About Custodia and David Fuentes III

CMMC did not appear from nowhere. The maturity model behind it was built at Carnegie Mellon’s Software Engineering Institute, and that same program trains the security professionals who now carry it into the field. David Fuentes III is one of them.

He spent years inside the discipline of federal information security, then watched small contractors get priced out of the work they were qualified to do, not because they were not secure, but because the paperwork to prove it was written for auditors and consultants, not for the owner of a five-person machine shop.

So he built Custodia. A guided platform that walks any owner through all 15 FAR 52.204-21 safeguarding requirements in plain English, drafts the System Security Plan and SPRS affirmation from real answers, and keeps the posture watched year-round. Then he wrote the book, so the do-it-yourself path is documented too. The goal is the same either way: any honest small business should be able to secure itself and bid on federal work without hiring a compliance department.

Custodia is veteran-owned and operated, based in Pittsburgh, Pennsylvania, and focused entirely on CMMC Level 1 for small defense contractors and the subcontractors in their supply chain.