How Workstreet Helped Booth Engineering Services Achieve CMMC Level 2

Booth Engineering Services is a Florida-based electrical engineering and operations research company that serves both commercial and defense industry customers. Its defense work includes producing electrical diagrams, site photos, and plans, and handling technical data connected to Navy and Space Force projects. Some of that data is Controlled Unclassified Information (CUI), which brings Booth into scope for Cybersecurity Maturity Model Certification (CMMC) Level 2. 

To ensure a smooth path to certification, Booth worked with Workstreet to define its CUI boundary, build policies and procedures, remediate gaps, and set up a CMMC-ready secure enclave for its team. 

The Challenge: CUI Moving Through Tools Built for Speed

Booth has a small, distributed team that’s used to moving fast. Its workflows were built for speed, not handling CUI, with data and files moving through portable drives, commercial Microsoft 365, and local engineering workstations.

With CMMC Level 2 requirements coming into scope, the company needed a way to enable its team to keep up its pace of work in a compliant way without having to build an enterprise-scale security operation. Additionally, alongside its government work, the commercial side of the business had to keep running as normal.

The Approach: Building a secure enclave

The first step was to define the CUI boundaries by tracking how CUI enters into Booth’s systems, where it lives, and who touches it. 

Workstreet documented Booth's current state against Level 2, then moved the government work into a secure enclave built on Microsoft GCC High and Azure Government, Virtual desktop infrastructure (VDI), multi-factor authentication, Intune, Defender, Sentinel, and Vanta. 

The project's aim was to build a system that kept CUI inside a controlled environment that met CMMC Level 2 requirements, while simultaneously ensuring that the commercial side of the business could continue to operate with its existing toolset and processes.

The Results: From Readiness to Assessment and Beyond

Workstreet supported Booth from readiness through assessment support, helping build policies, procedures, SSP materials, POA&M structure, CUI handling workflows, role-based training, evidence folders, vulnerability tracking, audit logs, break-glass procedures, and live-demo preparation

On the technical side, Workstreet worked through conditional access, mobile photo upload workflows, software access, firewall rules, privileged access, audit logging, and Vanta evidence mapping. 

Throughout the project, Theresa Booth, Booth's internal lead, worked closely with Workstreet’s team and became the owner of the environment at Booth. Our team worked alongside Theresa through evidence collection, training, and control walkthroughs so she understood the system and could answer assessor questions directly during the audit and confidently maintain the program post-audit.

“Workstreet helped us build an environment we could operate to meet CMMC requirements from scratch and gave us the support needed to ensure we would be able to operate it on our own. Their experience and advice made the whole process less overwhelming,” said Theresa Booth.

Here's what Booth accomplished with Workstreet:

• Completed CMMC Level 2 C3PAO assessment with Monarch ISC
• Built a controlled CUI enclave for a small distributed engineering team
• Rebuilt existing workflows in a CUI and CMMC Level 2 compliant way
• Enabled Booth personnel to manage and demonstrate controls directly
• Transitioned from audit readiness into continuous monitoring

Don’t Let CMMC Block Your Business 

Workstreet is the only AI-powered Registered Provider Organization (RPO). We help companies build defense-grade security programs to meet Level 2 requirements and protect Controlled Unclassified Information (CUI).

Want to see how we can help your business achieve CMMC certification? Connect with our team here.