CMMC Is Finally Law. Most of the Defense Supply Chain Still Can't Pass It.
November 11, 2026
Rodney Hall, COO— AI-assisted and reviewed prior to publication.
The Cybersecurity Maturity Model Certification program stopped being theoretical on November 10, 2025. That's when the 48 CFR acquisition rule took effect, making CMMC requirements a condition of winning or keeping Department of Defense contracts. Passing an assessment now depends on whether someone inside your organization actually knows how to implement and evidence all 110 security controls, not just sign a form.
What actually changed on November 10?
Before this date, defense contractors promised to protect sensitive data and mostly graded their own homework. Now that promise has teeth. Contracting officers can write CMMC requirements directly into solicitations, and a company without the right certification level simply cannot bid.
For most contractors handling Controlled Unclassified Information, that means CMMC Level 2, which requires full implementation of the 110 security requirements laid out in NIST Special Publication 800-171. Depending on how critical the program is, that implementation gets verified either through a rigorous self-assessment or through an audit by a Certified Third-Party Assessment Organization, known as a C3PAO. Either path requires the same underlying work: mapping every control to real evidence, not policy language that sounds good in a proposal.
Why are only 1% of contractors actually ready?
Because implementing 110 controls across real systems, people, and vendors takes longer than most companies budgeted for, and most started late. A Merrill Research study commissioned by CyberSheath found that only 1 percent of defense contractors considered themselves fully prepared for the assessments that now determine whether they can keep working with the Pentagon.
That gap shows up everywhere once you look for it. System security plans exist but don't match what's actually running in production. Access control policies are written but nobody can produce the configuration evidence an assessor would ask for. Plans of action and milestones sit untouched for a year because no one owns them. None of this is a paperwork problem. It's a staffing problem: most defense contractors, especially smaller subcontractors several tiers down the supply chain, have never had anyone on staff whose job is to run a control framework end to end.
The assessor bottleneck makes the timeline worse
Even contractors who are ready can't always get assessed fast enough. As of October 2025, the Cyber AB, the accreditation body that runs the CMMC ecosystem, had authorized just 83 C3PAOs to conduct Level 2 assessments nationwide. Estimates put the number of companies that will eventually need a Level 2 C3PAO assessment at roughly 80,000, against a defense industrial base of several hundred thousand suppliers in total once subcontractors are counted.
Do the math and the queue problem is obvious. Even a contractor that finishes implementation on schedule can still lose a contract award waiting for an assessment slot. Requirements also flow down the supply chain: a prime contractor's CMMC obligations extend to its subcontractors and suppliers, so a company that never deals with the Pentagon directly can still find itself on the hook because of who its customer's customer is.
Who signs for this, and why that's not the whole job
The final rule requires a senior-level representative, called the Affirming Official, to submit an annual affirmation of continuing compliance into the government's Supplier Performance Risk System. That signature carries real legal weight. Attorneys have flagged that a false or careless affirmation can expose both the signer and the company to False Claims Act liability, since the government now treats a CMMC affirmation as a certification it can enforce after the fact.
But a signature only means something if the work behind it is real. The Affirming Official isn't the person mapping 110 controls to system evidence, tracking POA&M remediation dates, or prepping for a C3PAO interview. That work belongs to whoever runs governance, risk, and compliance day to day, and in a lot of defense contractors right now, that role is either understaffed or doesn't formally exist yet.
What the day-to-day work of CMMC readiness looks like
Passing a Level 2 assessment is an operational exercise, not a document review. It involves translating each of the 110 NIST 800-171 requirements into a specific technical or procedural control, then producing evidence an outside assessor will accept.
A short, realistic list of what that work includes:
- Scoping the CUI environment correctly, so you're not assessing systems that don't need to be in scope, or missing ones that do
- Mapping each control to an owner, a system, and a piece of evidence, using the NIST SP 800-171A assessment procedures as the reference an assessor will actually use
- Maintaining a living plan of action and milestones for any control that isn't fully met, with real dates and real owners
That skill set, running a governance and risk framework from policy down to technical evidence, is exactly what ISC2's CGRC certification is built around. It's the credential most directly aligned to the authorization and control-assessment work CMMC demands, and it gives a security professional a structured way to speak both languages: the compliance language a contracting officer wants to see, and the technical language an assessor will test against.
Building the internal capability instead of outsourcing all of it
Plenty of contractors are leaning entirely on consultants to get through their first assessment. That can work once, but the annual affirmation requirement means compliance isn't a one-time project. Someone inside the company has to own continuous monitoring, control drift, and the next assessment cycle, because the Affirming Official is putting their name behind an ongoing claim, not a snapshot.
If your organization touches DoD contracts at any tier, the practical move is building that capability in-house rather than renting it every year. A curriculum overview is a reasonable place to start if you're trying to figure out which certification actually maps to the compliance work your contracts now require, versus one that only covers adjacent material. For a GRC analyst, compliance manager, or security engineer who's about to inherit this work, you can start training now rather than finding out during a failed assessment that the gaps were never closed.
The deadline pressure isn't going away
The rollout is phased, but the direction is fixed. Every new DoD solicitation moves closer to requiring certification at award, not as a follow-up condition. Contractors that treat the next twelve months as optional prep time are gambling with contract eligibility itself, not just a compliance score.
The 1 percent readiness number from late 2025 should be read as a snapshot of how far behind the industry started, not a ceiling. Companies that invest now in people who can actually run the control framework, not just sign for it, will be the ones still bidding on DoD work when the assessor queue finally catches up.