Quinn Evans Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a historic preservation firm built a compliant enclave on their own terms, adapting the KRA to fit unique design workflows
CMMC Level 2
Applied solution
Kieri Reference Architecture
Kieri Compliance Documentation
Consulting Support
CMMC Certified
Months to Certification
Architecture Firm Certified
About Quinn Evans
Quinn Evans is an architecture firm specializing in historic preservation, renovating buildings that matter. Their client base spans commercial and federal work, with a significant portion of revenue coming from government customers.
Andrew Hollomon serves as Chief Technology Officer.
His team are experienced technologists, comfortable managing complex systems and customizing solutions to fit their needs. But architecture firms operate differently than typical defense contractors. Creative work demands flexibility. Processes tend to stay loose. Rigid structure can feel uncomfortable.
When CMMC requirements entered the picture, Quinn Evans faced a choice: hand control to an outside provider, or figure out how to build compliance themselves.
They chose to build it themselves.
Challenge
- Quinn Evans started their CMMC journey at zero. They had no prior knowledge of NIST 800-171. “We did not have much knowledge about NIST 800-171 when we started the journey. We had this need to learn as quickly as we could.”
- The technical implementation wasn’t the problem. Andrew’s team knew Microsoft 365 inside and out. The challenge was translating federal security controls into actual configuration settings and documented evidence.
- Beyond the technical learning curve, there was an organizational shift to manage. Standing up a formal security program meant structured processes, defined workflows, and documentation requirements that felt foreign to a design firm’s culture. “Architecture firms like to be loose in terms of process because that’s kind of the way they work, responding to clients in an individual, customized fashion.”
- Quinn Evans also had specific requirements that ruled out cookie-cutter solutions. Their design applications, CUI flows, and operational needs didn’t fit standard enclave templates. They needed flexibility to adapt.
- Andrew’s team talked to multiple MSPs specializing in CMMC enclaves, but the conversations kept hitting the same wall. They wanted control over their own environment, not a managed solution.
“The KRA and KCD were really useful to us in teaching us how the SSP and compliance documentation worked enough that we understood how to extend it.”
Andrew Hollomon,
CTO, Quinn Evans
Solution
- The recommendation that changed everything came from a peer going through the same process, about three or four months ahead of Quinn Evans. “He ultimately went with an MSP because that’s what his organization felt more comfortable with. But he viewed Kieri as a strong approach, and it ended up being the one that made the most sense for us.”
- Quinn Evans purchased the Kieri Reference Architecture (KRA) and Kieri Compliance Documentation (KCD), then built their enclave themselves.
- The KRA provided the foundation. The team adapted it to fit their specific environment: adding Autodesk for Government to support design workflows, implementing VDI instead of local laptops to keep the physical environment out of scope, and using FIDO2 for multi-factor authentication with conditional access instead of Duo.
- These weren’t small modifications. But the KRA and KCD gave them something more valuable than a rigid template: understanding. They learned how the SSP and compliance documentation worked well enough to extend it for their unique needs.
- The instructions were straightforward for a technical team. No roadblocks during implementation. The real work came in the final stretch. Andrew’s team used all their included consulting time, then purchased additional hours. “It was particularly valuable to talk to people like Lia and Eric. It really helped us learn. There’s a lot we can absorb on our own, but everybody has questions, and Kieri was really great about being there to answer the questions that we had.”
“What we were looking for is to have more control over our environment. We wanted to run it ourselves. We wanted to be steering how it was operated and how it was built because we had some requirements that are not common.”
Andrew Hollomon,
CTO, Quinn Evans
The Results
Quinn Evans achieved CMMC Level 2 certification.
The 14-month journey from initial conversations to certification wasn’t full-time work throughout. The process built slowly, with intensity concentrated in the final months of preparation and assessment.
The payoff extends beyond compliance.
“There are very few firms in our particular business, architecture, that have been CMMC Level 2 certified. For us, it’s a bit of a differentiator right now.”
The consulting helped verify that their modifications to the KRA were compliant and aligned with NIST 800-171 requirements. When you’re extending a reference architecture, that validation matters.
Life After Certification
The enclave is a production system. Real work happens inside it every day.
Quinn Evans manages ongoing cybersecurity maintenance with their existing lean IT team. The KCD’s maintenance checklists and procedures make that possible.
“The KCD and the KRA are set up in a way that the maintenance tasks required to fulfill the controls are done in a way that’s pretty efficient.”
