JPL doesn’t
build weapons.
Its contractors build
everything else. CMMC still applies.
Pasadena’s defense character doesn’t look like a prime contractor’s supply chain. It looks like a research ecosystem. JPL, managed by Caltech for NASA, anchors a dense cluster of contractors and subcontractors doing propulsion research, space systems engineering, and advanced materials science, much of it dual-use and cross-agency, touching NASA, DoD, and intelligence community programs simultaneously. The Caltech engineering ecosystem feeds spinout companies, technical consultancies, and boutique R&D shops along the Colorado Boulevard corridor and throughout Old Pasadena. Advanced propulsion firms, materials science labs, and space systems engineering companies working directly with program offices, not just flowing down from a prime. CUI in this ecosystem often carries research classifications and export control markings that go beyond a standard manufacturing SOW, and CMMC reaches every one of them.
Intelecis is headquartered in Fullerton, and guides Pasadena JPL-adjacent contractors, Caltech-linked R&D firms, advanced propulsion and materials science shops, and defense-adjacent engineering consultancies through CMMC Pasadena from gap assessment to C3PAO-ready, without disrupting research operations or losing a single contract in the process.
✓ NSA-Accredited ✓ NIST 800-171 Specialists ✓ 111 Five-Star Reviews
✓ Orange County HQ · Fullerton, CA ✓ Founded 2010
CMMC Compliance Pasadena, The Risk
A prime relationship
quietly ends.
That’s how it looks.
The Pasadena exposure is rarely loud. It’s a research contract that quietly isn’t renewed because the program office can’t verify your CUI protection. A propulsion research subcontract that moves to a certified competitor in the same JPL supplier ecosystem. A materials science engagement that stops because the prime managing the funding needs a defensible SPRS score you can’t produce. Program offices working with JPL contractors and Caltech-linked R&D firms can already see supplier compliance status, and dual-use research contractors face scrutiny from multiple agencies at once, not just DoD.
The DFARS CMMC Final Rule took effect November 10, 2025. Phase 1 is live. Phase 2 in November 2026 reaches existing option periods and recurring research engagements that Pasadena JPL-adjacent contractors, Caltech-linked R&D firms, and advanced propulsion companies live on, not just brand-new awards. And the DOJ’s Civil Cyber-Fraud Initiative is actively pursuing False Claims Act cases against research contractors whose SPRS scores aren’t backed by defensible documentation.
- Could you defend your SPRS score to your prime's compliance team today?
DFARS 252.204-7019 requires a current, documented self-assessment on file.
- If your prime dropped you from an approved supplier list tomorrow, would you know why?
Primes are required to flow CMMC requirements down, and aren't required to explain removals.
- Could your team report a CUI breach to the DoD within 72 hours, tonight?
DFARS 252.204-7012 requires rapid incident reporting. Most Pasadena shops have no plan.
Most research firms call us after the bad news. A subcontract that quietly wasn’t renewed. A proposal excluded from consideration because the program office flagged missing compliance documentation. A joint research agreement that moved to a certified lab. Pasadena’s research ecosystem is small and tightly networked. Word travels fast when a firm loses a JPL-adjacent contract over compliance, and travels just as fast when a firm gets ahead of it. Under CMMC, the firms that certify quietly keep the research relationships. The ones that don’t lose them the same way, quietly.
How It Works
From exposed
to certified.
Three phases. One SoCal-based consultant. No handoffs to offshore teams or junior staff. The same expert manages your program from kickoff through certification and every renewal after, built around how Pasadena JPL-adjacent contractors, Caltech-linked R&D firms, and advanced propulsion and materials science companies actually operate.
Gap Assessment & SPRS Scoring
We evaluate your entire Pasadena environment against all 110 NIST 800-171 controls, engineering workstations, production and test areas, server rooms, field laptops, shared mailboxes, and prime-portal access, calculate your accurate SPRS score, and document every gap. We develop your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) in plain language and guide you through submitting your score to the SPRS portal with defensible supporting documentation.
Remediation & Control Implementation
We help implement the controls needed to close every gap, access management, MFA, endpoint protection, audit logging, incident response planning, policy documentation, and staff training across your engineering, production, and back-office operations. A gap report you have to act on yourself isn’t compliance, it’s homework. We do the work alongside your team so your C3PAO assessor finds nothing outstanding.
