VR&E Self-Employment Business Plan

Veteran: Michael Cochran · 30% Service-Connected · Army 17C (Cyber Operations) · JCAC 2014
Entity: The Cochran Block, LLC · EIN 41-3835237 · Dundalk, MD 21222
Post-9/11 GI Bill: 23 months remaining (electing P9/11SA for Baltimore BAH)
CSB: Approved · SDVOSB: Pending · SAM.gov: IRS Validated · CAGE Pending (DLA Reviewing) · UEI W7X3HAQL9CF9 · eMMA: SUP1095449

The Cochran Block is a Maryland Certified Small Business specializing in memory-safe software architecture for federal agencies. We develop compiled Rust applications that replace cloud infrastructure — a single 8.4 MB binary replaces $36,000/year in AWS bills.

The Business Model: All software released under The Unlicense (public domain). Zero procurement friction — no ITAR/EAR licensing, no sole-source justification, no vendor lock-in. Revenue comes from professional services: implementation consulting ($225/hour), air-gapped DevSecOps architecture, and environment-specific hardening for DoD/IC/federal deployments.

Every claim below is verifiable by clicking through this site:

• 15 public repositories on GitHub, 13 Unlicense — github.com/cochranblock
• 30-minute commit tracker — machine-verified continuous development, not self-reported
• Binary sizes from 48 KB to 51.5 MB — every binary measured, every claim verified
• First paying client — oakilydokily.com under active contract
• Production infrastructure: 4 bare metal Debian nodes, GPU compute (RTX 3070 8GB + RTX 3050 Ti 4GB), automated deployment pipeline
• This site — 8.4 MB Rust binary, $10/month infrastructure, zero cloud

Federal market entry requires validated performance data generated in enterprise-grade computing environments:

1. AI/ML Model Validation at Scale
Federal procurement officers require performance benchmarks generated on hardware comparable to their deployment targets. University lab environments provide multi-GPU clusters, standardized benchmarking infrastructure, and published results that constitute "past performance by proxy" for SAM.gov proposals.

2. FIPS 140-3 Crypto Validation Environment
Federal deployments require FIPS-validated cryptographic modules. Transitioning from development-grade crypto to FIPS-certified implementations requires testing against NIST CAVP test vectors on controlled lab equipment.

3. Air-Gapped/Edge Computing Stress Testing
Government edge deployments (tactical, shipboard, SCIF) operate on resource-constrained hardware without internet. Validation requires isolated network segments, ARM/RISC-V boards matching DoD targets, and 72+ hour sustained load tests.

1. UMBC Center for Applied AI — GPU clusters, AI research focus, DoD-adjacent faculty
2. Johns Hopkins Applied Physics Laboratory — Federal research heritage, security clearance infrastructure
3. University of Maryland, College Park — Maryland Cybersecurity Center (MC2) — NIST partnership, FIPS expertise

The Veteran maintains a custom-built dashboard that tracks and verifies continuous Git commits at 30-minute intervals across all 15 active repositories:

• 30-minute commit tracker → Objective evidence of sustained productivity — machine-verified, not self-reported
• Public audit trail → Every commit timestamped, hashed, and published to GitHub
• Binary size leaderboard → Every product measured — 48 KB to 51.5 MB
• Proof of Artifacts — Each repo maintains verifiable build metrics, test results, and binary sizes
• Timeline of Invention — Dated, hash-verified commit history establishing IP provenance

This documentation rigor exceeds standard industry practice and demonstrates the discipline, consistency, and technical capability required for successful self-employment under VR&E Category II.

CISA "Secure by Design" (2024-2026): Mandates memory-safe languages for all new federal software. Rust is the only compiled systems language on CISA's recommended list. Every Cochran Block product is 100% Rust.

EO 14028 SBOM Requirements: Cochran Block ships machine-readable Software Bills of Materials with every release. Complete dependency tree known at compile time.

NIST SP 800-218 (SSDF): Development practices mapped to all four task areas — Prepare (PS), Protect Software (PW), Respond to Vulnerabilities (RV), Protect Operations (PO).

CMMC Level 1-2: Compliance documentation maintained per-project in standardized govdocs/ directories.

FedRAMP: On-premises deployment model eliminates cloud authorization boundary complexity entirely. No cloud = no FedRAMP boundary = faster ATO.