Firm Overview

Garrett Partridge: Firm Capabilities

The operator who stands up and runs compliant US defense operations, and the operating system that holds after the auditor leaves.

Garrett Partridge · July 16, 2026 · 8 min read · Brochure

Garrett Partridge is an operations architect for the defense industrial base. I build and run the compliant US operation an allied manufacturer needs to win Department of Defense work, and I install the operating system that holds for a New England shop racing the CMMC gate. The work is hands-on and it is scarce: I own the operating model, converge the IT and OT environment to a CMMC and ITAR-ready posture, and stay on the P&L until the system runs on its own. A maximum of four concurrent engagements, by design.

The practice

I am an engineer who has operated. I have been the CEO of a manufacturer and the general manager of a foreign subsidiary's North America operations, so I speak P&L and shop floor in the same sentence. That is the difference between an operator and an advisor, and this audience can tell which one is standing in front of them.

The practice serves two situations through one method. An allied manufacturer turning a prototype into a secure, on-shore US production line to capture DoD contract work enters through the US market-entry door. A New England shop already inside the defense base, racing the CMMC clock and holding a prime relationship, enters through the domestic door. One operator, one operating system, two doors.

Both roads run through New England. My base is Brookline, New Hampshire, and the work is delivered on-site across Greater Boston and Southern New Hampshire, where the primes and the regional supply base already are.

One operator, one method, two doors: US market entry for allied manufacturers, and the CMMC-clock operating install for the New England shops already in the defense base.

Standard Work 2.0, the operating system

Standard Work 2.0 takes the discipline of lean standard work off the production floor and applies it to the whole company, back office and shop floor alike. It runs on four pillars, and each one ties an operational mechanism to a number the owner already watches.

IT / OT Convergence. I merge the metrics coming off the industrial equipment on the floor into clean financial-dashboard visibility, so MES, ERP, and SCADA stop being three separate compliance liabilities and become one auditable digital thread the P&L can see. The auditor follows one thread, and it holds.
Margin Engineering. Kaizen events aimed straight at the P&L. I map the value stream and eliminate the two things that quietly bleed a mid-market margin: the undocumented Hidden Factory errors the ERP never recorded, and the manual spreadsheet taxes standing in for a real system. Recovered capacity converts into cash conversion days.
Human-in-the-Loop. Smart workflows absorb the cognitive drudgery of paperwork, so a line worker gets upskilled into a strategic site lead instead of buried in forms. In a regulated environment, verified human judgment stays in the loop on every decision that touches data integrity. Automation augments the operator, it never replaces the operator.
Sovereign Tier. I hardwire ITAR, CMMC 2.0, ISO, and AS9100 into the daily build process, so the data borders sit where the controlled technical data actually lives and the auditor finds the controls already running instead of bolted on as a binder of PDFs. Built this way, compliance stops being overhead and becomes a competitive moat.

Three ways to work

The four pillars are not a deliverable on their own. They get installed through one of three engagements, scoped to the constraint you are actually fighting.

30-Day Operational Triage. The full diagnostic. Value stream and swim-lane maps of how work actually moves, Gemba walks and targeted Kaizen on the floor, and a final recommendations report that names the constraint and the sequence to remove it. Roughly five weeks at twenty hours a week. Fixed scope, fixed deliverable.
Fractional COO. Embedded operational leadership without a 300,000 dollar full-time hire. Two to three days a week with your direct reports, the full Standard Work 2.0 install across the IT and OT divide, and real-time SQDIP reporting that holds the gains after I step back. Near full-time in the first 90 days, then a steady fractional cadence.
Strategic Consultancy. Standard Work 2.0 installed against one defined event: forensic operational diligence before an LOI hardens, a 90-day P&L triage, or compliance hardening before a prime gate. Scoped firm-fixed-price against a defined deliverable, from a focused working session up to a 30-day stint.

Capacity is the constraint and the proof. Four concurrent engagements is the real limit of doing this work at depth, so four is the number, and every engagement is held under NDA.

Know your work class

Before anyone quotes a timeline, you need to know which class of defense work you are chasing, because each class is a different build. Most sub-tier DoD manufacturing lives in the middle class, and that is the one a foreign-owned US entity can stand up without a facility clearance.

