A security program built to win defense work
End-to-end build of Velo3D's cybersecurity and compliance posture — NIST 800-171, CMMC, and DoD STIG hardening — to prove the product was secure enough for critical infrastructure and open a customer market that had been closed.
A closed market, and a product no one could yet trust.
Velo3D's technology was built for the hardest parts in aerospace and defense — but the company couldn't win the work. It was failing to meet customer security requirements and could not acquire the customers it was built to serve. The most valuable opportunities were tied to DoD and critical-infrastructure programs, and those came with a hard gate: DoD STIG hardening on top of CMMC and NIST 800-171 compliance.
When Aaron took ownership, Velo3D's DoD STIG posture sat at roughly 7% compliance. There was no security program to speak of, no path to certification, and no proof a customer could point to that the product itself was secure. The market wasn't lost — it simply couldn't be entered until the security story was real.
What the work actually was.
NIST 800-171, CMMC & STIG remediation program
Built the control framework and remediation program from the ground up against a defined plan of action and milestones — DoD STIG hardening from 7% to 97% in under six months, and NIST 800-171 compliance above 95% within a year.
Green-level STIG, an industry first
Rather than stop at policy, went and proved it — hardening the product to green-level STIG (>90%), making Velo3D the first metal additive manufacturer to earn the DoD designation, used directly as evidence to customers that the product was secure.
Cloud security & controls
Implemented AWS security controls and guardrails that reduced cloud cost by 15% while tightening data collection and access.
Security governance & steering committee
Created and chaired the IT Security Steering Committee — a quarterly forum reporting to the CFO, CTO, General Counsel, and Chief People Officer — putting security oversight in front of the executive team rather than inside IT.
IT general controls & audit readiness
Designed pre- and post-IPO IT general controls that came through audit with zero material weaknesses.
Security woven into operations
Embedded security and ITGC into onboarding and day-to-day IT so compliance held up under audit instead of decaying after certification.
What it delivered.
“Compliance wasn't the goal. Winning work we couldn't touch before — that was the goal. The certification was how we proved the product was secure.”
Four ways it mattered.
Security became a revenue unlock, opening a market the product was built for but couldn't enter.
STIG hardening turned a security claim into third-party, defense-grade evidence.
A 90-point compliance swing in under six months against a real POA&M.
Controls embedded into operations so the posture held after the auditors left.
