Exigo Corporation Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a Space Force contractor used the KCD to transform “yes/no” documentation into assessment-ready evidence.
CMMC Level 2
Applied solution
Kieri Compliance Documentation
Cloud-Based
MSP Experience
Certified
About Exigo Corporation
Exigo Corporation serves the U.S. Space Force as their primary customer. As a cloud-first organization, they’ve built their entire infrastructure around modern technology. No on-premises servers. No traditional VPNs. Everything runs through Microsoft Entra and cloud services.
John Hilb serves as both Chief Technology Officer and Chief Compliance Officer. His background includes 15 years working for a managed service provider, giving him deep expertise in configuring Office 365 and managing cloud environments.
The technical implementation side of CMMC was familiar territory.
The documentation and body of evidence required to actually pass an assessment was a different story.
Challenge
- Exigo had started their CMMC journey the way many defense contractors do. They had an SSP template that listed controls with yes/no answers. For a while, that seemed sufficient. Then reality set in.
- The challenge wasn’t capability. Exigo had the technical controls in place. The challenge was proving it in a way that would satisfy assessors. They needed documentation that went beyond checkboxes to demonstrate how each control was actually implemented.
- NIST SP 800-171 was written with traditional architectures in mind. Servers. VPNs. Perimeter-based security. Exigo’s cloud-first approach didn’t fit that mold neatly.
- John needed guidance on how to translate cloud implementations into compliant documentation. He needed to know what he didn’t know.
“It was a great skeleton. It gives you, hey, here’s all the stuff that you need to be talking about. When you don’t know what you don’t know, it really gives you, here’s what you don’t know and here’s what you need to answer.”
John Hilb, CTO & CCO,
Exigo Corporation
Solution
- John discovered Kieri through the CUI Center of Excellence, a Discord community where OSCs, C3PAOs, and service providers share information about CMMC compliance. Amira Armond’s reputation for genuine helpfulness led him to explore the KCD.
- Given his technical background, John chose the do-it-yourself path rather than customization consulting. The KCD templates required customization to match Exigo’s specific environment, but they provided a comprehensive starting point.
- More importantly, they surfaced requirements John might have otherwise missed. The explanatory notes throughout the documentation stood out as particularly valuable. “There’s a lot of notes in there that are, ‘Hey, this control, this is what that actually means.’ Because there’s a lot of controls that you can ask 100 people to interpret what it’s saying you have to do, and you get 100 different answers.”
- Having a C3PAO perspective on control interpretation served as a sanity check. Instead of guessing whether their implementation met requirements, Exigo could validate their approach against expert guidance.
- Exigo engaged with the full KCD subscription beyond just the templates. Monthly webinars, check-in calls with consultants, and community connection all played a role. “Sometimes somebody else would ask a question and I’d go, ‘Oh, man, I hadn’t even thought about that.'”
“Having somebody who’s on the C3PAO say, ‘Hey, this is sort of what this actually means’ is very helpful, at least as a sanity check. To be like, okay, so this is what they’re asking us to do, and we are doing that.”
John Hilb, CTO & CCO,
Exigo Corporation
The Assessment
Because Exigo used the KCD, they couldn’t use Kieri Solutions as their C3PAO due to conflict of interest requirements. Kieri maintains strict separation between consulting and assessment services. They chose Sentinel Blue, specifically because of alignment on cloud architecture.
“We wanted to find a company that got it, that understood what the technology stack we were using is, so that we wouldn’t have to explain to our assessor, ‘Well, here’s what conditional access is.'”
The assessment itself validated everything Exigo had built.
“We handed over all of our policies and procedures and everything for the pre-assessment. When it came time to do the actual assessment, there was very little to actually do because everything had been answered in the paperwork we had already given.”
Exigo Corporation achieved CMMC Level 2 certification.
When assessors had questions about specific implementations, John could make his case. When he explained why an alternative approach met the control’s intent, the assessors agreed.
“That’s how it’s supposed to work. It’s not supposed to say the assessor wants X, and if you don’t have X, you fail. You should be able to make the case: here’s why Y is a good substitute for X.”
Advice for Defense Contractors
John’s guidance comes from experience with multiple government audits, not just CMMC.
“If you can hand all of your documentation and artifacts to the assessor and they can go through and say, ‘This control is this, this control is this,’ and not ask you any questions, everybody’s going to be happy.”
