About Pave-Tech

Pave-Tech is a heavy civil construction company that specializes in military airfield reconstruction. Founded in 1993, the company rehabilitates, reconstructs, and builds new airfield pavements, with asphalt, concrete, striping, and polyester overlay work. It also performs heavy highway construction for state agencies, including Caltrans, the Nevada Department of Transportation, and the Hawaii Department of Transportation.

Ben Gonzalez is Pave-Tech’s Military Division Manager and has been with the company since 1995. He manages the military division that performs the company’s federal work. The division is supported by a small administrative team and a field workforce that grows to 50 or 60 employees when work is heavy. CMMC requirements began appearing in Pave-Tech’s military contracts, and without compliance, the company could not keep bidding the work it has performed for decades. Ben was tasked with bringing the division into compliance.

‍

Story Highlights

• Requirement Added After Award: Pave-Tech won its place on a NAVFAC multiple award construction contract in 2025 without CMMC language in it, then learned after award that the remaining task orders would require it.
• Everything Marked CUI: The contracting office treated publicly available specifications, and nearly every other document, as CUI. Pave-Tech accepted over-marking as part of government work and chose to comply properly rather than check boxes.
• Compliance Landed on a Construction Manager: The work fell to a 31-year company veteran with no IT background. Atomus explained each requirement in plain terms and prepared him for his first assessment.
• Keeping the IT Provider They Trust: Pave-Tech’s IT provider of more than 20 years worked alongside Atomus through the rollout. He still supports the company’s day-to-day IT, while Atomus carries the security and compliance side.

The Requirement Arrived After the Award

Pave-Tech had seen compliance language in specifications for a few years, but none of it asked the company to change how it worked. That changed with a NAVFAC multiple award construction contract, awarded in April 2025 without CMMC clauses. After the award, and before any task orders were issued, NAVFAC notified Pave-Tech in early 2026 that the remaining contracts would carry the requirement. Around the same time, a separate multiple award contract in Hawaii issued an amendment asking the company to acknowledge a CMMC Level 1 requirement. For Ben, that was the moment CMMC stopped being language in a spec and became something Pave-Tech had to act on.

Everything Marked CUI

The harder lesson came from how the requirement is applied. Pave-Tech builds runways and taxiways that anyone can view on satellite imagery, from specifications the government posts publicly and tailors mostly by adding a runway number and a project number. Even so, on a current bid the contracting office told contractors to treat every document as CUI, whether or not it carried a marking.

“We’re a construction company that goes out and builds an airfield where you can go to Google Maps and pull up anything you want to see.”

Ben Gonzalez

Military Division Manager at Pave-Tech

As Ben sees it, working with the government means accepting that it will often over-mark and over-claim what counts as CUI. Over-marking is simply what contracting officers do. Declaring everything CUI is safer for the government than reviewing documents one by one, even though a document-by-document review would be smarter and would cost the government less. Requirements written with the largest defense contractors in mind then land on a paving company the same way, and meeting them adds real cost that does not disappear. It goes into the overhead a contractor carries into future bids, so the government ultimately pays for the requirement it asked for.

Two Options, and Only One Worth Taking

Pave-Tech had two realistic options. The first was to change a few settings, read through the requirements, and attest that the work was done. Ben knew other contractors and suppliers were taking that route. To him, it would have been window dressing, an attestation made without really understanding what was being attested to. A company that has been in business since 1993 does not operate that way.

“I had two suppliers come back to me and say, why are you sending me this stuff? Other contractors are not making me do this [cybersecurity questionnaires].”

Ben Gonzalez

Military Division Manager at Pave-Tech

The second option was to do it right, and that was the instruction Ben received from the owner: get the company compliant, and never find out later that something was missed. As Ben put it, the company would either buy in or not do it at all.

With Atomus, Pave-Tech set up a separate government IT environment for its defense business. Employees in the military division received dedicated computers for federal work, kept apart from the systems that support the company’s state transportation contracts. Atomus built and configured the environment on Atomus Aegis, implemented the controls required by NIST 800-171, DFARS 7012, and CMMC, and produced the system security plan and supporting documentation.

Compliance Without an IT Background

Ben’s background is in construction, not information technology. He came to CMMC as the person responsible for his division’s contracts, and he needed to understand the requirements well enough to explain them to a team that had worked the same way for decades. Many of Pave-Tech’s administrative staff have been with the company for more than 20 years, and their biggest concern was doing something wrong that could hurt the company. The questions came constantly, from which computer to use to what could be emailed or printed.

Atomus walked Ben through each requirement in plain terms, without the jargon he was used to hearing from technical specialists. He never felt talked down to, and he could return to his team with answers instead of more questions.

“This isn’t my background. I’m not a computer guy. But you guys have made it very easy for me. You’ve put it in layman’s terms, and you’ve made it a very doable thing that I can go back and answer questions to my people.”

Ben Gonzalez

Military Division Manager at Pave-Tech

Working Alongside the Company’s IT Provider

Pave-Tech has relied on the same IT provider for more than 20 years, and it had no intention of replacing him. Ben asked him to sit in on every early meeting with Atomus, so the technical questions were answered by someone who knew the company’s systems. After the first meeting, he told Ben that Atomus was the real deal, and he became an advocate for doing the work properly rather than putting window dressing on it.

“After our first meeting, my IT provider and I had a conversation, and he said, hey, these guys are the real deal.”

Ben Gonzalez

Military Division Manager at Pave-Tech

During the rollout, the IT provider set up and enrolled the new computers for the government environment, and Atomus deployed the security tooling to them centrally so employees only had to sign in. The division of responsibility has held since. Atomus is the point of contact for the security and compliance tools, and the IT provider continues to handle new hardware, software, and day-to-day support. When Atomus rolls out a new policy, Ben distributes it to the team and the IT provider is kept informed.

The Assessment

When Ben informed Pave-Tech that an audit was required, there was a nervous reaction similar to that which most people have when a letter from the IRS is received. Atomus prepared Ben and another employee for their interviews with the assessor and gave Ben the materials to review beforehand. An independent C3PAO then assessed the environment, with the Atomus team alongside Pave-Tech throughout. Because the evidence was already in the system, anything the assessor asked for was produced right away, and the assessment never lost momentum.

“Our Atomus point of contact knew everything during the assessment. What he didn’t have on hand, he was able to get right away, so there was no momentum loss whatsoever.”

Ben Gonzalez

Military Division Manager at Pave-Tech

Ben came out of the assessment understanding what each control was for, not just that it was in place. Pave-Tech then received its CMMC Level 2 certificate, and the owners who were concerned before the audit were pleased with how it went. The company now has a government environment and a documented process it will keep following for its military work, and it kept the IT provider it trusts along the way.