BlueKey IT helps Utah aerospace and defense suppliers prepare for NIST 800-171 and CMMC, from scoping and gap review to documentation and assessment preparation, supported from our West Valley City office.
Real reviews from real customers. See why businesses choose BlueKey IT.
Read All ReviewsUtah companies that machine parts, build composites and electronics, or write software for defense and aerospace programs are expected to protect Federal Contract Information and CUI now. We find where that information lives, close the gaps, and build the records primes and assessors expect.
CMMC requirements keep changing, so we maintain one current summary, Where CMMC Stands Today, on our CMMC Compliance page. For the basics, read What Is CMMC Certification.
The Wasatch Front, from Ogden and Davis County through the Salt Lake Valley to Utah County, supports aircraft sustainment, composites, avionics, rocket and space systems, and the many smaller suppliers that serve them: machine shops, engineering firms, software developers, and logistics providers.
Our Utah office is at 2819 S 5600 W in West Valley City, close to suppliers in Salt Lake City and West Valley City. Remote support covers the rest of Utah.
Shared CAD and CAM logins, project files synced to personal cloud storage, and no written record of which systems touch CUI. Each of these is common, and each can be fixed before a prime or assessor asks.
Your contract clauses and flow-downs determine the level.
If you only handle Federal Contract Information, Level 1 applies: the 15 basic safeguarding requirements in FAR 52.204-21, confirmed by an annual self-assessment and affirmation.
If you receive or create CUI, such as controlled drawings, specifications, or test results, Level 2 applies, built on the 110 requirements of NIST SP 800-171.
Programs with the most sensitive CUI may require Level 3, which adds selected NIST SP 800-172 requirements and a government-led assessment.
Scoping, remediation, documentation, and assessment support.
We check each NIST SP 800-171 requirement against your environment, calculate your SPRS score, and give you a ranked remediation list.
We trace how controlled data flows and decide whether an enclave or a company-wide approach protects it at lower cost. Start with the scoping worksheet.
Documentation that describes your real systems and tracks remaining gaps with clear owners and target dates.
Multifactor sign-in, encryption, logging, endpoint protection, and backup, implemented and managed by our team.
Policies written around your daily work, with security awareness training and completion records.
Evidence mapped to each requirement and coordination with an independent C3PAO.
We review your contracts, the information primes share with you, and your current systems, then send a summary of risks and priorities.
We define scope, recommend an enclave or whole-company approach, and price the work as a project or as part of managed IT.
We close gaps, write the SSP and POA&M, organize evidence, and stay involved through affirmations and assessment.
Requests are prioritized by business impact and measured in business hours.
| Priority | First response | Example |
|---|---|---|
| Critical | 1 hour | Server down, office cannot work, suspected breach |
| High | 2 hours | Email or internet down for a user or team |
| Medium | 4 hours | Printer down, but a workaround exists |
| Low | 8 hours | New user setup, scheduled changes |
CMMC Certified Professionals and CyberAB Registered Practitioners on staff.
We prepare you, and an independent C3PAO performs the assessment.
The team that manages your systems also builds the controls.
Our Utah office is close to suppliers across the Salt Lake Valley.
We keep CUI on as few systems as possible to control cost.
Yes. DFARS 252.204-7012 still requires NIST SP 800-171 for CUI, and Federal Contract Information has basic safeguarding requirements. CMMC rollout details keep changing, so see Where CMMC Stands Today on our CMMC Compliance page for the current status.
Possibly. If the drawings or specifications you receive are CUI, or your purchase order includes CMMC clauses, the requirements apply to you.
Often. Keeping CUI on a small, well-protected set of systems and users narrows the assessment scope and lowers cost.
No. An independent C3PAO performs Level 2 certification assessments. We prepare you and coordinate with the assessor.
Yes. Our office is in West Valley City, and remote support covers Ogden, Utah County, and the rest of the state.
Readiness projects are quoted after the discovery call and review, based on scope. For ongoing managed IT and security, on average, clients invest about $100 per user per month, with a 10-user minimum. Pricing is per user and per device, month to month for smaller teams, and annual with a 90-day out for larger organizations.
Your contract or purchase order clauses, a list of systems that handle customer data, and the people who use them. The CUI scoping worksheet helps organize it.
Do you know exactly where CUI lives in your business? The BlueKey IT worksheet takes you through your contract clauses, how CUI moves through your company, which CMMC asset category each system belongs to, and the smallest boundary you can defend. It is a planning tool, not legal advice, a CMMC assessment, or a certification.
Prefer to talk it through? Schedule a discovery call and we will review your contracts and security controls, then lay out a clear plan.
Related services: managed IT services in Utah, CMMC compliance for defense contractors, and what is CMMC certification.
