Valor Cybersecurity’s final recommendation to the CMMC Reform Task Force doesn’t ask for a new program, a new tier, or a new piece of infrastructure. It asks the Department to fix a guidance gap that’s quietly inflating the compliance population, without ever having to touch the underlying rule.

Of all the reforms in Valor Cybersecurity’s submission to the CMMC Reform Task Force, this last one may be the simplest to act on. It doesn’t require standing up new infrastructure, training a new generation of assessors, or designing a new assurance tier. It asks the Department of War to clarify something that should already be clear: which subcontractors actually need to meet CMMC Level 2 requirements in the first place.

The Problem: Caution Is Expanding the Compliance Population Beyond the Data That Needs Protecting

CMMC exists to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Logically, that means the companies who need to meet its requirements are the companies who actually handle that information. But Valor’s submission points to a pattern its clients encounter regularly: a significant share of the compliance population exists only because prime contractors flow down full Level 2 requirements to subcontractors who never handle FCI or CUI at all.

This isn’t happening because primes are indifferent to cost or trying to make life harder for their subcontractors. It’s happening, according to Valor’s submission, out of excess caution in the absence of clear guidance. When a prime isn’t certain exactly where the line sits, the safer legal position is to flow down the full requirement to everyone in the supply chain, whether or not a given subcontractor ever touches in-scope information. That’s a rational response to ambiguity. It’s also an expensive one, and it’s being paid for by companies whose actual security posture has nothing to do with why they’re being asked to spend six figures on assessment.

The Fix: Guidance, Not a New Rule

Valor’s recommendation is narrow and specific: the DoW should issue explicit contractual flow-down guidance limiting CMMC requirements to subcontractors who actually handle in-scope information.

That’s the entire recommendation. It doesn’t ask the Department to redefine what counts as CUI, change the assessment process, or create a new category of contractor. It asks for clear, authoritative direction that primes can rely on when structuring flow-down clauses, so that the decision to require Level 2 compliance is based on whether a subcontractor actually touches FCI or CUI, not on how much legal exposure a prime is willing to tolerate under ambiguous guidance.

Why This Matters: It Shrinks the Problem Without Touching the Standard

What makes this recommendation notable is what it doesn’t require. As Valor’s submission puts it, this would meaningfully shrink the population required to comply without changing the underlying rule or reducing protection for data that is genuinely at risk.

That distinction matters throughout Valor’s broader submission. Every other reform, cohort assessments, a centralized DIB network, a tiered assurance model, an accelerated assessor pipeline, is designed to make compliance more affordable for companies who actually need to comply. This recommendation does something different: it correctly sizes who needs to comply in the first place. A subcontractor who never handles FCI or CUI isn’t a company that needs a cheaper path to Level 2 certification. It’s a company that shouldn’t be in the Level 2 population at all.

That has a compounding effect on every other constraint described in Valor’s submission. Fewer companies flowed down into full Level 2 requirements means fewer companies competing for the same scarce pool of roughly 100 C3PAOs. It means fewer six-figure assessments being paid for by companies with no meaningful CUI footprint to protect. And it means the assessor capacity that does exist can concentrate on the contractors actually handling the information CMMC was built to protect.

No Data Gets Less Protected

It’s worth being direct about what this recommendation does not do. It doesn’t loosen requirements for any subcontractor who genuinely handles FCI or CUI. Those companies remain fully in scope, held to the same standard as before. This recommendation targets a specific inefficiency: subcontractors swept into the compliance population by default, not by the actual sensitivity of the information they handle. Removing them from that population doesn’t reduce protection for federal data, because they were never a meaningful risk to that data to begin with.

A Simple Reform With Outsized Reach

Compared to the other recommendations in Valor’s submission, this one carries a different kind of weight. It’s not the most structurally significant, and it’s not the most resource-intensive to implement. But it may be the fastest to act on, since it requires guidance rather than a new rule, a new tier, or new infrastructure, and its effect touches every subcontractor tier across the Defense Industrial Base simultaneously.

Taken together with the other reforms in Valor’s submission, cohort assessments, a centralized DIB network, an accelerated assessor pipeline, and a tiered assurance model, this recommendation addresses a different kind of cost: not the cost of assessment itself, but the cost of being asked to comply with something that was never proportionate to the risk a company actually presents. Fixing that doesn’t require rebuilding CMMC. It requires the Department to say clearly what the rule was always meant to mean.

Valor Cybersecurity will continue advocating for this and the other reforms outlined in our full submission to the CMMC Reform Task Force, and we remain available to provide further detail on any recommendation.

Valor Cybersecurity is a CMMC compliance and cybersecurity readiness company based in Norfolk, Virginia, serving defense manufacturers and shipyards across the Defense Industrial Base.