About Custodia and David Fuentes III
Custodia exists for one reason: to put audit-grade CMMC Level 1 compliance in the hands of the small business owner who never signed up to be a cybersecurity expert. It is built and run by a compliance professional, not a faceless software vendor.
David Fuentes III
Founder and Lead Compliance Officer, Custodia. Pittsburgh, PA.
CMMC did not appear from nowhere. The maturity model behind it was built at Carnegie Mellon’s Software Engineering Institute, and that same program trains the security professionals who now carry it into the field. David Fuentes III is one of them.
He spent years inside the discipline of federal information security, then watched small contractors get priced out of the work they were qualified to do, not because they were not secure, but because the paperwork to prove it was written for auditors and consultants, not for the owner of a five-person machine shop.
So he built Custodia. A guided platform that walks any owner through all 15 FAR 52.204-21 safeguarding requirements in plain English, drafts the System Security Plan and SPRS affirmation from real answers, and keeps the posture watched year-round. Then he wrote the book, so the do-it-yourself path is documented too. The goal is the same either way: any honest small business should be able to secure itself and bid on federal work without hiring a compliance department.
Custodia is veteran-owned and operated, based in Pittsburgh, Pennsylvania, and focused entirely on CMMC Level 1 for small defense contractors and the subcontractors in their supply chain.
Secure Your Business. Win Contracts.
The do-it-yourself CMMC Level 1 field guide for small DoD contractors. All 15 FAR 52.204-21 safeguarding requirements, the SSP and the affirmation, plain English, start to finish.