“I wouldn’t say security gets in the way,” Andrew notes. “What’s new for us is really understanding CUI flows and being able to adapt internal firm workflows to those new ways of thinking about how information flows in the firm.”
The team is looking forward to expanding capabilities as more SaaS tools achieve FedRAMP authorization, adding to their enclave’s toolkit over time.
What Andrew Would Tell Other Defense Contractors
On the assessment experience:
“It’s a roller coaster, and I’m glad it ended well. They keep you in suspense until the very last moment.”
On the final stretch:
“The last three months were the most intense part of the process. You start to really question and make sure that you’re really prepared for the assessment. You begin to have doubts.”
On working with Kieri:
“Kieri was exceptionally helpful during the assessment process.”
“The KCD in particular, the documents are really well written and a lot of thought has been put into them.”
Andrew Hollomon, CTO, Quinn Evans
Ready to Build Your Own Compliant Enclave?
Quinn Evans proved that a technical team with unique requirements can build CMMC compliance on their own terms. The KRA provided the foundation. The KCD provided the documentation framework. Kieri’s consulting filled the gaps when questions arose.
Your company can do the same.
If your organization wants control over your compliance environment and has the technical capability to build it, this approach works.
Schedule a consultation with Kieri Solutions to discuss your compliance journey.
Explore Related Case Studies
Masser Technologies Passes CMMC Assessment with Flying Colors as Both MSSP and OSC
How a dual-role company adapted the KCD and KRA to fit their unique position serving defense contractors while being one themselves
MSSP + OSC
Both roles certified
IntelliGenesis Achieves CMMC Level 2 Certification by Chipping Away Over Seven Years
How a small defense contractor split the work between technical and documentation teams, then finished their final push in three months
4 DAYS
TO COMPLETE ASSESSMENT
Crux Solutions Achieves Perfect 110 Score by Treating CMMC as a Lifestyle, Not a Project
How a Fort Worth technology consulting firm built a custom enclave, partnered with their MSP, and passed assessment on the first try.
12 months
To Certification
Quinn Evans Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a historic preservation firm built a compliant enclave on their own terms, adapting the KRA to fit unique design workflows
CMMC L2
Certified
Reynolds Construction Achieves Perfect CMMC Level 2 Score Without an IT Background
How a 250-person construction company built their own compliant enclave, saved over $200,000, and passed assessment on the first try
$200,000
Saved
How a 10-Person Manufacturing Company Prepared for CMMC Level 2 After Nearly a Decade of Compliance Work
A 39-year-old defense subcontractor with government expertise finds the documentation and consulting guidance needed to finally feel confident about assessment.
93%
SIEM Cost Reduction
Exigo Corporation Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a Space Force contractor used the KCD to transform “yes/no” documentation into assessment-ready evidence.
4x
Faster Compliance Assessments
Masser Technologies Passes CMMC Assessment with Flying Colors as Both MSSP and OSC
How a dual-role company adapted the KCD and KRA to fit their unique position serving defense contractors while being one themselves
MSSP + OSC
Both roles certified
IntelliGenesis Achieves CMMC Level 2 Certification by Chipping Away Over Seven Years
How a small defense contractor split the work between technical and documentation teams, then finished their final push in three months
4 DAYS
TO COMPLETE ASSESSMENT
Crux Solutions Achieves Perfect 110 Score by Treating CMMC as a Lifestyle, Not a Project
How a Fort Worth technology consulting firm built a custom enclave, partnered with their MSP, and passed assessment on the first try.
12 months
To Certification
Quinn Evans Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a historic preservation firm built a compliant enclave on their own terms, adapting the KRA to fit unique design workflows
CMMC L2
Certified
Reynolds Construction Achieves Perfect CMMC Level 2 Score Without an IT Background
How a 250-person construction company built their own compliant enclave, saved over $200,000, and passed assessment on the first try
$200,000
Saved
How a 10-Person Manufacturing Company Prepared for CMMC Level 2 After Nearly a Decade of Compliance Work
A 39-year-old defense subcontractor with government expertise finds the documentation and consulting guidance needed to finally feel confident about assessment.
93%
SIEM Cost Reduction
Exigo Corporation Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a Space Force contractor used the KCD to transform “yes/no” documentation into assessment-ready evidence.
4x
Faster Compliance Assessments
We deliver modern CMMC solutions designed to simplify compliance, eliminate uncertainty, and protect your contract pipeline — without forcing one rigid path.
See how defense contractors achieve CMMC certification with Kieri.
See how defense contractors achieve CMMC certification with Kieri.
Talk with a certified CMMC assessor who can help you figure out your next step.