Certification & Ongoing Protection
We prepare full evidence packages, run mock assessments, and walk your team through the C3PAO audit. One certification covers every prime relationship and federal customer you serve. After certification we monitor your posture continuously, so annual affirmations and triennial renewals never catch you off guard, and your recurring SOWs and POs never quietly stop renewing.
The Three Levels
Getting the wrong level
costs you the contract.
Certification at the wrong level means your certification doesn’t satisfy your contract requirements, even after all the work is done. Most Pasadena JPL-adjacent contractors, Caltech-linked R&D firms, and defense-adjacent engineering consultancies fall under Level 2, but Pasadena’s research density means Level 3 exposure through classified or sensitive national security research programs is more common here than in most LA County cities.
Foundational
1
Basic Cyber Hygiene
For subcontractors handling Federal Contract Information without access to CUI. Annual self-attestation, no third-party auditor required.
- Based on FAR 52.204-21
- Annual company affirmation
- No C3PAO assessment required
Most Common in Pasadena
2
Advanced Cyber Hygiene
For contractors handling Controlled Unclassified Information. If a program office, prime, or research sponsor connected to JPL, NASA, or DoD-funded research passes you technical data, research specifications, or engineering deliverables carrying CUI markings, this is almost certainly your level, and it applies to the majority of Pasadena JPL-adjacent contractors, Caltech-linked R&D firms, and advanced propulsion companies.
- Mandatory C3PAO third-party assessment
- Annual affirmation between cycles
- Aligned to NIST SP 800-171
- 3-year certification cycle
Expert
3
Expert Cyber Hygiene
For Pasadena firms supporting the DoD’s most sensitive programs, advanced systems, classified research, and critical national security work.
- Government-led DCMA assessment
- Based on NIST SP 800-172
- Designed to defend against nation-state threats
CMMC Pasadena, By the Numbers
Pasadena hosts one of the densest concentrations of dual-use defense and space research contractors in the country, anchored by JPL and Caltech.
JPL-adjacent contractors and subcontractors doing propulsion research and space systems engineering. Caltech-linked R&D firms and technical consultancies spun out of the university’s engineering programs. Advanced materials science labs supporting defense and aerospace applications. Space systems engineering firms working directly with program offices. Old Pasadena technical consultancies along the Colorado Boulevard corridor. Every one of them is inside the NASA, DoD, and intelligence community research supply chain, and CMMC reaches all of them.
110
NIST SP 800-171 controls that apply to your Pasadena operation the moment any prime or naval contracting officer passes CUI to you
180d
POA&M closure window under conditional CMMC certification, miss it and your cert and contract eligibility lapse together
Nov’25
DFARS CMMC Final Rule effective, every prime relationship and DoD customer you serve is subject to Phase 1 requirements right now
3×
False Claims Act penalty multiplier on inaccurate SPRS submissions, personally exposing the owner or officer who signs
Why Intelecis
Built around security.
Not bolted onto it.
Most IT companies added CMMC to their service menu when contracts started requiring it. Intelecis built its practice around advanced cybersecurity, including classified military and intelligence environments, long before CMMC existed. We’re based in Fullerton, and we work with Pasadena JPL-adjacent contractors, Caltech-linked R&D firms, advanced propulsion and materials science companies, and defense-adjacent engineering consultancies every week.
Military Security Foundation
Our team brings classified military intelligence experience to every engagement. NSA-accredited for Cyber Incident Response Assistance, one of the only firms in Southern California that can make that claim. This isn’t a marketing credential. It’s the difference between compliance on paper and compliance that holds up.
We Help Close Gaps, Not Just Name Them
A gap report you have to act on yourself isn’t compliance, it’s homework that sits on someone’s desk. Intelecis helps implement every missing control, policy, and documentation requirement alongside your team. When your C3PAO assessor arrives, there’s nothing left to find.
One Consultant, Start to Finish
No ticketing systems. No rotating junior staff. No explaining yourself to someone new every month. A dedicated Intelecis consultant manages your compliance program from kickoff through certification and every renewal after, the same expert, the same relationship, throughout.
Full Documentation, Walk In Ready
SSPs, POA&Ms, policies, and evidence packages, all built and maintained by Intelecis. You walk into assessment day with every document organized, current, and defensible. Not scrambling to find the right file the night before.
Compliance That Doesn’t Expire
CMMC requires annual affirmations and triennial re-assessments. Most firms pass certification and then drift. Intelecis monitors your posture continuously, so your certification and your contracts never quietly expire while you’re focused on running the business.
