Fractional COO and US market entry questions, answered before the first call.

A fractional COO is an embedded operating leader who runs your operations part-time, not an advisor who hands you a report and leaves.

I sit with your direct reports, own outcomes against your numbers, and stay until the system holds on its own.

It does not, as of July 2026.

On July 13, 2026 the Department suspended CMMC Phase II, the mandatory third-party certification step originally scheduled for November 10, 2026, and stood up a reform task force. No replacement date has been announced. Phase I, which began November 10, 2025, remains in force: a Level 2 self-assessment every three years against the 110 NIST SP 800-171 Rev 2 requirements, with annual affirmation into SPRS. The Department stated that the suspension does not eliminate the requirement to protect information under DFARS clause 252.204-7012.

No.

DFARS 252.204-7012 still requires you to safeguard covered defense information and report incidents, as the Department said when it announced the suspension on July 13, 2026. Phase I self-assessment and annual affirmation remain in force, your prime cannot award you covered work without a current assessment posted, and a false affirmation carries False Claims Act exposure today. The reform task force aims to lower barriers for small, medium, and non-traditional businesses and replace bureaucratic compliance with scalable, resilient cybersecurity measures. A shop that built the 110 controls into the daily workflow is ready for whatever the review returns.

Most small defense manufacturers spend roughly 100,000 to 200,000 dollars to reach Level 2, per CMMC.com.

DoD published estimates put a Level 2 self-assessment at 37,000 to 49,000 dollars and a Level 2 C3PAO assessment at 105,000 to 118,000 dollars, before remediation. With Phase 2 suspended as of July 2026, the self-assessment is the live path. Either way the money goes into the same 110 controls; built into your workflow, that spend buys a working system instead of a binder.

The Hidden Factory is the undocumented rework, tribal knowledge, and off-the-books problem solving your ERP never records.

Quality pioneer Armand Feigenbaum estimated this loss can reach 40 percent of total company effort. The 30-Day Operational Triage finds it and converts it back into capacity and cash.

Every engagement is scoped to the constraint, so a rate card would price the wrong thing.

The 30-Day Triage is fixed-price against a defined deliverable, the fractional COO work is a retainer, and a strategic consult is a paid time-boxed session. We agree the scope and the number in the strategic conversation, before work begins.

I work in ITAR, DFARS, CMMC 2.0, AS9100, and CUI handling directly, as part of the operating system rather than a separate workstream.

Where a CMMC IT partner is the right tool for a control, I bring one in as an input to the system I architect. The operations layer stays mine.

A paid strategic consult is available now, without waiting for a full slot.

Full engagements open as an existing one reaches Phase 3, because I run a maximum of four at a time. If your trigger is time-critical, name it and I respond within 48 hours with a realistic window.

Most engineering-led shops can do the work but cannot see the constraint, because the people closest to it are inside it.

I bring an outside operator's read of your value stream plus the defense-compliance fluency most internal teams have not built yet. The 30-Day Triage is built for a capable team that is operationally bottlenecked.

The Supplier Performance Risk System holds your self-assessed NIST SP 800-171 score.

Your prime cannot see it: under DFARS 252.204-7020(f) the score is visible to DoD personnel and to you. The lever your prime holds is harder. Under 252.204-7020(g)(2) it may not award you a subcontract subject to NIST SP 800-171 unless you have completed at least a Basic assessment within the last three years. A stale assessment does not cost you points. It takes you off the award. A wrong or stale score is also a false-affirmation risk, and the DOJ Civil Cyber-Fraud Initiative pursues that under the False Claims Act. With CMMC Phase 2 suspended as of July 2026, that self-assessment and its annual affirmation are the mechanism being enforced. Getting the score right and defensible is part of the Sovereign Tier pillar.

Yes.

I am standing up US defense manufacturing operations for a Canadian-parent subsidiary now. The work covers the operating model, the IT and OT build, and the compliance posture you need to qualify for US defense business.

A facility clearance lets a company access classified information.

Foreign Ownership, Control, or Influence mitigation is what a foreign-owned company negotiates with the Defense Counterintelligence and Security Agency to hold that clearance despite its parent. Most sub-tier defense manufacturing is unclassified CUI and ITAR-controlled work that needs no facility clearance, so your class of work decides whether FOCI mitigation and a clearance are in scope. I build and run the unclassified operation; the clearance and the FOCI instrument stay with your cleared-facility counsel and DCSA.

A DFARS qualifying country is a nation with a reciprocal defense-procurement agreement with the Department of Defense, which lets its end products and components bypass Buy-American restrictions.

All nine countries I serve qualify. It is a procurement preference: it waives neither ITAR nor CMMC, and it clears no FOCI.

Usually not without a boundary.

Controlled technical data stays inside a US-person data boundary, so a shared ERP giving the foreign parent open access to CUI or ITAR-controlled data is a problem. I build the boundary so the US operation holds controlled data compliantly, and transfers to the parent happen under DDTC authorization or not at all. Sometimes that means a segregated instance, sometimes a separate system; the architecture decision is part of the build.

On-site operating work is concentrated across New England, where the defense industrial base and the prime relationships I know best are dense.

Diagnostic and strategic work runs nationally. If your US site is going elsewhere, we scope the on-site and remote mix up front.

I am the operations partner.

I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate your prime set. Entity formation, ITAR and DDTC registration, FOCI mitigation, and CFIUS stay with your corporate and export-control counsel. I coordinate with them and own the operating outcome.

Your order book grows while your working capital tightens, because long-lead inventory and rework trap cash between the sale and the deposit.

AlixPartners found the aerospace and defense cash conversion cycle lengthened by 21 days between 2018 and 2022. Margin Engineering targets that cycle, recovering cash conversion days you can redeploy.

Both.

Floor work, Gemba walks, Kaizen events, and the first 90 days of a fractional engagement need me on-site. Analysis, reporting, and the steady-state cadence run remote. I am based in Brookline, NH, and serve Greater Boston and Southern New Hampshire on-site.

It is a method with four named pillars and a defined delivery sequence.

IT/OT Convergence, Margin Engineering, Human-in-the-Loop, and Sovereign Tier are each a set of operations, delivered through the 90-Day Strategy Formulation Framework of Diagnostic, Stabilization, and Commercial Scale. The names make the work memorable, not impressive.