Maya HTT Achieves a Perfect SPRS Score and CMMC Level 2 Certification
We were able to get a perfect score from the first audit. [The auditors] had no questions. Thank you, Virtru, for being part of this CMMC process because without it, we wouldn't have been able to complete it the same way.
Jonathan Bieber
IT Director and CISO
Maya HTT, a leading 3D engineering simulation software company serving the aerospace, defense, and automotive industries for over 40 years, needed to achieve CMMC Level 2 certification to continue working with U.S. Department of Defense customers. Based in Canada with a distributed workforce in the U.S., Maya HTT required a solution that could protect Controlled Unclassified Information (CUI) without forcing them into a costly government cloud environment.
Maya HTT ultimately achieved a perfect score on its first CMMC Level 2 audit, covering all 110 controls and opening doors to new defense contracts, with Virtru integrated into their existing Microsoft 365 environment.
The Result
With Virtru's end-to-end encryption for Microsoft Outlook as part of its tech stack, Maya HTT was able to achieve the following:
-
Perfect SPRS Score in CMMC Level 2 Assessment: Maya HTT achieved a flawless SPRS score on its first CMMC audit, with Virtru for Outlook and Virtru Secure Share as part of their tech stack.
-
Cost-Effective Compliance: Avoided expensive GCC High migration costs while maintaining CMMC compliance in their existing Microsoft Commercial Cloud environment.
-
Rapid Deployment: Implemented enterprise-grade encryption for email and file sharing in less than one month, with seamless Azure SSO integration and conditional access policies.
The Challenge: CMMC Compliance Without Breaking the Bank
Jonathan Bieber, IT Director and CISO at Maya HTT, had been preparing for CMMC requirements since the original NIST SP 800-171 framework. The company works with sensitive engineering data (including CAD files and simulation results for aerospace and defense projects), and it required robust protection to share that data among stakeholders. "We work with the governments in the U.S. and in Canada, as well as the Department of Defense, and that's why we went with the CMMC Level 2 certification," Bieber explained.
Maya HTT was previously using FileCloud for secure file exchange, but as CMMC Level 2 requirements evolved, the company needed a more comprehensive solution that could handle both encrypted email and secure file sharing. The challenge was particularly acute given Maya HTT's unique position as a Canadian company with employees in both Canada and the U.S.
When evaluating options, the team quickly discovered that Microsoft's GCC High SKU — the government cloud offering designed for CUI — presented significant obstacles. "I remember looking at GCC High, and it was really expensive," Bieber noted. "But also, you need to be DoD registered if I'm not mistaken, and we're not. So we're not able to access that." Furthermore, managing multiple Azure tenants would have created additional complexity and administrative burden for the IT team.
Bieber evaluated four encryption and data protection solutions, comparing them against CMMC requirements, licensing flexibility, and ease of deployment. "Some did not meet the requirements. Some were not allowing us to have as low as five licenses," he explained. The company needed a solution that could scale with their business without requiring a massive upfront investment.
The Virtru Difference: Integration with Microsoft Email and File Workflows
Virtru stood out because it allowed Maya HTT to maintain their existing Microsoft Commercial Cloud infrastructure while achieving CMMC compliance. "Having a solution that comes into the current environment that we have, was really a plus," Bieber said. Rather than migrating to a separate government cloud tenant, Virtru integrated directly into their Outlook environment and leveraged the existing Azure Active Directory for identity management.
This architectural approach provided multiple advantages. "Virtru comes as an add-in for Outlook," Bieber explained. "It integrates with the SSO part of Azure for the identity management. And that was really a big plus for us because we are in Canada. We don't want to touch this information. We should not touch this information anyway. So, we were able to leverage the conditional access policies and then say, well, only our employees in the U.S., duly authenticated with our environment, can access Virtru — so we're able to secure the environment and the access to it."
When presenting this architecture to their CMMC assessors, the response was overwhelmingly positive. "That's the way we presented it to the auditors, and they really liked the idea," Bieber recalled. "They had no questions."
Pricing also played a key role in the decision. "Virtru was, in all aspects, addressing our requirements. It satisfied the minimum license that we needed because we don't do intensive CUI-related work in the US," Bieber noted. "But now, with the CMMC certification, it also opens doors — so we might do way more. But, also, the pricing was a plus. Being able to size down and size up is a great asset."
Deployment: From Evaluation to Production in Under a Month
The deployment process moved quickly thanks to Virtru's user-friendly interface and comprehensive documentation. "I would say it was relatively easy," Bieber explained. "It was less than a month from the beginning to the end."
The IT team followed a structured approach: Testing and reviewing the platform over several days, documenting it within their security processes, and designating a power user in the U.S. to manage licenses and administration. "Every time I ask a question, he's able to quickly find information — whether it's on the interface or from the user documentation," Bieber noted. "Virtru has good documentation, which really helps."
For end users, adoption was seamless. "I do like the integration in Outlook. It's very convenient," Bieber said. The team created template emails with guidelines and ran a few tests, and deployment was complete. "Everyone is very happy with the solution. We haven't had any support or complaints or anything to do."
The administrative interface also proved valuable during the CMMC audit process. "When we were going and collecting the evidence for the CMMC... when I requested the evidence from our power user, he was able to provide everything," Bieber explained. "That also confirms that it was the right tool for us."
The Value: CMMC Certification Opens New Doors for Business Growth
Maya HTT's CMMC Level 2 certification process took over a year of dedicated work to cover all 110 security controls. The company engaged consultants to perform gap analysis and ensure comprehensive compliance, ultimately achieving something rare: "We were able to get a perfect score from the first audit and have everything cleared out of the way," Bieber shared.
Virtru played a central role in several critical CMMC control areas. The platform's encryption capabilities, audit trails, role-based permissions, access revocation features, and identity management integration addressed numerous requirements. "With Virtru, the security of the platform is what you're providing to us. The compliance part is all those different features — the audit trails, the roles, the permissions, the ability to revoke sharing access, how you protect the identity, the sharing, and all that," Bieber explained.
Beyond compliance, Virtru delivers operational value for Maya HTT's day-to-day business. The company regularly exchanges large CAD files and simulation results with defense and aerospace customers. "Sometimes customers use their own platform for file exchange, which is always what we prefer, because we don't want to have that information for too long in our environment," Bieber noted. "But when we have no choice, when the customer doesn't have a solution, this is where Virtru takes place. And we know that at every part of the process, the information will be protected."
The encryption happens transparently for users while maintaining strong security. "By default, information cannot be displayed to someone else's eyes because you do need to confirm that you want to decrypt the content before accessing it," Bieber explained. "If you set it properly, even if you travel outside the country, your data is saved and protected and cannot be accessed."
Perhaps most importantly, Maya HTT’s CMMC certification has opened up new business opportunities. For a company specializing in aerospace and defense simulation software, including work that has literally gone to Mars, maintaining and expanding their defense contractor relationships is essential.
Looking back on the journey, Bieber reflected on what made success possible: "Thank you, Virtru, for being part of this CMMC process because without it, we wouldn't have been able to complete it the same way." His advice to other organizations pursuing CMMC certification emphasizes the importance of partnership: "Make sure you have people on board, because otherwise, alone, it's going to be a very long journey. And that's where Virtru as a partner takes its place."
/Arkansas-Case-Study-Virtru.webp)