Pasadena & JPL-Adjacent R&D Specialists
JPL-adjacent contractors and subcontractors doing propulsion research and space systems engineering. Caltech-linked R&D firms and technical consultancies. Advanced materials science labs. Space systems engineering firms working directly with program offices. We know how Pasadena’s research ecosystem actually operates, the cross-agency funding, the dual-use research classifications, the export control overlays, the tightly networked reputational risk when a compliance gap surfaces, before we ever walk in the door. CMMC Pasadena is what we do.
Who It Applies To, Pasadena
If a prime
passes CUI to you, this is you.
CMMC requirements flow through every tier of the LA County defense supply chain, including small Pasadena subcontractors that never see a direct DoD contract. If a prime, naval contracting officer, or program office passes CUI to you, you’re in scope.
JPL-Adjacent Contractors
Contractors and subcontractors doing propulsion research, space systems engineering, and mission hardware development connected to JPL and NASA-DoD cross-agency programs.
Without CMMC: your research subcontract moves to a certified competitor in the same ecosystem.
Caltech-Linked R&D Firms
Spinout companies, technical consultancies, and boutique R&D shops connected to Caltech’s engineering programs, producing deliverables for DoD, NASA, and program office clients.
Without CMMC: your funding agency flags your proposal as non-compliant before review.
Advanced Propulsion Research
Firms doing propulsion systems research and development, often dual-use across NASA, DoD, and commercial space programs with overlapping export control requirements.
Without CMMC: cross-agency funding relationships end quietly, one at a time.
Materials Science & Advanced Manufacturing
Materials science labs and advanced manufacturing R&D firms supporting defense and aerospace applications, often working from CUI-marked technical specifications.
Without CMMC: your research results can't be delivered to the sponsoring agency.
Space Systems Engineering
Space systems engineering firms working directly with program offices on satellite, spacecraft, and mission systems engineering, frequently holding CUI-marked mission data.
Without CMMC: your engineering contract doesn't get renewed at the next program milestone.
Old Pasadena Technical Consultancies
Engineering consultancies and technical services firms clustered downtown and along the Colorado Boulevard corridor, producing deliverables for defense and aerospace clients.
Without CMMC: your SOW won't be renewed, even if your technical work is excellent.
Common Questions
Answered
plainly.
No acronym soup. No compliance theatre. Direct answers to what Pasadena JPL-adjacent contractors, Caltech-linked R&D firms, and advanced propulsion companies actually ask, and what it means for your business.
Our contract is with NASA or JPL, not the DoD directly. Does CMMC even apply to us?
Often yes, and this is the single most misunderstood scoping question in the Pasadena research ecosystem. CMMC itself is a DoD program, but a substantial share of JPL and Caltech-linked research is dual-use or cross-agency, meaning the same technical data, propulsion research, or space systems engineering work can carry DoD-relevant CUI even when your prime contract is with NASA. If your research touches ITAR-controlled technical data, export-controlled propulsion or materials science, or any DoD-funded portion of a larger program, you can be in CMMC scope regardless of which agency signs your primary contract. This gets missed constantly because researchers assume “NASA contract” means “not a DoD program,” which isn’t how CUI or export control actually works.
Our research is dual-use and touches multiple agencies. How do we know which compliance framework actually applies?
This is one of the hardest scoping questions in Pasadena’s research ecosystem, and it’s exactly why a generic IT provider gets it wrong. Dual-use research can trigger CMMC (DFARS 252.204-7012 and the CMMC rule), export control regimes (ITAR/EAR), and NASA-specific data handling requirements simultaneously, and they don’t always require the same controls. The right approach starts with a data inventory: what specific data your research generates or receives, which agency or program funded that portion of the work, and what markings (CUI, export-controlled, proprietary) actually attach to it. From there, your CMMC boundary can usually be scoped to the systems that actually touch DoD-relevant CUI, rather than assuming your entire research environment needs Level 2 certification. We map this precisely during the free account review rather than guessing.
How long does Level 2 certification take for a Pasadena firm?
For most Pasadena firms, 4 to 9 months from gap assessment to C3PAO certification. Small R&D consultancies and technical services firms with well-organized IT often land under 5 months. JPL-adjacent contractors, materials science labs, and firms with mixed lab, engineering, and computational environments typically need 5 to 7 months because the CUI boundary crosses lab equipment networks, research data storage, engineering workstations, and program portals that have never been formally inventoried. Firms with cross-agency funding (NASA plus DoD-relevant work) sometimes take longer because the SSP needs to scope which specific research touches CUI. Your free account review gives you a timeline specific to your operation.
