How Monte Sano Research Achieved CMMC Level 2 with Virtru

"Monte Sano's CEO actually trusted in the team, that we knew what to do, and the vision we had for MSRC," says Jimmy Miller, IT Systems Manager at Monte Sano Research Corporation. "He actually said that to us face to face and that was the first person that I've ever had do that to me at any company."

That trust proved well-placed. In June 2026, Monte Sano Research achieved CMMC Level 2 certification, successfully navigating what Miller describes as "by far the most intense audit" of his 15-year IT career. On deck in their certification strategy was Virtru, providing the CUI transmission capabilities that satisfied both rigorous assessors and the practical needs of a 180-person defense contractor bridging the "valley of death" for Army missile systems.

The Result

With Virtru for Outlook and Secure Share, Monte Sano Research is able to:

• Encrypt CUI in Outlook with end-to-end protection that satisfied CMMC Level 2 assessors and FedRAMP requirements while replacing Microsoft Information Protection failures that had plagued Army collaboration
• Exchange files securely using Virtru Secure Share, allowing partners to upload and download sensitive files without desktop installations or enclave access
• Support flexible licensing through distribution groups, eliminating the need for per-user licenses while maintaining security across the organization
• Build operational confidence in their Azure enclave environment, knowing CUI protection meets both compliance requirements and real security standards

Bridging the Valley of Death

Monte Sano Research Corporation takes Army missile concepts from science and technology through engineering, research and development, prototyping, demonstration, and testing all the way to programs of record. Their engineers and scientists design, simulate, test, and prototype complete end-to-end missile systems: sensors, seekers, guidance and navigation control, warheads, rocket propulsion, fire control, launchers, and ground support equipment.

If you've seen or heard of an Army missile system, Monte Sano Research employees likely conceived it, designed it, simulated it, tested it, and prototyped it.

This kind of work demands absolute protection of controlled unclassified information. When Jimmy Miller, IT Systems Manager, came on board at Monte Sano Research, CMMC requirements had just become clear, and he immediately assessed the company's network for compliance readiness. What he found was a fractured approach to CUI transmission. The organization was using Microsoft Information Protection for data labeling, S/MIME certificates in Outlook, and DoD SAFE when it was available. None of it was working consistently.

None of it was working consistently.

When Microsoft Information Protection Failed

The problems with Microsoft's data labeling feature were immediate and persistent. Army users on a partner’s network would send documents to Monte Sano Research with labels automatically applied.

"When they would have any kind of documents, the labels would get adhered to the documents when they would get sent to us," Miller explains. "When we would open them up in our network, [Microsoft’s solution] would fail continuously and we just had all kinds of issues with the data labeling."

User complaints mounted. The team needed one standardized, reliable method for transmitting CUI that would satisfy CMMC Level 2 assessors and actually function for daily operations. That's when Alyssa, Jimmy's colleague, spotted Virtru in an email signature promoting secure sending.

"We started researching, got with Virtru, and liked the product," Miller recalls. The team implemented Virtru for CUI transmission within their Azure enclave, taking advantage of distribution group licensing. "We could do the distribution group, so we didn't have to have a license for every individual user. That works perfectly."

The Most Intense Audit

The CMMC Level 2 assessment ran remotely through Microsoft Teams, with sessions from 9 AM to 3 PM over multiple days. Assessors reviewed documentation, randomly selected controls to verify via screen share, and scrutinized every technical and administrative detail.

"They were real big on documentation; not so much having your commas and periods in place, but the titles of the documents, the signatures of the officials, all that has to be in place," Jimmy explains.

The assessors approved Virtru's FedRAMP and compliance certifications without issue. But they pressed on one specific requirement: explicit user-initiated CUI labeling. Monte Sano Research demonstrated Virtru's persistent file protection and watermarking capabilities, showing that all transmitted data was treated as CUI by default. The assessors wanted more. They wanted users to affirmatively mark content as CUI, mirroring the Microsoft Information Protection model the company had already abandoned.

Miller created a workaround: mail flow rules that automatically encrypted anything with "CUI" in the subject line or attachment metadata. While somewhat cumbersome (the word "CUI" could appear in non-CUI contexts, triggering false positives), it satisfied the assessors and allowed Monte Sano Research to maintain Virtru as their transmission standard.

By mid-week, the assessment wrapped early. On Friday, the executive team received confirmation: CMMC Level 2 certified.

Building Confidence in CUI Protection

Monte Sano Research successfully submitted their first proposal through the new enclave with Virtru protecting CUI throughout the process. Beyond achieving certification, Virtru delivered the user experience that Microsoft Information Protection had failed to provide.

"I love the easy log on, the verify me link in the email where you don't have to enter a code," says Jimmy. "I love Secure Share; it's a web app, so there's no desktop application that I need to install or be in an enclave that has to be more secure."

During testing, Miller validated Virtru's recipient experience across Gmail, Yahoo, and other external accounts. "Every account that I used, the login was exceptional." When third parties received Virtru-protected content during the gap analysis phase, the feedback was consistently positive.

Beyond the technical capabilities, the partnership itself stood out. "Virtru’s on top of the game as far as getting back with us and making sure that we stay in contact," Miller notes. "They seem to have an extra care about the company and the future of it. Whereas others, it's not really there."

Most importantly, Virtru provided what Monte Sano Research needed for the three-year certification period ahead.

"It gives us the confidence to know that we have a platform that we can transmit and protect CUI the way we're supposed to for the government," Miller explains. "We know what to expect from our subs and all that and the flow down of CUI. It just makes us more confident in the whole game."