Crux Solutions Achieves Perfect 110 Score by Treating CMMC as a Lifestyle, Not a Project
How a Fort Worth technology consulting firm built a custom enclave, partnered with their MSP, and passed assessment on the first try.
CMMC Level 2
Applied solution
Kieri Compliance Documentation
Kieri Reference Architecture
Perfect Assessment Score
MONTHS START TO CERTIFICATION
ATTEMPT WITH PERFECT SCORE
INTERNAL IT STAFF
How a Technology Consulting Firm Passed CMMC Without Internal IT
Crux Solutions faced a situation familiar to many small and mid-sized defense contractors. They had DoD work worth protecting, no internal IT team, and a compliance requirement that would reshape how they operated.
Crux is a technology consulting and design firm serving the built environment industry out of Fort Worth, Texas. They work with architects, engineers, and construction firms, helping clients integrate technology into the spaces they create. Their client base splits between commercial and federal work, with DoD contracts making up a meaningful portion of the business.
When CMMC requirements became unavoidable, leadership faced a straightforward decision.
“We made a strategic decision for our company that we want to be in that space,” explains Gale Moericke, Vice President and Chief Security Officer at Crux. “If this is a requirement, this is what we’re going to go do.”
Gale brought serious credentials to the effort. He’s a CISM-certified cybersecurity professional with years of experience in ISO-audited environments. He understood exactly what needed to happen.
Understanding the destination and knowing how to get there, though, are two different things.
Challenge
- Crux had DoD work worth protecting but no internal IT team, working through an MSP partner instead.
- Their tools were solid for day-to-day protection, but the environment wasn’t built to generate the audit evidence CMMC requires.
- They needed an entire compliance program built from scratch: policies, procedures, documentation, evidence collection, and an SSP that would satisfy third-party assessors.
- As a Microsoft shop running Autodesk design tools for AEC workflows, they needed a custom enclave that could support Revit — not a standard GCC-High setup.
- Crux wanted to own their compliance program internally, not hand it off to a consultant or MSP long-term.
“I cannot be the first guy to ever want to do this.Somebody out there has probably put together a package that I could buy into.”
Gale Moericke,
Vice President and Chief Security Officer
Solution
- Gale’s research led him to Kieri Solutions. The Kieri Compliance Documentation (KCD) stood out immediately. “It resonated with me. When I saw what you guys did, it’s like, yeah, that’s how I do things.”
- Crux chose the KCD without the Kieri Reference Architecture. Their AEC workflows required a different technical approach than the standard Microsoft 365 GCC High design.
- As a Microsoft shop working heavily with Autodesk design tools, they built a custom enclave using Preveil (a FedRAMP Moderate equivalent platform) combined with Autodesk for Government (AFG) for their Revit workflows.
- The KCD’s technology-agnostic design made that work. The policies, procedures, and SSP templates adapted to whatever technical architecture Crux needed.
- Gale brought his MSP, SentinelEdge, into the journey early — but strategically kept them out of the audit crosshairs in a supporting role only.
- The monthly subscriber calls and Kieri check-ins gave Gale a direct line to certified assessors whenever he hit gray areas in the requirements.
“I just had to have some faith that if I do it the way you said do it, it’s all going to kind of work out in the end. And it did.”
Gale Moericke,
Vice President and Chief Security Officer
The Results
Crux started their earnest push in March 2025. They could have been ready by December, but couldn’t get assessors scheduled until February 2026.
Perfect 110 score. First attempt.
The assessment went faster than expected. Gale’s ISO background had trained him to treat document control seriously — every revision got a proper version number, every release was tracked. When the C3PAO team arrived, the documentation told a clean story from policy to procedure to evidence.
“Our assessment went fast. They were done quicker than they thought they would be. It’s because our documentation was so straightforward to follow.”
The MSP strategy worked exactly as Gale designed it. SentinelEdge stayed in a supporting role, outside the audit crosshairs, while Crux kept full ownership of the enclave and the CUI. No shared hosting, no MSP access to the enclave, no scope creep that would have pulled them into their own CMMC assessment.
“They don’t host anything for me. They don’t have access to my enclave. They can’t put their fingers on my CUI.”
The KCD’s cross-mapping structure between SSP, policies, and procedures was a major accelerator during the assessment itself. Assessors could follow a thread from an assessment objective to exactly where Crux addressed it across their documentation.
“That technique of saying these words in this SSP right here are addressed in that policy over there in that section was very effective. That tying it together made it really quick.”
Today, Crux treats CMMC as a lifestyle rather than a one-time project. The monthly subscriber calls keep them current on requirements. Their policies, procedures, and evidence collection run as standard operating practice, not as a scramble before the next assessment.
“It just has to be the way you run the business. If you’ll do that, then a lot of this gets less scary.”
