About GEA Builders

GEA Builders, a six-person federal general contractor in San Diego, had no in-house IT when CMMC began gating the Army Corps work it wanted to win. Atomus moved the company from Google Workspace to Microsoft 365 GCC and guided it through Level 2 and a C3PAO assessment. GEA earned CMMC Level 2 certification in August 2026 with a perfect score.

GEA Builders, Inc. was founded in 1999 by George Arroyo, who started in residential construction before moving into federal work. The company is a certified 8(a) and Service-Disabled Veteran-Owned Small Business specializing in design-build tenant improvement projects. Its clients include the General Services Administration, the U.S. Coast Guard, U.S. Customs and Border Protection, and the Department of Homeland Security. The team is fully remote, with a second office in North Florida.

Kristen Devereaux is GEA's Director of Operations and Business Development. She oversees active projects, attends industry days, and builds the relationships that bring in new work, with the U.S. Army Corps of Engineers at the top of the list. Before joining GEA, Kristen spent eight years as a Navy Supply Corps officer, finishing as a contract specialist at Naval Medical Center San Diego. When CMMC arrived, she was told to get it done.

“I was told ‘Kristen, full steam ahead. This is your baby. Go and do it.’ Just having that direction from my boss of, ‘You will get it done. I signed off on it, now go execute,’ I think that made it really easy.”

Kristen Devereaux

Director of Operations and Business Development at GEA Builders

Story Highlights

• A Federal General Contractor With No In-House IT: GEA builds for GSA, the Coast Guard, CBP and DHS with six employees and nobody whose job is IT.
• Google Workspace to Microsoft 365 GCC Migration: Atomus moved a fully remote team off Google Workspace in stages, testing each step before the next.
• Signed to C3PAO Certified in About Four Months: GEA signed with Atomus in April 2026 and passed an independent C3PAO assessment in August with a perfect score, ready for the Army Corps work it wanted.

When CMMC Started Showing Up in Federal Construction Bids

Kristen first heard about CMMC at the NAVFAC Industry Day.

Two months later, GEA couldn't respond to a solicitation because it required a CMMC level the company didn't have. The same week, a joint venture partner raised CMMC, and the term kept coming up around the larger projects on military bases where her father wanted to take the company. Kristen decided to lean in rather than resist, and reached out to Atomus.

She has since watched peer firms stall, hearing secondhand accounts of the cost and disruption of choosing the wrong partner.

“It's all horror stories from firms. And so that's what the smaller companies that it's being trickled down to hear, and they're like, ‘Well, we don't wanna do that.’”

Kristen Devereaux

Director of Operations and Business Development at GEA Builders

Comparing CMMC Quotes as a Small Business

GEA talked to several providers, and the quotes ranged widely. At the far end, one provider wanted $10,000 for the Level 1 self-assessment alone, before any Level 2 work. At that point, Kristen had no way to tell which prices reflected the requirement and which reflected the seller. What she learned from Atomus is that pricing tracks the number of users in scope, not a company's revenue.

Atomus scoped the work to a six-person company and included Level 1 in the work of getting GEA to Level 2, rather than selling it separately. Kristen says the Atomus team understood how little GEA knew about CMMC and didn't take advantage of it. Once Level 1 was done and filed in SPRS in June, her reaction was simple: “That was it?”

Looking back, she would have asked every provider sharper questions, but she would make the same choice. In her words: “Just based on our size and our capabilities and where we wanted to see ourselves, Atomus was the best fit for our company.”

“They were gonna charge us 10 grand just to put us through Level 1 self-assessment.”

Kristen Devereaux

Director of Operations and Business Development at GEA Builders

Moving From Google Workspace to Microsoft 365 GCC

GEA ran its business on Google Workspace. To handle CUI, the company moved to Microsoft 365 GCC, Microsoft's government community cloud. GCC is available only to verified government contractors, and Microsoft confirmed GEA's eligibility before it issued the new tenant. Email moved from Gmail to Outlook, files from Google Drive to OneDrive, and the team started working in Teams. Atomus also deployed Microsoft Defender on every device and a Cloudflare cloud VPN, which kept a fully remote team's home networks out of assessment scope.

The move was paced to a team with no IT function. Atomus introduced one change at a time, checked it, and only then moved to the next. The team kept working in the old environment alongside the new one until everyone was ready for full cutover.

Cutover day was still hectic. By the second day, the new environment felt routine. Kristen found the setup familiar from the Navy, from the authenticator app to the managed devices, and the team now prefers it. In her words, logging in feels “more official” and the team feels “more squared away.”

“That first day we were all like chickens with our head cut off, panicking. It was probably like two days before we were like, ‘Oh, okay. We're good. Everything's good.’”

Kristen Devereaux

Director of Operations and Business Development at GEA Builders

“As long as you lean into the requirement and just listen to the subject matter expert, they're not gonna do anything that your company's not ready for.”

Kristen Devereaux

Director of Operations and Business Development at GEA Builders

Passing the C3PAO Assessment With a Perfect Score

GEA signed with Atomus in April 2026. The original plan was a Level 2 self-assessment in November. Instead, an independent C3PAO assessed GEA in August, and the company passed with a score of 100%.

GEA had never been through an assessment of any kind, and Kristen went in nervous. The assessors' questions turned out to be practical: who approves the company's social media posts, and how new employees are onboarded and departing ones offboarded. Atomus had prepared the team to answer them, and the evidence was already in place. Kristen says the preparation is what kept the assessment from being as intimidating as she expected.

The Atomus team was also in the room. Technical questions about the systems Atomus runs could go straight to the people who run them.

“If there was a technical question that was directed to me, your team would either immediately step in or give me a second to see if I could respond, and if I started responding in a way that was incorrect, they would be like, ‘Oh, Kristen, remember we talked about X, Y, and Z,’ and it would kind of get me back on track.”

Kristen Devereaux

Director of Operations and Business Development at GEA Builders

What CMMC Level 2 Opened With the Army Corps

At the Navy Gold Coast conference, Kristen had a one-on-one with the Army Corps of Engineers. When CMMC came up, she told them GEA was Level 2 certified. Their advice was to put it on the company's capability statement, front and center. GEA has since started hearing from the Army Corps directly, after being off its radar entirely when the work began.

Kristen notices the difference third-party certification makes in those conversations. A self-assessment is GEA's own word. A C3PAO assessment is an independent assessor confirming the environment, and clients treat it as a higher level of trust. She also frames the requirement as more than paperwork: it protects the bases GEA builds on and the service members and civilians who work there.

Asked what she valued most in working with Atomus, Kristen pointed to the people. Her view is that this business runs on relationships, and that a great product only goes so far if clients don't want to work with the people behind it.

“When I go into these conversations with industry now, I feel very confident talking about CMMC and very proud to say that we are Level 2 certified. And they go, ‘Oh, by third party or self-assessed?’ I'm like, ‘No, by a third-party audit.’”

Kristen Devereaux

Director of Operations and Business Development at GEA Builders