Skip to content

Cobalt Ridge × Bastion Security Partners · RFP CRM-IT-2026-04

Keep the defense work. Keep Line 3 running.

A dated plan to hold C3PAO Level 2 certification by September 30, 2027, built for a two-person IT team and Sunday-only floor windows.

Prepared for
Ray Brandt, Linda Gerhardt, Dana Kowalski, Tom Reyes and Priya Natarajan, Cobalt Ridge Manufacturing
Prepared by
Elena Marsh and Jordan Pike, Bastion Security Partners
Date
October 12, 2026

What Halvorsen’s August letter asks

One third-party Level 2 certificate by September 30, 2027. Not a self-assessment. Nineteen years of work depend on it.

Three dates, in the order they arrive

Your customers and your insurer set these dates, not us. Whatever happens with the federal phase-in, Halvorsen’s date is the one that binds you. This plan reaches each date in turn.

  1. Dec 1, 2026

    Insurer attestation

    The supplemental application for your January 1 renewal, attesting MFA, monitored EDR, tested backups, training and isolated end-of-life systems.

    Both teams

  2. Mar 31, 2027

    SPRS of 70+ for Kestrel

    Kestrel Aerosystems’ interim milestone: an updated, defensible score posted in SPRS.

    Both teams

  3. Sep 30, 2027

    C3PAO Level 2 certified for Halvorsen

    You stay eligible for new purchase orders and the long-term agreement renewal. Halvorsen’s quarterly status updates start in January.

    Both teams

Sized for Kokomo, Defiance and Sturgis

Dana keeps help desk. Tom’s Sunday windows set the pace. Every control we add ties back to revenue, insurance or uptime.