Case study: Virginia government contractor nears CMMC compliance