ST. LOUIS and CHESAPEAKE, Va., Aug. 17, 2026 — Avatara, a provider of compliant IT systems-as-a-service, and AVMAC LLC (AVMAC), an aviation and maritime technical services company supporting the U.S. Department of War (DoW), today announced that AVMAC has achieved Cybersecurity Maturity Model Certification (CMMC) Level 2 using Avatara Platform for Government, receiving a maximum score of 110 with no Plan of Action and Milestones (POA&Ms).

“AVMAC is proud to achieve this important milestone,” said Bert Ortiz, Founder, President and CEO of AVMAC. “Avatara Platform for Government supports all 110 CMMC Level 2 controls, while allowing us to inherit approximately 80% of the 320 underlying assessment objectives on Day 1. Achieving this critical milestone validates our hard work and reinforces our commitment to safeguarding Controlled Unclassified Information (CUI) within the defense supply chain.”

AVMAC’s independent CMMC Level 2 assessment was conducted by a leading C3PAO assessment team, validating the company’s implementation of the security requirements necessary to protect CUI. Avatara Platform for Government served as the secure IT foundation for AVMAC’s environment.

“AVMAC’s achievement is a powerful real-world validation of the model we’ve built at Avatara,” said Rob McCormick, founder and CEO of Avatara. “We built Avatara Platform for Government so defense contractors can operate within a secure, compliant foundation and inherit a significant portion of the technical responsibility rather than assembling a compliant environment themselves. AVMAC’s success demonstrates what this model can achieve when paired with a committed, prepared and collaborative customer.”

For AVMAC, achieving CMMC Level 2 represents more than meeting a cybersecurity requirement. It gives customers, prime contractors and government contracting organizations independent verification that AVMAC has implemented the required safeguards for handling CUI.

“Independent verification creates another level of trust,” Ortiz said. “When the Department paused the transition to Phase 2 for a 60-day review, we decided to keep moving forward because these cybersecurity responsibilities aren’t going away. Other companies may be waiting to see what happens next, but we’ve already crossed the line. For us, that is a significant competitive advantage.”

From Compliance Readiness to Independent Validation

AVMAC began preparing for CMMC well before formal assessment requirements reached the company. As the longtime defense contractor grew, it needed to move beyond a decentralizedapproach to IT while keeping pace with evolving cybersecurity requirements that would increasingly determine eligibility for DoW business. For Ortiz, a 31-year U.S. Navy veteran, that meant finding a model that did not require AVMAC to build and manage complex compliant infrastructure or expand a dedicated internal IT organization.

AVMAC selected Avatara Platform for Government to consolidate its IT environment into a centralized, secure, compliant foundation for its CMMC journey. Built for organizations operating in highly regulated industries, the platform replaces fragmented tools, vendors and legacy infrastructure with one secure, all-inclusive environment designed to address cost, complexity and compliance.

“CMMC becomes significantly more manageable when security and compliance are engineered into the IT environment from the beginning,” said Brandon DiMemmo, Vice President of Product at Avatara. “Avatara Platform for Government provides customers with a centralized, standardized environment where infrastructure, security controls and operational processes are designed to work together as a system. That platform model enables customers like AVMAC to inherit much of the technical implementation required for CMMC rather than having to assemble and manage those capabilities piece by piece.”

Throughout the process, Avatara played a central role in helping AVMAC align the platform’s inherited safeguards with the company’s remaining responsibilities, updating documentation, clarifying scope and preparing for the C3PAO assessment.

Avatara Platform for Government achieved FedRAMP Moderate Equivalency in April 2026, establishing the platform foundation for organizations handling sensitive defense data. Avatara subsequently launched its Mission Ready Offering (MRO), combining compliant infrastructure, operational support, documentation acceleration and C3PAO assessment coordination to help defense contractors move toward assessment readiness faster and with greater predictability.