A complete blueprint based on the environment Kieri Solutions used to pass their own DIBCAC assessment

---

Most CMMC compliant environments come with enterprise price tags. Dedicated IT staff requirements. Complex managed service arrangements where you lose control of your own systems.

Kieri Solutions faced the same problem. They needed a CMMC Level 2 compliant environment to become an authorized C3PAO assessment organization. But they had a small team, limited IT resources, and no budget for million-dollar solutions.

So they built their own. Designed it for simplicity. Optimized it for low-cost operation. Made it functional enough for real work.

Then they passed a DIBCAC assessment with it. Then they had consulting customers pass their own assessments with it.

The Kieri Reference Architecture is that exact blueprint, available to defense contractors who need the same thing.

Why Kieri Built the KRA

Three years ago, Kieri Solutions started designing their compliance environment with specific constraints in mind.

Limited IT staff. No dedicated IT department. The environment needed to be manageable by one or two people part-time.

Limited budget. No million-dollar enterprise solutions. Every component chosen for cost-effectiveness without sacrificing compliance.

Real functionality. No forcing users onto virtual desktops with accessory compatibility issues, internet glitches, and limited capability. Real laptops that work at client sites, from home, or in the office.

The result is a Microsoft 365 GCC-High based environment that checks all the compliance boxes while remaining practical for actual work.

The Core Architecture

The KRA uses Microsoft 365 GCC-High as its foundation. This single platform handles most security functions for the environment.

Vulnerability scanning. Patch management. Directory services. Monitoring. Antivirus. Secure storage for CUI.

Using one platform for as much as possible keeps complexity down. It also ensures you’re operating in a FedRAMP High authorized environment for both CUI protection and security systems.

Laptops as the Boundary

Here’s where the KRA differs from most compliance approaches.

Each laptop has a fully configured Windows Defender firewall turned to maximum settings. This software firewall creates a strong boundary around each device.

The laptop becomes its own security perimeter.

What does this mean practically? Your home WiFi stays out of CMMC scope. Your home network stays out of scope. Even your corporate network can stay out of scope if you keep CUI on the laptop or in Microsoft 365.

Users can take laptops anywhere. Work from home. Visit client sites. Come to the office. The boundary travels with them.

BYOD for Email and Calendar

Most CMMC environments prohibit personal devices entirely. The KRA takes a different approach.

Keep CUI out of email. Use SharePoint for file sharing instead. With that design decision, BYOD becomes safe.

Employees can access email and calendar on personal cell phones. This seems small, but it’s a huge functionality advantage that most compliance environments don’t offer.

The key is the architecture decision about CUI flow. Email handles communications. SharePoint handles documents. CUI stays in SharePoint. Personal devices access email safely.

Secure File Sharing Without App Installation

When you need to share files with external parties, SharePoint handles it securely. Recipients access files through a web browser. No application installation required.

Kieri uses this method for every assessment they conduct. It works reliably without interoperability issues.

You do have to issue accounts and manage access properly. That’s CMMC Level 2 compliance. You can’t just throw invites out randomly and maintain proper CUI stewardship.

The KRA includes the complete process for secure external sharing with proper access control.

What’s Included in the License

The KRA isn’t just architecture diagrams. It’s a complete implementation package.

Step-by-Step Instructions and Scripts

Exact instructions for what to buy. Specific license requirements. Hardware and software specifications.

Configuration scripts you can run. DNS setup procedures. Microsoft 365 and Intune security settings. Everything documented step by step.

System Security Plan

The KRA includes a System Security Plan that combines with the Kieri Compliance Documentation to create a 95% complete SSP.

Every technical configuration in the environment is fully described. All maintenance procedures are documented. You follow the instructions, customize for your organization, and you have a complete SSP ready for assessment.

Audit Log Procedure

This document goes into full detail for every monitoring and audit logging task required by CMMC Level 2.

Copy and paste queries included. Literal instructions for demonstrating each monitoring step. Nothing else on the market goes to this level of detail.

PC Setup Checklist

Works with the automatic build process in the instructions. Ensures every new computer is built to baseline and fully secured before handoff to users.

Documented proof that you’re building systems correctly from the start.

Cybersecurity Maintenance Checklist

Triggers for every required compliance task on a scheduled basis. Weekly tasks. Monthly tasks. Semi-annual and annual tasks.

This checklist is customized for the KRA specifically. Procedures reference the exact menus, buttons, and queries you’ll use in your environment.

Administrative Processes Document

How to run your IT department in compliance with CMMC Level 2.

User account creation. Account removal. Permission assignment. Paperwork and authorization documentation. Inventory maintenance.

Everything an assessor wants to see evidence of, documented as repeatable processes.

Training and Ongoing Support

Training Library

Video training covering key portions of KRA setup. Specific maintenance procedures for the harder tasks. Content updated as Microsoft changes menu locations and interfaces.

Monthly Q&A and Newsletters

Regular updates as things change. Microsoft moves menus frequently. New guidance appears. You get that information through ongoing support.

Included Engineer Support

Every license includes 10 hours of support from an engineer who has actually built the KRA before.

Use those hours to double-check your work. Get past tricky spots. Verify configurations are correct. The support is included because Kieri wants you to succeed.

Support Options

Base License – DIY

All instructions, scripts, training videos, and monthly support. Ten hours of engineer time included.

Best for organizations with capable IT staff who want to learn the system while building it.

Build With Help Package

Base license plus 40 hours of additional consulting.

An engineer works alongside you through the instructions. Trains you on maintenance processes. Customizes all documentation for your environment. Performs a gap analysis at the end to verify settings.

This is the most popular option. You build it, you learn it, but you have expert guidance throughout.

Turnkey Option

Kieri builds it and hands you the keys.

You purchase all licenses in your name. Kieri gets admin access, builds everything, and performs functionality testing. They hand over a working environment with training on ongoing maintenance.

Best for organizations that need speed or lack internal IT resources for the build.

Who the KRA Works For

The KRA fits organizations that want control over their own compliance environment.

Defense contractors needing CMMC Level 2. The architecture is designed specifically for Level 2 requirements.

Companies with limited IT staff. Kieri operates their environment with about one and a half IT people. The KRA is designed for that reality.

Teams that need real laptops. No virtual desktop limitations. Real devices with real programs that work at client sites, at home, or in the office.

Organizations wanting BYOD capability. Email and calendar on personal phones is a significant functionality advantage.

Businesses preferring Microsoft ecosystems. If you already work with Microsoft products, the KRA builds on familiar platforms.

Getting Started

Download the complete datasheet at kieri.com/kra to see full specifications, capabilities, limitations, and pricing.

The datasheet covers what the environment supports, what it doesn’t, and where you might need additional engineering help for expansions like on-premises network connections or specialized applications.

Schedule a consultation to discuss whether the KRA fits your compliance needs

The KRA exists because Kieri needed it first. They built it, passed assessment with it, and now offer the same blueprint to defense contractors facing the same challenge.

---

Kieri Solutions is one of 54 authorized C3PAOs in the United States. The KRA is based on the environment we used to pass our own CMMC Level 2 assessment with DIBCAC. It’s battle-tested, not theoretical.

Need the Documentation to Go With It? The Kieri Compliance Documentation combines with the KRA for a complete compliance package.

Ready for Assessment? Visit kieri.com/assess to learn about CMMC Level 2 certification services.