Valor Cybersecurity’s response to the CMMC Reform Task Force points to a second reform that goes after the compliance problem from a different angle: instead of making each company’s assessment cheaper, stop making every company build and defend its own boundary in the first place.

In its submission to the CMMC Reform Task Force, Valor Cybersecurity outlined several reforms aimed at reducing the cost and complexity of CMMC compliance for small and mid-size defense contractors. One of the most structurally significant is a proposal for a centralized, government-owned Defense Industrial Base (DIB) network, a shared, accredited environment where eligible contractors’ controlled unclassified information (CUI) would live, rather than each company building an independent version of the same thing.

Here’s the reasoning behind it.

The Problem: 100,000 Companies, Each Building the Same Wall

Valor’s submission identifies a cost driver that sits underneath almost every other CMMC compliance challenge: right now, every contractor in the Defense Industrial Base is expected to independently build and maintain its own compliance boundary. Enclave architecture, centralized logging, and access control tooling all get engineered separately, company by company, even when many of those companies are performing functionally identical work for the same customer.

That duplication compounds a capacity problem Valor flags elsewhere in its submission: roughly 100 authorized C3PAOs exist to assess more than 100,000 companies. Every time a company builds its own boundary from scratch, that’s one more independent environment an already-scarce pool of assessors has to review, scope, and re-review over time. The result is a system where thousands of companies are separately reinventing the same architecture, and a thin bench of assessors is separately re-verifying each reinvention.

The Fix: One Accredited Environment, Not Thousands of Look-Alike Ones

Valor’s recommendation starts from a smaller, more immediate idea: where a contractor’s CUI environment already sits entirely within a FedRAMP-authorized platform, or is monitored by a DoW-recognized managed security provider, that platform’s own authorization should count directly toward the contractor’s assessment. There’s no reason for a company to independently re-document controls a platform has already proven it satisfies.

That principle points toward the larger structural reform: the Department of War should establish or formally sponsor a centralized, government-owned and managed network environment where eligible contractors’ CUI is created, stored, and transmitted within a single accredited boundary. Instead of building an independent equivalent one company at a time, contractors would be provisioned access into an environment that has already been accredited.

The effect on the assessment problem is direct. As Valor’s submission puts it, this approach collapses the assessment surface from well over 100,000 independent boundaries down to a small number of government-controlled environments that can be assessed centrally. Fewer, larger, more consistently built environments means fewer things for a scarce pool of assessors to individually evaluate, which addresses the capacity shortage at its root rather than only its symptoms.

This Is the Long Play, Not the Quick Fix

Valor is direct about where this recommendation sits on the implementation timeline. Unlike the cohort assessment model or standardized self-assessment templates, which could be piloted within the current 60-day review window using infrastructure that already exists, the centralized DIB network is described in Valor’s submission as the most structurally significant recommendation and the most resource-intensive. It would likely require a phased rollout, starting with a pilot cohort of contractors in a single sector or region, before broader adoption.

That’s not a reason to set it aside. It’s a reason to start the clock now. A reform this significant needs a runway, and the sooner a pilot begins, the sooner the Department has real data on whether the model works before scaling it across the industrial base.

The Trade-Off Worth Naming

Valor’s submission doesn’t present this as a reform without risk, and that candor is worth preserving here. Concentrating CUI in a smaller number of environments reduces the assessment burden, but it also creates a higher-value target. A centralized network would need to be held to a FedRAMP High equivalent standard with its own continuous monitoring, and the Department should hold its own management of that environment to the same rigor it expects of industry today.

There’s an upside worth naming too. Valor’s submission points out that pairing a centralized network with a shared threat intelligence feed across participating contractors could turn a compliance cost center into a genuine early-warning capability for the DIB, something no individual small business could build on its own. Centralizing the boundary doesn’t just reduce redundant cost; done well, it could make the entire industrial base more resilient than the sum of its individually built parts.

Why This Matters Alongside the Cohort Model

Valor’s submission is clear that these reforms aren’t competing ideas; they operate on different timelines toward the same goal. Cohort assessment reduces the cost of assessing the boundaries that exist today. A centralized DIB network reduces the number of boundaries that need to exist, and need to be assessed, at all. One is a near-term fix the Task Force can pilot immediately. The other is a structural change worth starting now, so it’s in place well before the next generation of small and non-traditional businesses is deciding whether defense work is worth the cost of entry.

Valor Cybersecurity will continue advocating for this and the other reforms outlined in our full submission to the CMMC Reform Task Force, and we remain available to provide further detail on any recommendation.

Valor Cybersecurity is a CMMC compliance and cybersecurity readiness company based in Norfolk, Virginia, serving defense manufacturers and shipyards across the Defense Industrial Base.