Optimal is deliberately small. The people who scope an engagement are the people who build the enclave and answer the phone when something breaks — there is no layer between the sales conversation and the engineering.
“The defense industrial base was handed two problems at once — prove you can hold CUI, and adopt AI without losing control of it. Most firms will sell you one and quietly make the other worse.”
I started Optimal to do both jobs properly, and to do them in the customer’s own environment. We build, migrate, and run CMMC-ready Microsoft 365 GCC High enclaves for contractors handling CUI and ITAR-controlled data — and then we stand up the governed access layer that lets frontier models be genuinely useful inside that boundary instead of routing around it.
Those two things belong to the same problem. An enclave that people work around is not a boundary, it is a formality. Once a team has a real reason to paste controlled data into an unapproved tool, every control upstream of that moment stops counting. So the answer is not to ban the capability — it is to make the governed path the fastest one: authenticated gateway, prompt guardrails, default-deny egress, and an auditable trail that stands up in an assessment.
We are also clear about what we are not. Optimal engineers environments to be assessment-ready; the certified assessment is performed independently by a C3PAO, and we do not grant authorizations. That separation exists for good reasons, and we would rather explain it up front than be the vendor who let a customer misunderstand their own position.
Everything we claim we can build, we have built. NINELINE is our working reference implementation, and the AI gateway architecture is public. If you want to see how we think before you hire us, start there — then let’s talk about your environment.
Ryan Gutwein — Founder & CEO, Optimal, LLC
A control that passes an audit and fails an attacker is a liability with paperwork. We start from how these systems actually get broken, then map the result back to NIST SP 800-171, CMMC, and the AI RMF — in that order.
Your enclave, your tenancy, your keys, your logs. We build and run the environment; we do not become a dependency you can't remove. Nothing about the way we work should make your data harder to control.
We engineer environments to be assessment-ready and we say so plainly. Optimal is not a C3PAO and does not grant an ATO — that assessment is independent, by design, and any firm that blurs it is selling you risk.
Optimal, LLC is certified through the SBA Veteran Small Business Certification (VetCert) program as both an SDVOSB and a VOSB, and is eligible to compete for SDVOSB and VOSB set-aside contracts. The certification is publicly verifiable on the SBA certification registry.
Scoping calls are run by the founder, not a sales team. Bring your contract requirements and your environment as it actually is — we’ll tell you what it takes.
