Petronella Technology Group, Inc. opened in Raleigh in 2002. The original brief was unglamorous: keep small and mid-sized North Carolina businesses running on the IT and networking equipment of the day, fix what broke, and replace what failed. That work was honest and steady, but the calls that started coming in around 2010 were different. Law firms had laptops stolen and needed forensics. Healthcare practices were asked HIPAA questions they had never been asked before. Defense subcontractors started seeing flow-down clauses in their prime contracts that referenced something called DFARS 252.204-7012.
The pattern was clear. North Carolina has one of the densest defense and healthcare clusters in the Southeast - Research Triangle Park, Fort Bragg (formerly Fort Liberty), Camp Lejeune, Seymour Johnson Air Force Base, Cherry Point MCAS, the academic medical centers across Duke and UNC and ECU and Wake Forest - and the regulatory weight on those organizations was only going to grow. Petronella shifted from generalist managed services toward security, digital forensics, and compliance consulting. The firm earned BBB Accreditation in 2003 and has held A+ continuously since. Craig Petronella sat for the North Carolina Digital Forensics Examiner license, which became DFE #604180, listed on the North Carolina Office of Indigent Defense Services expert-witness registry at forensicresources.org.
By the time the Department of Defense finalized CMMC 2.0 in October 2024 and DFARS clause 252.204-7021 began its phased rollout, Petronella had spent more than a decade walking small and mid-sized DoD subcontractors through NIST SP 800-171, the System Security Plan, and the Plan of Action and Milestones. Joining the Cyber AB Registered Provider Organization list as RPO #1449 was the natural step. So was rolling out the CMMC Registered Practitioner certification across the entire team rather than just the principal. Today every Petronella engineer assigned to a defense client is CMMC-RP certified, and the firm partners with a network of independent practitioners who hold deeper specialty credentials - more on that in the partner-network section below.
Raleigh stayed the headquarters. The office sits at 5540 Centerview Dr., Suite 200, Raleigh, NC 27606, ten minutes from the I-40 / I-440 interchange and within a short drive of every major North Carolina defense base and academic medical center. We remain locally owned and operated. Craig is still the principal, still answers the phone, and still sits on the scoping calls.
What grew alongside the consulting practice was a small portfolio of tooling and intellectual property the firm now uses on engagements and offers separately to clients. ComplianceArmor is our compliance documentation platform that automates the heavy lift of SSP authoring, POA and M tracking, and evidence repository organization. Our private AI cluster and 24/7 AI-plus-human hybrid threat analysis stack underpins managed detection and response for the DIB and healthcare clients who cannot risk sending Controlled Unclassified Information or Protected Health Information to a public-cloud SOC. That AI infrastructure is aligned to CMMC, DFARS, and HIPAA data sovereignty rules - we built it because the off-the-shelf options were not, and clients started asking. The hardware story for that cluster lives separately at our hardware practice.
