AI Infrastructure for a Defense Contractor Preparing for CMMC 2.0
Frontier-grade AI productivity across 20 years of business-development content — without a single controlled document, or its derived index, leaving the perimeter.
Defense contractor. Name redacted at their request.
The Problem
A defense contractor needed to bring AI into business development — not engineering. Contract negotiation, marketing content, and 20 years of institutional knowledge sat in a proprietary CRM they couldn't risk exposing to third-party APIs. They were mid-preparation for CMMC 2.0, meaning third-party auditors — not internal self-attestation — would soon verify every control. Anything built had to be audit-ready from day one, not retrofitted later.
Internally, they lacked the GPU/inference expertise, Kubernetes fluency, and LLM tooling knowledge to scope, let alone build, a compliant solution. Prior consultants offered strategy decks, not deployable infrastructure.
The Solution
DPLYD deployed fully managed, on-prem AI — inference and infrastructure-as-a-service, repeatable and consistent, running inside the contractor's perimeter. The core engineering:
Bridged Linux ↔ Windows environments
Custom services spanning SMB shares so inference could reach content wherever it lived.
Inherited access control
Existing document-level ACLs were ingested and enforced at the inference layer, so search results always honored pre-existing security profiles.
Crawl-walk-run rollout
Phased deployment so the organization adopted capability at a pace matched to its own operational maturity.
The Outcome
Zero egress
Frontier-grade AI productivity without a single document — or its derived index — leaving the contractor's boundary.
20 years, searchable
Two decades of BD content made queryable in place, without exposing controlled data to frontier models.
Posture inherited, not bolted on
CMMC-ready throughout the deployment, rather than requiring a rebuild before assessment.
Security posture was inherited, not bolted on — CMMC-ready throughout, not rebuilt before audit.
Why This Matters Broadly
Defense contractors face a shared bind: real AI value sits in unstructured, decades-deep, proprietary content — but frontier models and cloud indexing are structurally incompatible with controlled environments. The same bind shows up for law firms holding privileged work product and health systems holding PHI. The fix isn't a thinner AI tool; it's moving inference and the index inside the perimeter, inheriting the access controls and audit posture the organization already built. That's the model DPLYD now productizes across defense contractors and every other regulated vertical.