Leading CMMC readiness through policy and practice

The challenge

Preparing GoHPT for CMMC Level 2 required more than a technology solution. Policies needed to reflect how the business actually operated while introducing targeted changes to address identified deficiencies. Turning those policies into everyday practice required changes in working habits across the organization, including executive leadership.

My responsibility

I championed and led GoHPT’s CMMC migration: researching and selecting a vendor, building the enclave, and writing policies and standard operating procedures. My responsibility also included helping people understand and adopt the changes required in their day-to-day work.

From immediate fixes to accountable change control

One practical challenge was shifting from unilateral hardware decisions made to meet immediate business needs toward a documented review and approval process.

I implemented a change-control policy requiring proposed hardware additions and changes to undergo Change Control Board (CCB) review and approval. The policy supports business needs while ensuring changes are evaluated for security and operational impact, documented, and tracked.

Progress and ongoing work

The change-control policy is implemented. My ongoing focus is improving adoption and consistent adherence across the organization, including executive leadership.

CMMC assessment and certification are pending. This case study describes preparation and policy implementation, not a completed assessment or certification.

Leadership perspective

Policy needs to work in the business it governs. The leadership challenge is preserving responsiveness to business needs while building the review, accountability, and everyday habits that make change control effective. Writing the policy establishes the expectation; consistent adoption remains an ongoing leadership responsibility.