be.

Kitty Hawk Technologies, a Service-Disabled Veteran-Owned Small Business providing strategic engineering and defense solutions, is proof. Facing a compressed timeline and limited internal CMMC experience, Kitty Hawk partnered with Planet Technologies (Planet) and passed its C3PAO assessment on the first attempt, meeting 100% of the required NIST SP 800-171 controls in roughly four months.

The Challenge: Achieving CMMC Level 2 as a Small Business on a Compressed Timeline

CMMC 2.0 Level 2 requires an organization to implement 110 security controls drawn from NIST SP 800-171 Revision 2, which decompose into 320 discrete assessment objectives across 14 security domains, and must be proven through a formal assessment by an accredited Certified Third-Party Assessment Organization (C3PAO). For Kitty Hawk, that certification was the essential for remaining eligible for DoD contracts that require protection of Federal Contract Information (FCI) and CUI.

For SMBs, the challenge is scope against time and resources. Kitty Hawk needed a secure environment, a complete body of documentation, and fully implemented controls, quickly and without pulling the team away from core mission work. To meet that challenge, Kitty Hawk engaged Planet as a trusted advisor to lead a structured, end-to-end readiness program built around the requirements of its C3PAO audit.

The Planet Approach: A Structured, End-to-End CMMC Readiness Program

Planet guided Kitty Hawk through five connected efforts, applying deep experience in government compliance and DIB cybersecurity to reach a successful Level 2 outcome.

1. Rapid GCC High Tenant Deployment

Planet began by rapidly standing up a Microsoft GCC High (GCCH) tenant aligned to NIST SP 800-171 Revision 2. GCCH is a secure, compliant foundation designed by Microsoft for handling CUI and regulated defense workloads. Establishing the right environment early gave Kitty Hawk a platform built for CMMC from the start, rather than one that would need to be retrofitted later.

2. Gap Assessment and Audit-Ready Documentation

With the environment in place, Planet conducted a CMMC gap assessment, evaluating Kitty Hawk’s controls against the Level 2 standard through targeted interviews and technical reviews. Planet then produced the full body of audit-ready documentation the assessment requires, including an Acceptable Use Policy and a complete System Security Plan (SSP) mapping all 110 controls and 320 assessment objectives, along with supporting policies and procedures, an asset inventory, network diagrams, an incident response plan with tabletop exercise results, and risk assessments. The result was a defensible, evidence-backed documentation package aligned to CMMC 2.0.

3. Mock CMMC Level 2 Assessment

Planet then ran a full-scope mock assessment modeled on the real C3PAO audit. Over multiple days, Planet’s veteran assessors evaluated each control family, reviewed evidence, and interviewed staff, scoring every practice as met or not met. The exercise surfaced residual gaps, produced a findings report with a prioritized plan of action, and gave Kitty Hawk’s team direct practice responding to assessor questions before the final audit.

4. Targeted Remediation Support

Working alongside Kitty Hawk’s IT and security team, Planet helped close the remaining findings, including verifying technical fixes, refining procedural controls, and finalizing evidence. By the end of this phase, all 110 controls were fully implemented and documented, and the environment was at a high state of readiness.

5. C3PAO Assessment Support

Planet stayed engaged through the formal audit. Planet validated artifacts and confirmed the team was prepared for each interview; during the multi-day assessment, Planet provided real-time support helping demonstrate controls, clarifying implementation details, and supplying additional evidence as the assessors requested it.

Beyond these five connected efforts, Planet remains available as a long-term compliance partner, with DIB managed services spanning ongoing compliance maintenance, cloud security advisory, and vulnerability management to help Kitty Hawk sustain its posture and adapt to future requirements.

The Impact: CMMC Level 2 Certification on the First Attempt

With Planet’s structured approach, Kitty Hawk passed its CMMC Level 2 C3PAO audit on the first attempt, meeting 100% of the required NIST SP 800-171 controls, and delivered on the planned timeline of roughly four months. Key outcomes included:

• Full CMMC Level 2 certification, formally qualifying Kitty Hawk to pursue DoD contracts that require protecting FCI and CUI.
• A secure Microsoft GCC High environment aligned to NIST SP 800-171 Revision 2, built for regulated defense workloads.
• All 110 required controls and all 320 assessment objectives met on the first attempt.
• A complete SSP and audit-ready documentation package built to withstand assessor scrutiny.
• A stronger, more resilient security posture was embedded into daily operations.
• A lean team was able to maintain focus on its core mission throughout the engagement.
• A long-term compliance partnership was established to help Kitty Hawk maintain certification going forward.

For small and mid-sized defense contractors, CMMC Level 2 certification is increasingly essential to competing for DoD work and proof, not just policy, is what the assessment demands. Kitty Hawk’s first-attempt success shows how an SMB can move quickly, with the right partner, to secure its environment, document its program, and earn certification while keeping the business running.

Whether you’re an SMB just starting out or well into your compliance roadmap, Planet can help wherever you are. Get in touch or email [email protected].