Staying Certified: How Schnabel Engineering Maintains CMMC Compliance

Certification is the starting line. But, you need to stay compliant.

Schnabel Engineering began putting Department of Defense (DoD) security requirements into practice in 2017. When the company’s CMMC program was formally published, its IT team worked with Egnyte to build a dedicated secure data enclave for Controlled Unclassified Information (CUI). The company went on to achieve CMMC Level 2 certification through an independent third-party (C3PAO) assessment. Now the team's primary focus is maintaining compliance.

The compliance landscape is also shifting. The DoD's July 13th announcement paused CMMC Phase 2, yet NIST SP 800-171 and DFARS requirements still apply to DoD contractors. Maintaining a strong, clearly documented program is more important than ever.

Join Garrett McGowan, Information Security Manager at Schnabel Engineering, and Neil Jones, Director of Cybersecurity Evangelism at Egnyte, for a practical look at what it takes to maintain CMMC compliance after the initial assessment.

In this session, you'll learn:

• What the DoD's July 13th announcement means for your compliance obligations.

• How to keep documentation and evidence current, so you're always assessment-ready.

• How to prepare for annual affirmations and the three-year certification cycle.

• How to manage change (new projects, users, and systems) without expanding CUI scope or diluting controls.

• How to build the internal processes, habits, and reporting that make compliance sustainable.

Whether you are already certified or working toward it, you will leave with practical, experience-backed steps that can be taken right away.