Class A, commercial and uncontrolled. Dual-use and commercial parts with no controlled technical data. Needs a US entity and a clean quality system, no CMMC boundary or ITAR registration. Most parents can reach this class on their own.
Class B, CUI and ITAR-controlled but unclassified. The bulk of sub-tier DoD manufacturing. Needs DDTC registration, a US-person data boundary, and CMMC Level 2 built into the workflow. Achievable for a foreign-owned US entity. This is the class I build and run.
Class C, classified. Work that touches classified information. Needs a facility clearance and FOCI mitigation negotiated with DCSA. That is counsel and DCSA territory. I coordinate with your cleared-facility counsel; the clearance itself stays with them.

I build the US entity and the US-person data boundary so your American operation holds controlled technical data compliantly. Transfers to the parent happen under DDTC authorization or not at all. That is an ITAR-ready posture designed into the workflow, not a guarantee bolted on after.

New England, the landing zone

A qualifying-country manufacturer wins US defense work by standing up a real US operation, not by shipping across a border. That means a US entity, a US-person data boundary, and a floor that runs to a CMMC and ITAR-ready posture from the first day it opens.

The market for this help is real and it is moving. In April 2026, American Rheinmetall achieved CMMC Level 2 certification across its US production facilities, which is precisely the compliant-US-operation build this practice delivers. Six tiers of firms help a foreign manufacturer enter the US, from FOCI law firms to site-selection consultancies to CMMC IT vendors, but none of them stands up and runs the compliant operation. That operating layer is the unowned lane, and it is mine.

I have stood on the exact ground my market-entry clients are walking onto. I ran the North America operations of GEFRAN, an Italian sensor and automation multinational with a real manufacturing plant in New England, so I have been the foreign parent's operator in the US. New England is the landing zone: my Brookline base, the prime relationships, and the regional supplier fluency are what a Brescia or an Ontario parent is buying, an operator already standing where you are landing.

The countries served

The countries I work with are NATO members, major non-NATO allies, and defense-trade partners. Every one of them is a DFARS qualifying country under a reciprocal defense-procurement agreement with the Department of Defense.

Canada, the United Kingdom, Germany, Italy, and France are the primary markets, each with a full market-entry brief. Japan, Australia, Spain, and Switzerland are also qualifying countries I serve, with a one-pager brief available for each.

Qualifying-country status is a procurement preference, not a shortcut. It does not waive ITAR, it does not waive CMMC, and it does not clear FOCI. Those regimes still apply, and building for them is the work.

Why an operator, not an advisor

This audience has met the AI consultants who have never owned a number. The credibility here is different in kind: I have signed the front of a paycheck, sat in the AS9100 audit chair rather than reviewing it from a slide, and run an MRP cutover on a live floor without losing a shipment.

I am the foreign parent's operator in the US, and I am one now, standing up US defense manufacturing operations for a Canadian-parent subsidiary. When an allied manufacturer lands in New England to win DoD work, I am the operator already standing where they are landing. When a domestic shop is racing the prime gate, I am the operator who has been upstream and can bridge that relationship.

CEO and division-GM operating history, with the P&L owned, not advised on.
Toyota Production System and lean practice: Kaizen, Gemba, 5S, pull systems, kanban, SQDIP, and value stream mapping.
Working command of ITAR, DFARS, CMMC 2.0, NIST SP 800-171, AS9100, ISO, and CUI handling across both IT and OT.
A scarce single operator running four engagements at a time, not a roster you get matched into.

Frequently asked

Direct answers.

What does the firm actually do?

I stand up and run compliant US defense manufacturing operations. For an allied manufacturer entering the US market, that means building the US entity, the US-person data boundary, and a CMMC and ITAR-ready floor, then running it. For a domestic New England shop, it means installing Standard Work 2.0 across the IT and OT divide so the operation holds through the CMMC gate and beyond. I am an operator, not an advisor who hands you a report and leaves.

Do you work with foreign-owned manufacturers?

Yes. Building the compliant US operation for a qualifying-country parent is the primary practice. I build the US entity and the US-person data boundary so controlled technical data stays inside the American operation, with transfers to the parent happening under DDTC authorization or not at all. I coordinate FOCI mitigation and the legal instrument with your counsel; the operating build is mine.

How many clients do you take at once?

A maximum of four concurrent engagements. Capacity is the constraint and the proof, because four is the real limit of doing this work at the depth it requires. Every engagement is held under NDA.

How does an engagement start?

It starts with a strategic conversation. Name your trigger, a prime supplier letter, a CMMC window, an LOI in diligence, or a US market-entry opportunity you cannot capture from abroad, and you receive a realistic timing window within 48 hours. Most engagements begin with a 30-Day Operational Triage that produces a defensible written plan.

Sources

Take this with you

Download the print-ready PDF for the boardroom, or put this in front of an operator directly.

Request a Strategic Conversation Download the PDF