We're a defense IT / MSP serving multiple SoCal defense clients. How does CMMC apply to us?
If any of your clients are defense contractors who handle CUI, you’re an External Service Provider (ESP) under CMMC, and your environment is in scope wherever you touch client CUI. Your clients are required to use ESPs whose CMMC posture matches the level their own contracts require, typically Level 2. The good news: one Intelecis-led certification gives you a credential you can offer across your entire defense client portfolio. The bad news: defense clients are increasingly required to move uncertified MSPs out of the picture entirely.
Can we actually lose contracts we've held for years?
Yes, and it usually happens quietly. You don’t get a formal notice. The research subcontract just doesn’t extend. The proposal isn’t advanced past initial review. You’re removed from a program office’s approved contractor list without an announcement. By the time you know, the work has moved to a certified lab or consultancy elsewhere in the same research ecosystem. CMMC is a go/no-go condition now, and Phase 2 in November 2026 reaches existing option periods and recurring research funding, not just new awards. Long-standing research relationships aren’t immune. In a tightly networked ecosystem like Pasadena’s, one lapse can cost you a reputation as well as a contract, and both travel fast among program officers who know each other.
What is the False Claims Act risk our owner keeps mentioning?
Under the DOJ’s Civil Cyber-Fraud Initiative, contractors who submit an inaccurate SPRS score can be prosecuted under the False Claims Act, which carries treble damages, 3× the contract value, plus per-claim penalties. This isn’t theoretical. The DOJ has already settled multiple cases. The exposure attaches personally to the executive who signs the attestation, not just to the company. For Pasadena suppliers, that’s usually an owner-operator, president, or VP. A score that isn’t based on a defensible, documented assessment puts that person’s name on the line, not just the firm’s reputation.
Book Your Free CMMC Account Review
Tell us about your Pasadena operation and the primes or defense customers you serve. We’ll tell you exactly what’s in scope, what CMMC requires, and what it would take to keep your contracts intact through Phase 2.
CMMC Pasadena:
protect the contracts
that built your business.
One conversation with an OC-based CMMC specialist. No obligation. You’ll know exactly where you stand on CMMC compliance Pasadena, and what it would take to protect your prime relationships, your SOWs, and your option-period renewals through Phase 2, before you commit to anything.
No pressure. No sales calls. Response within 1 business day.
LA County & SoCal Coverage
CMMC compliance across LA County:
every city, every market.
Intelecis serves defense contractors across all of LA County, from the South Bay aerospace corridor to the San Gabriel Valley engineering community. You’re viewing the Pasadena page; select another LA County city below for local CMMC compliance guidance specific to that market, or explore adjacent OC coverage.
The full LA County CMMC compliance overview, aerospace primes, defense electronics, space and satellite systems, and the country's largest defense supply chain.
A century of aerospace and maritime defense heritage. Aerospace manufacturers around Long Beach Airport, defense logistics through the Port of Long Beach, and the Seal Beach naval supply chain.
Cold War defense manufacturing heritage. Cal Poly-adjacent engineering, precision machining, and multi-county subcontractors feeding LA, San Bernardino, and OC primes.
Anchored by JPL and the Caltech ecosystem, the densest concentration of defense R&D, propulsion, and advanced engineering services in LA County.
Sits between Burbank aerospace, Pasadena R&D, and the LA basin primes. Defense electronics, precision fabrication, and professional services all feeding the same three clusters.
The LA aerospace access corridor. LAX-adjacent logistics, Century Boulevard manufacturers, and defense freight forwarders positioned inside every South Bay prime's supply lane.
Concentration of defense professional services, legal, financial, and consulting firms handling CUI on behalf of aerospace primes and program offices across LA County.
The full Orange County CMMC compliance overview, defense primes, supplier networks, and the major aerospace corridor immediately south of Pasadena.
A proud aerospace manufacturing heritage right across the OC county line. The deep subcontractor ecosystem here, machining, composites, electronics, is now fully in CMMC Level 2 scope.
Serving all of LA County, your city, your supply chain, your contracts.
Don't see your city listed? Call us, we cover the entire OC region and we'll get to you.
