Ask a project manager at a naval yard what their compliance burden looks like and you will usually get an answer about one thing: whichever regime bit them most recently. Insurance people talk about Longshore. Programme people talk about CUI. Nobody describes the whole shape of it, because no single department sees the whole shape.
The clearest way to see it is to stop thinking about departments and follow one person.
Take a certified welder placed on a naval surface programme at a Gulf Coast yard. Same badge, same rate, same supervisor all week.
Working steel on the yard, adjoining navigable water, on a vessel in build. This is maritime employment on a covered situs. If he is hurt, the claim is federal, under the Longshore Act, and a state workers compensation policy will not respond to it.
He is handed a work package built from vessel drawings and system specifications. On a defense programme, that documentation is routinely Controlled Unclassified Information. Everyone in the chain that stored, transmitted, or printed it is now inside the scope of a cybersecurity requirement, including whoever emailed it to the labour vendor.
Still Longshore, still federal, still nothing to do with the state system. The exposure has not changed since Monday, but the severity profile has, because he is now working at height over a dock floor.
He sails with the vessel to finish a repair underway. Time aboard a vessel in navigation is what builds seaman status, and seamen sue rather than claim. If this becomes a pattern rather than a one off, the argument that he is crew becomes available to a plaintiff's lawyer, and the capped comp exposure the employer was relying on may not be there.
The timesheet is billed to a contract line. The access renewal names a facility and a programme. The weld log references the drawing package. Payroll runs Friday because trades expect weekly pay. Three regimes, one administrative afternoon.
"Nothing about his job changed all week. What changed was which body of federal law was watching, and none of them coordinate with the others."
What makes this genuinely difficult is not the number of requirements. It is that they have no common structure, no common authority, and no common way of being satisfied.
| USL&H | MEL & Jones Act | CMMC | |
|---|---|---|---|
| What it governs | Injury to maritime workers who are not crew | Injury to vessel crew | Handling of controlled information |
| Authority | Department of Labor | Federal courts, general maritime law | Defense acquisition regulation |
| Trigger | Where the work happened and what it was | Connection to a vessel in navigation | Whether covered information was received |
| How it is satisfied | Underwritten insurance endorsement | Underwritten liability policy | Implemented controls, assessment, affirmation |
| Time to acquire | Years of maritime loss history | Years of maritime loss history | Months of programme work and remediation |
| Failure mode | Uninsured federal claim, exclusive remedy lost | Uncapped jury exposure | Ineligible for award, contractual and FCA exposure |
Each column has its own guide. USL&H and the gap in state workers comp covers the first. MEL coverage and the Jones Act covers the second. What CMMC actually requires covers the third, including what the July 2026 suspension of Phase 2 did and did not change.
A company can usually solve one of these. The reason the stack is a barrier rather than a checklist is that the three are acquired through completely different mechanisms, on completely different timescales, and no amount of progress on one advances the others.
Specialty maritime coverage cannot be bought into. Carriers underwrite USL&H and MEL on demonstrated operating history in maritime environments and on loss experience over years. A well capitalised firm with no maritime record is not a candidate at any premium. That is a genuine moat, and it is why the phrase used in the industry is that these coverages are earned rather than purchased.
CMMC cannot be bought into either, though for a different reason. It requires implemented controls, documented policies, scoped systems, and an affirmation that carries liability if it is inaccurate. It is measured in months of work rather than years of history, but it is not something a broker can arrange.
Then there is the operational layer that sits underneath all of it and gets forgotten: weekly payroll, because Gulf Coast trades expect it; multi state deployment, because yards pull crews from wherever the trade exists; and the insurance certificates and documentation the yard's own compliance team will ask for before anyone gets a badge.
"Most vendors clear one of the three. A good one clears two. The set is rare enough that it decides who gets to bid."
There are three ways a contractor or staffing firm can respond to this, and only one of them is realistic for most.
Build it. Establish maritime operations, accumulate a clean loss record over years, persuade a carrier to write USL&H and MEL, stand up a compliant information environment, and complete a CMMC assessment. This is the honest path and it is a decade long.
Avoid it. Decline naval work and stay in commercial environments. A legitimate strategy, and the one most trades staffing firms take by default without ever framing it as a decision.
Place the workforce with an employer that already holds all three. The client keeps the customer relationship, directs the work, and controls who is on the job. The Employer of Record becomes the legal employer, which puts the Longshore and maritime liability exposure on its programme and the information handling inside its environment.
That third structure is what Revelation was built around. The specialty coverage position covers the maritime side, the CMMC page covers the information side, and weekly payroll across all 50 states covers the part everyone forgets until a crew misses a Friday.
If you are placing trades into a naval yard, these five questions separate vendors quickly. Ask for the answers in writing.
Bring us the scope and we will tell you which of the three you are exposed on, before the yard's compliance team does.
BOOK A CONSULTATIONNot simultaneously for injury purposes, because USL&H and seaman status are mutually exclusive at any given moment. But across a week the same worker can generate Longshore exposure in the yard, seaman status arguments while aboard, and CMMC scope through the documentation attached to the job. The employer has to hold all three positions at once even though the worker occupies them in sequence.
No. The suspension paused the transition to mandatory third party certification. Phase 1 self-assessment requirements, DFARS 252.204-7012, and NIST SP 800-171 remain in force, and primes remain free to require more of their suppliers than the Department requires of them. It was also done by memorandum, which can be reversed quickly.
If that is genuinely never, the exposure is limited. The difficulty is that sea trials, riding crews, and voyage repair assignments are usually decided at short notice by the yard rather than by the labour supplier, so the answer can change without the vendor being consulted. Confirm it contractually rather than assuming it operationally.
Because the cost of holding them is fixed and the volume across many clients is what makes it economic. A specialty EOR spreads decades of maritime underwriting history, an insurance programme, and a compliant information environment across a large employed population. A single contractor carrying that for one contract cannot make the arithmetic work.
No. Under an Employer of Record arrangement the client continues to direct the work, decide who is assigned, and hold the customer relationship. What transfers is the employment infrastructure: payroll, tax, insurance, and compliance administration, along with the liability that attaches to being the legal employer.
Where the employer already holds the coverage and the security programme, onboarding runs on the timescale of documentation rather than procurement, often same day to a few days. The slow parts are typically the yard's own badging and access process rather than the employment side.
With over 30 years of experience and more than half a billion dollars in payroll funded, Revelation Workforce Solutions is a trusted Employer of Record partner built on relationships, not just technology. We deliver fully compliant EOR services, including payroll administration, tax compliance, HR management, benefits, risk mitigation, and workforce technology across all 50 U.S. states. What truly sets us apart is our people providing a hands-on, personal approach that protects your brand, supports your employees, and keeps your business compliant at every level.
