“The future of defense compliance is infrastructure, not repetition.”

-Greg Tomchick, Valor Cybersecurity CEO

I have been in this space long enough to recognize when a policy conversation is circling the right answer without quite landing on it.

The CMMC Reform Task Force is doing exactly that right now.

The debate is real and the problems being raised are legitimate. Cost burden on small contractors. Assessment body accountability. Timeline pressure that is pushing innovative companies out of the defense industrial base before they ever get a chance to contribute. These are not manufactured complaints. They are the daily reality of the manufacturers, shipyard suppliers, and dual-use startups I work with across Hampton Roads and the broader defense supply chain.

But there is a structural observation sitting underneath all of those symptoms that the Task Force has not named yet. And until they name it, every reform they recommend will treat the fever without addressing the infection.

Here it is.

The current CMMC model requires every contractor to rebuild compliance from scratch. Every single time.

The Compliance Hamster Wheel

A new company enters the defense supply chain. A contract award triggers a CMMC requirement. The clock starts. Eighteen months. A hundred thousand dollars. A gap assessment. An SSP built from a blank document. A POA&M developed without any shared context from the primes or program offices the contractor supports. An evidence package assembled by people who have never done this before and will have to do it all over again when the next contract cycle begins.

Multiply that across tens of thousands of defense contractors and subcontractors. Add the friction of every company interpreting the same 110 controls differently. Factor in the assessors who find different gaps in programs built to the same standard because there is no shared infrastructure creating consistency.

What you get is not a compliance ecosystem. It is a compliance hamster wheel. Expensive. Exhausting. Structurally incapable of keeping pace with a threat environment that does not wait for procurement timelines or 60-day Task Force reviews.

The Task Force is being asked to make the wheel spin faster and cost less. That is the wrong problem to solve.

The Right Model Already Exists

The Department of Defense has a model for this in physical terms and has had it for decades.

When a new contractor needs access to a secure facility, nobody builds them a new SCIF. The infrastructure already exists. The contractor goes through an access review. They demonstrate they meet the requirements. They are granted the appropriate level of access to an environment that was built once and maintained continuously for everyone who qualifies.

That is the model CMMC compliance should follow.

Not every contractor building their own independent compliance program in isolation. Shared infrastructure that contractors onboard into. Access reviews that confirm eligibility rather than full program rebuilds that duplicate cost and introduce inconsistency. A continuous compliance environment maintained at the program or supply chain level, not reconstructed from zero every time a new company wins a contract.

This is not theoretical. This is the architecture we are already building at Valor Cybersecurity through our pooled compliance model, and through 757Defend across the Hampton Roads defense manufacturing supply chain. One infrastructure. Multiple contractors. Access reviews instead of repeated rebuilds. Thirty to fifty percent lower per-company cost. Consistent posture across the entire supply chain rather than fragmented programs of varying quality and depth.

The CMMC Reform Task Force should not be recommending how to make individual compliance programs cheaper. They should be recommending this model as the architecture for how the Department of Defense approaches contractor compliance at scale.

The Data Problem Nobody Is Naming

There is a second structural issue sitting underneath the compliance problem that rarely gets named directly, and it is the one that creates the most persistent vulnerability in the defense industrial base.

The Department of the Navy and the broader defense industrial base operate across a fragmented network of contractors, subcontractors, suppliers, and partners who all touch sensitive data at some point in the workflow. Technical drawings pass from prime to Tier 2. Maintenance specifications flow from government program offices to ship repair contractors. Contract performance data moves between ERP systems that were never designed with CUI handling in mind.

The result is that nobody has a clear picture of where the data actually lives. Not the prime. Not the program office. Not the contractor three levels down the supply chain who received a controlled technical drawing via email six months ago and stored it in a shared folder that nobody has reviewed since.

CMMC requires contractors to define their system boundary and document where CUI flows within that boundary. That is the right requirement. The problem is that most contractors are defining their boundary in isolation, without visibility into how their environment connects to the broader DoN and DIB network. They define what they can see. They have no way of seeing what they cannot.

This is how CUI spreads. Not through malicious intent. Through ambiguity. Through the absence of clear data ownership at the point where information moves between organizations. Through the natural tendency of controlled information to flow toward whoever needs it, regardless of whether the infrastructure protecting that movement is adequate.

Three Things That Have to Be True

The conversation the Task Force needs to have is not just about certification timelines or assessment body accountability. It is about the fundamental architecture of how controlled information moves through the defense supply chain and who is responsible for it at every step.

Three things need to be true for that architecture to actually work.

Data ownership needs to be defined before the contract is awarded. Not discovered during a compliance assessment. Not negotiated after a prime sends a questionnaire. Before the contract is signed, every piece of CUI that will flow from a government program office or prime contractor to a subcontractor needs a designated owner. A named organization with documented responsibility and the authority to enforce the protections that responsibility requires.

The scope of CUI needs to be minimized at the point of generation. The single most effective compliance control is not a technical safeguard. It is reducing how much controlled information exists in how many places. Defense programs routinely generate far more CUI than the mission actually requires because nobody is asking the minimization question early enough in the process. Minimizing spread before it happens is dramatically cheaper and more effective than containing it after the fact.

Shared infrastructure needs to replace repeated rebuilds. This is the structural shift that the Task Force has the authority and the opportunity to recommend. Not every contractor building their own compliance program in isolation, each one a slightly different interpretation of the same 110 controls. A tiered infrastructure model where contractors onboard into shared environments, demonstrate access eligibility, and are maintained within a continuous compliance framework that does not require them to start over every time a contract changes or a new company enters the chain.

What This Looks Like When It Works

We are running this model in Hampton Roads right now and the results are not complicated.

A Tier 1 prime or a shipyard anchors the compliance infrastructure. The shared enclave environment, the documentation framework, the assessor access, and the evidence management system are built once at the program level. Tier 2 and Tier 3 suppliers onboard into that infrastructure. Their compliance review confirms that their operations meet the access requirements for that specific supply chain. The cost per contractor drops significantly. The compliance posture across the supply chain is consistent and auditable rather than fragmented and inconsistent. When a new supplier enters the chain, they onboard into existing infrastructure rather than rebuilding from scratch on their own timeline with their own budget.

This is what the DoN and the broader DIB network should look like. Not thousands of independent compliance programs of varying quality, each rebuilt every contract cycle and each representing a potential gap that an adversary can exploit. A layered infrastructure where the standards are set at the top, the shared environment is maintained continuously, and the access review confirms eligibility without asking every contractor to solve the same problem alone.

The Task Force Has the Opportunity to Say This Out Loud

The CMMC Reform Task Force was created to address real problems in how the current framework is being implemented. Cost. Timeline. Duplication. Burden on small contractors. Those problems are real and they deserve serious answers.

But the most important answer is not a timeline adjustment or an assessment body reform, as necessary as those changes may be. It is a structural recommendation that the current model of every contractor building their own compliance program in isolation is not sustainable at the scale and speed the defense industrial base requires.

The answer is infrastructure. Shared. Tiered. Built to support access reviews rather than repeated rebuilds. Designed to minimize CUI spread from the point of generation. Anchored to clear data ownership that is defined before a contract is awarded, not discovered during an assessment eighteen months after the work has already begun.

The Hampton Roads defense manufacturing ecosystem is already proving this model works. The Task Force has the opportunity to recommend it at national scale.

That is the observation worth making. That is the reform worth building.