Life After Certification
For Crux, passing CMMC wasn’t the finish line. It was the start of how the company now operates. The compliance program runs as standard practice, not as a scramble before the next assessment.
Gale’s advice to other defense contractors comes from experience, not theory.
“Make sure you want to do this. Anything where you have to demonstrate ongoing compliance to a standard is a lifestyle thing. It’s not a one and done thing.”
The monthly KCD subscriber calls stay useful long after certification. Gale submits questions during the live sessions and gets answers from certified assessors in real time.
“Those monthly calls were pretty handy. I put a couple of questions to them that I thought might have been general interest questions, and sure enough, they talked about them in the call.”
For contractors still shopping for a path forward, Gale’s message is direct.
“Looking at the DoD timelines for when they’re going to start enforcing contract terms, if you’re just starting, I don’t know what to tell you, but get on it.”
He also knows that the right IT partnership can make or break the effort. For Crux, that meant bringing SentinelEdge into the journey as a committed partner rather than a reluctant vendor.
“If your IT partners don’t become your best friends and your arm-in-arm partners, you will not get there from here.”
Ready to Build Your Own CMMC-Compliant Program?
Crux Solutions proved that a technology consulting firm without internal IT can achieve CMMC Level 2 certification with a perfect 110 score. Using the Kieri Compliance Documentation and a strategic MSP partnership, they built a custom enclave tailored to their AEC workflows, passed assessment on the first attempt, and now run compliance as standard business practice.
Your company can do the same.
Schedule a consultation with Kieri Solutions to discuss your compliance journey.
Explore Related Case Studies
Masser Technologies Passes CMMC Assessment with Flying Colors as Both MSSP and OSC
How a dual-role company adapted the KCD and KRA to fit their unique position serving defense contractors while being one themselves
MSSP + OSC
Both roles certified
IntelliGenesis Achieves CMMC Level 2 Certification by Chipping Away Over Seven Years
How a small defense contractor split the work between technical and documentation teams, then finished their final push in three months
4 DAYS
TO COMPLETE ASSESSMENT
Crux Solutions Achieves Perfect 110 Score by Treating CMMC as a Lifestyle, Not a Project
How a Fort Worth technology consulting firm built a custom enclave, partnered with their MSP, and passed assessment on the first try.
12 months
To Certification
Quinn Evans Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a historic preservation firm built a compliant enclave on their own terms, adapting the KRA to fit unique design workflows
CMMC L2
Certified
Reynolds Construction Achieves Perfect CMMC Level 2 Score Without an IT Background
How a 250-person construction company built their own compliant enclave, saved over $200,000, and passed assessment on the first try
$200,000
Saved
How a 10-Person Manufacturing Company Prepared for CMMC Level 2 After Nearly a Decade of Compliance Work
A 39-year-old defense subcontractor with government expertise finds the documentation and consulting guidance needed to finally feel confident about assessment.
93%
SIEM Cost Reduction
Exigo Corporation Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a Space Force contractor used the KCD to transform “yes/no” documentation into assessment-ready evidence.
4x
Faster Compliance Assessments
Masser Technologies Passes CMMC Assessment with Flying Colors as Both MSSP and OSC
How a dual-role company adapted the KCD and KRA to fit their unique position serving defense contractors while being one themselves
MSSP + OSC
Both roles certified
IntelliGenesis Achieves CMMC Level 2 Certification by Chipping Away Over Seven Years
How a small defense contractor split the work between technical and documentation teams, then finished their final push in three months
4 DAYS
TO COMPLETE ASSESSMENT
Crux Solutions Achieves Perfect 110 Score by Treating CMMC as a Lifestyle, Not a Project
How a Fort Worth technology consulting firm built a custom enclave, partnered with their MSP, and passed assessment on the first try.
12 months
To Certification
Quinn Evans Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a historic preservation firm built a compliant enclave on their own terms, adapting the KRA to fit unique design workflows
CMMC L2
Certified
Reynolds Construction Achieves Perfect CMMC Level 2 Score Without an IT Background
How a 250-person construction company built their own compliant enclave, saved over $200,000, and passed assessment on the first try
$200,000
Saved
How a 10-Person Manufacturing Company Prepared for CMMC Level 2 After Nearly a Decade of Compliance Work
A 39-year-old defense subcontractor with government expertise finds the documentation and consulting guidance needed to finally feel confident about assessment.
93%
SIEM Cost Reduction
Exigo Corporation Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a Space Force contractor used the KCD to transform “yes/no” documentation into assessment-ready evidence.
4x
Faster Compliance Assessments
We deliver modern CMMC solutions designed to simplify compliance, eliminate uncertainty, and protect your contract pipeline — without forcing one rigid path.
See how defense contractors achieve CMMC certification with Kieri.
See how defense contractors achieve CMMC certification with Kieri.
Talk with a certified CMMC assessor who can help you figure out your next step.