John admits he went into the assessment uncertain. “Going into it, I thought, I don’t know if we’re ready for this. Every control, I was like, well, I could read this in a way that…”
But the preparation paid off. The documentation held. The certification came through.
“The community is very helpful for all this stuff. You don’t go it alone. Don’t just try to figure this out by yourself.”
Ready to Build Your Own CMMC-Compliant Enclave?
Exigo Corporation started with a yes/no SSP template that wouldn’t have passed assessment. With the Kieri Compliance Documentation, they built a comprehensive body of evidence that let assessors work through controls without asking questions.
Whether you’re cloud-first like Exigo or running traditional infrastructure, the KCD provides the skeleton you need to document your specific environment.
Your company can do the same.
Schedule a consultation with Kieri Solutions to discuss your compliance journey.
Explore Related Case Studies
Masser Technologies Passes CMMC Assessment with Flying Colors as Both MSSP and OSC
How a dual-role company adapted the KCD and KRA to fit their unique position serving defense contractors while being one themselves
MSSP + OSC
Both roles certified
IntelliGenesis Achieves CMMC Level 2 Certification by Chipping Away Over Seven Years
How a small defense contractor split the work between technical and documentation teams, then finished their final push in three months
4 DAYS
TO COMPLETE ASSESSMENT
Crux Solutions Achieves Perfect 110 Score by Treating CMMC as a Lifestyle, Not a Project
How a Fort Worth technology consulting firm built a custom enclave, partnered with their MSP, and passed assessment on the first try.
12 months
To Certification
Quinn Evans Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a historic preservation firm built a compliant enclave on their own terms, adapting the KRA to fit unique design workflows
CMMC L2
Certified
Reynolds Construction Achieves Perfect CMMC Level 2 Score Without an IT Background
How a 250-person construction company built their own compliant enclave, saved over $200,000, and passed assessment on the first try
$200,000
Saved
How a 10-Person Manufacturing Company Prepared for CMMC Level 2 After Nearly a Decade of Compliance Work
A 39-year-old defense subcontractor with government expertise finds the documentation and consulting guidance needed to finally feel confident about assessment.
93%
SIEM Cost Reduction
Exigo Corporation Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a Space Force contractor used the KCD to transform “yes/no” documentation into assessment-ready evidence.
4x
Faster Compliance Assessments
Masser Technologies Passes CMMC Assessment with Flying Colors as Both MSSP and OSC
How a dual-role company adapted the KCD and KRA to fit their unique position serving defense contractors while being one themselves
MSSP + OSC
Both roles certified
IntelliGenesis Achieves CMMC Level 2 Certification by Chipping Away Over Seven Years
How a small defense contractor split the work between technical and documentation teams, then finished their final push in three months
4 DAYS
TO COMPLETE ASSESSMENT
Crux Solutions Achieves Perfect 110 Score by Treating CMMC as a Lifestyle, Not a Project
How a Fort Worth technology consulting firm built a custom enclave, partnered with their MSP, and passed assessment on the first try.
12 months
To Certification
Quinn Evans Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a historic preservation firm built a compliant enclave on their own terms, adapting the KRA to fit unique design workflows
CMMC L2
Certified
Reynolds Construction Achieves Perfect CMMC Level 2 Score Without an IT Background
How a 250-person construction company built their own compliant enclave, saved over $200,000, and passed assessment on the first try
$200,000
Saved
How a 10-Person Manufacturing Company Prepared for CMMC Level 2 After Nearly a Decade of Compliance Work
A 39-year-old defense subcontractor with government expertise finds the documentation and consulting guidance needed to finally feel confident about assessment.
93%
SIEM Cost Reduction
Exigo Corporation Achieves CMMC Level 2 Certification with a Cloud-First Approach
How a Space Force contractor used the KCD to transform “yes/no” documentation into assessment-ready evidence.
4x
Faster Compliance Assessments
We deliver modern CMMC solutions designed to simplify compliance, eliminate uncertainty, and protect your contract pipeline — without forcing one rigid path.
See how defense contractors achieve CMMC certification with Kieri.
See how defense contractors achieve CMMC certification with Kieri.
Talk with a certified CMMC assessor who can help you figure out your next step.
