One of the most labor-intensive parts of CMMC preparation is one that rarely gets talked about: knowing what you actually have.

Before any defense contractor can define their CUI boundary, complete their System Security Plan, or pass a third-party assessment, they need a complete, accurate inventory of every vendor touching their environment — IT services, managed providers, cloud platforms, voice services, internet circuits, and SaaS applications. That inventory is not optional. It’s a formal requirement baked into the DoD’s scoping guidance.

For most manufacturers, that inventory doesn’t exist. Not because anyone dropped the ball — but because nobody has had a reason to build it. The bills get approved, the services keep running, and the full picture never gets assembled in one place.

That’s exactly what Berlin Pacific builds.

We give manufacturers a complete, organized inventory of:

Voice and data services — every WAN circuit, internet connection, SIP trunk, VoIP platform, and data line coming into and running through the environment. These services don’t store classified data, but they matter for CMMC because unmanaged or forgotten circuits are potential entry points into systems that do. The IT team and assessor need to know what exists so they can verify each service is properly secured or logically separated from the CUI environment. We surface what’s there. What the client does with that information — certifying, segmenting, documenting — is their call and their compliance team’s job.

SaaS applications — a full dashboard of every software vendor, what’s being spent, how many seats are active versus idle, and when renewals hit. Under CMMC, every external service provider that could access or transmit CUI must be identified and assessed. Most organizations are running 30–50% more SaaS tools than IT knows about, with contracts auto-renewing and seats sitting unused. Our platform surfaces all of it automatically — connected in 30 minutes, no manual entry.

Cloud and other IT vendor categories — the same approach extends to cloud infrastructure, managed services, and other IT spend categories. If it’s a vendor touching your environment, we can inventory it, map it, and identify what’s there.

What this gives the compliance team: A vendor inventory they don’t have to build from scratch. A voice and data circuit map that supports boundary scoping. A SaaS layer that flags every external provider that needs to be evaluated. All of it organized, documented, and ready to hand to the assessor.

And once that inventory exists, it becomes the foundation for something else entirely.

Most companies going through CMMC discovery for the first time find that nobody has done a real line-by-line review of what they’re paying for. Unused circuits still billing. SaaS seats nobody’s touched in a year. Cloud services that were spun up for a project and never turned off. Contracts that auto-renewed at rates that haven’t been renegotiated since before inflation hit.

That same inventory built for compliance is the starting point for recovering that spend. Berlin Pacific clients typically find 20–50% in savings across their voice, data, and SaaS categories — and our engagements are performance-based, so there’s no cost unless we find something. The compliance work and the savings work run off the same foundation.

We don’t certify anything. We don’t replace the C3PAO or the MSSP. What we do is eliminate the hours of discovery work that typically falls on an already-stretched IT team — and hand them an accurate picture of their environment that CMMC requires them to have, and that usually pays for itself many times over.

Most teams haven’t done this because it’s never been the priority. Under CMMC, it has to be.

Would it be worth a look at what’s there?

Berlin Pacific — done-for-you vendor cost recovery and inventory. We handle everything with your vendors. Only paid from savings we deliver on the cost side; the inventory platform is always free.