On November 10, 2025, the Cybersecurity Maturity Model Certification (CMMC) officially became law. For defense contractors across the United States and for international companies supporting the U.S. defense mission, this marked a significant shift. CMMC is no longer a proposed framework or a future requirement. It is enforceable, and it is now appearing in contract requirements and amendments throughout the defense industrial base.
Greg Tomchick, CEO of Valor Cybersecurity, outlines what has changed, what we are seeing in the market since CMMC became law, and what defense contractors should be doing now to protect their businesses and remain eligible for Department of Defense contracts.
The Evolution of CMMC
CMMC traces its origins back to 2017, when the Department of Defense began formalizing stronger cybersecurity requirements to protect Controlled Unclassified Information (CUI) across the defense supply chain. Since 2019, the framework has continued to evolve, and many companies questioned whether it would ever fully materialize.
Today, those questions have been answered. CMMC is active, enforceable, and tied directly to contract eligibility.
Beyond the United States, other countries including Canada, Australia, the United Kingdom, and members of the European Union are developing their own defense cybersecurity standards modeled in part on CMMC. The global defense supply chain is moving toward regulated cybersecurity as a baseline expectation.
At its core, CMMC is about protecting sensitive information and ensuring that companies handling defense-related data are not exposing it to adversaries. It is about operational resilience and safeguarding national security.
What Has Happened Since CMMC Became Law
In the first three months following enactment:
- Approximately 800 companies have completed and passed a CMMC audit.
- More than 1,000 companies have been audited in total.
- Audit costs have continued to increase.
- Failures, while not publicly reported, are occurring and often result in costly rework and reassessments.
One emerging concern is the financial strain on small and mid-sized defense contractors. For many organizations under 500 employees, audit costs and remediation efforts can create significant financial pressure, particularly when those costs cannot be billed back to contracts.
There are ongoing discussions at the federal level about how to better support small businesses within the defense industrial base. Policymakers are increasingly evaluating how CMMC implementation affects national security readiness, especially if compliance costs unintentionally reduce participation in the defense supply chain.
For contractors, the key takeaway is clear: waiting is no longer an option. CMMC is active, audits are underway, and enforcement is real.
What We Are Seeing in CMMC Audits
From an audit perspective, there are several common themes.
- Terminology and Clarity Matter
Auditors are looking for clear, definitive answers. When leadership or technical teams respond with phrases like “sometimes” or “most of the time,” that is typically interpreted as noncompliance. CMMC assessments are structured around objective evidence. Controls must be implemented and consistently followed, not partially applied.
A single weak answer during an interview can trigger a failed control, requiring remediation and a return visit from the assessor. That means more time, more cost, and potential contract delays.
- Leadership Involvement Is Critical
One of the most common mistakes is treating CMMC as an IT project. It is not.
CMMC is a business requirement. It impacts governance, operations, human resources, vendor management, and executive oversight. When organizations assign CMMC solely to an IT manager without executive ownership, audits often reveal gaps in policy enforcement and governance.
Executives must dedicate time, even if limited, to understand their organization’s cybersecurity posture and program maturity. Shared responsibility and ownership across leadership is essential.
- People, Process, and Technology
Cybersecurity is often misunderstood as a technology initiative. In reality, it rests on three pillars: People, Process, and Technology
Technology supports the business. People execute the processes. CMMC requires alignment across all three.
Organizations that focus only on technical controls without documented processes and employee training typically struggle during audits.
The Five Critical Steps to CMMC Success
For contractors preparing for CMMC, a structured roadmap is essential. Based on experience supporting hundreds of organizations, the following five steps form a practical and effective approach.
Step 1: Properly Scope Your Environment
Scoping is the foundation of the entire CMMC program.You must clearly define:
- Where CUI is handled
- How CUI flows through your systems
- The boundaries of the environment in scope
If scoping is done incorrectly, every subsequent step becomes more expensive and more complex. Over-scoping can dramatically increase costs. Under-scoping can lead to audit failure.
This is the most critical first step and where many companies make costly mistakes.
Step 2: Implement Required Controls
Once the scope is defined, organizations must implement the required security controls. For Level 2 contractors, this means aligning with NIST SP 800-171.
Implementation includes:
- Access controls
- Multi-factor authentication
- Logging and monitoring
- Configuration management
- Incident response capabilities
- Vendor risk management
This phase requires coordination between IT, leadership, and operational stakeholders.
Step 3: Document Everything
Documentation is not optional. You must develop and maintain:
- A System Security Plan
- A Written Information Security Policy
- An Incident Response Plan
- A Supply Chain Risk Management Plan
- Supporting procedures and evidence
During an audit, assessors will review documentation in detail. If a prime contractor requests evidence of your cybersecurity posture, these documents will be your formal proof.
Step 4: Prepare for the Audit
Preparation includes internal validation, evidence collection, and ensuring that personnel are ready for assessor interviews. Every control must be implemented and consistently applied.
Audit readiness should include mock interviews and documentation reviews to eliminate ambiguity before the formal assessment.
Step 5: Manage and Maintain the Program
CMMC is not a one-time effort.
As your business evolves, your cybersecurity program must evolve with it. Changes such as new software tools, upgraded Microsoft or Google licenses, new contracts, or operational changes must be evaluated through your cybersecurity framework.
If structured properly, a NIST 800-171 aligned program positions your organization not only for CMMC, but also for other frameworks such as ISO 27001 and SOC 2. A mature cybersecurity program becomes a competitive advantage.
Timeline Expectations
For most organizations, achieving CMMC readiness takes between 6 and 12 months.
Six months is aggressive and typically requires strong executive support, focused resources, and experienced guidance. Many contractors begin the process under time pressure due to contract requirements from a prime or direct government customer.
Planning early reduces cost and operational disruption.
CMMC as a Strategic Business Requirement
The most important mindset shift for defense contractors is this: CMMC is a business requirement, not an IT initiative.
Organizations that treat it as a technical checkbox exercise often overspend, underperform during audits, and create unnecessary operational friction. Those that approach it as a strategic business function integrate cybersecurity into governance, operations, and risk management.
CMMC enforcement is accelerating. Audit costs are rising. Expectations are clear. The organizations that will thrive are those that approach cybersecurity proactively rather than reactively.
Final Thoughts
CMMC represents a fundamental change in how cybersecurity is regulated within the defense industrial base. It reflects a broader global movement toward regulated cybersecurity across national defense ecosystems.
For defense contractors, the path forward is clear:
- Understand your scope.
- Implement required controls.
- Document thoroughly.
- Engage leadership.
- Treat cybersecurity as a business function.
National security depends not only on the warfighter, but also on the strength and resilience of the defense supply chain. Organizations that build strong cybersecurity foundations will protect their businesses, protect sensitive information, and remain competitive in the evolving defense landscape.
Catch the discussion with Greg Tomchick, CEO of Valor Cybersecurity, here:
