In the fall of 2024, the Department of Defense finalized one of the most consequential regulatory shifts to hit the defense industrial base in decades. The Cybersecurity Maturity Model Certification (CMMC) program established a tiered verification regime requiring any organization handling controlled unclassified information (CUI) on behalf of the DoD to demonstrate, and in many cases independently prove, that it meets defined cybersecurity standards.
Most of the conversation since has centered on deadlines. When does enforcement begin? How fast can we get certified? What controls do we need to implement? These are legitimate questions. But they obscure a more fundamental reality: CMMC is not a compliance project with a finish line. It is an ongoing eligibility condition that introduces persistent, enterprise-wide risk—the kind that belongs on a board agenda, not buried in an IT department’s backlog.
For the roughly 220,000 organizations in the defense industrial base, the strategic question is no longer whether to pursue certification. It is how to govern the operational, financial, supply chain, and liability risks that certification creates as a permanent feature of doing business with the Department of Defense.
What CMMC Actually Requires
Before unpacking the risk implications, it is worth establishing what CMMC is and what it demands, since the program’s structure directly shapes the risk profile it creates.
CMMC is organized into three levels. Level 1 applies to organizations that handle only federal contract information and requires implementation of 15 basic cybersecurity practices drawn from FAR 52.204-21. Organizations self-assess and self-affirm annually. The bar is low, but the obligation is real.
Level 2 is where the program’s weight lands. It applies to any organization handling controlled unclassified information, or CUI, and requires implementation of all 110 security requirements from NIST SP 800-171. Depending on the sensitivity of the CUI involved, Level 2 may require either self-assessment or third-party assessment conducted by a certified assessor organization known as a C3PAO. In either case, a senior official within the organization must sign an affirmation attesting to the accuracy of the assessment results.
Level 3, reserved for the most sensitive programs, layers on additional requirements from NIST SP 800-172 and involves assessment by the Defense Contract Management Agency itself.
What matters from a risk governance perspective is the structure beneath these levels. CMMC is not a one-time audit. Certifications carry a three-year validity window, but the affirmation requirement is annual. The underlying security posture must be maintained continuously. And crucially, CMMC status is now a condition of contract award—meaning a gap in certification is not merely a compliance finding but a direct threat to revenue.
The Operational Continuity Problem
The most immediate risk CMMC creates is operational. An organization that fails to achieve or maintain certification cannot be awarded new contracts requiring that level and may face challenges sustaining existing ones. This transforms cybersecurity posture from a back-office concern into a front-line business continuity issue.
The challenge is compounded by the current state of the assessment ecosystem. The number of accredited C3PAOs is growing but remains limited relative to demand. Assessment timelines are difficult to predict. An organization that begins the certification process with what it believes is adequate lead time may find itself waiting months for an available assessor, then discover during the assessment that a subset of controls requires remediation—triggering another cycle of implementation, documentation, and re-assessment.
During that window, the organization’s ability to bid on or receive new work is constrained. For companies where defense contracts represent a significant share of revenue, this is not an inconvenience. It is a material business disruption. The risk compounds when contract recompete timelines intersect with certification timelines, creating scenarios where an incumbent contractor could lose work not because of performance failures but because of verification timing.
Smart risk managers are already mapping CMMC certification windows against their contract portfolio—identifying where expiration dates, recompete periods, and assessment schedules converge to create vulnerability.
Financial Forecasting Under Uncertainty
CMMC also introduces a category of financial risk that most defense contractors have not had to model before. The cost of achieving and maintaining certification is real but manageable. The deeper issue is the uncertainty it layers onto revenue forecasting.
Consider a mid-tier defense contractor with several active contracts and a pipeline of new opportunities, all requiring Level 2 certification. The company completes its assessment and receives its certification. Three years later, it must recertify. But what if the assessment ecosystem has tightened? What if the assessor identifies new gaps based on updated guidance? What if a key technology vendor has changed its architecture in ways that affect control implementation?
Each of these scenarios is plausible, and each introduces the possibility that an organization could experience a gap between certification periods, during which new contract awards are at risk and existing contract modifications may be delayed.
For financial leaders, this means CMMC status needs to be treated as a variable in revenue forecasting, not an assumption. The question is not just “what does certification cost?” but “what is the probability-weighted revenue impact of a certification delay, and what mitigation strategies reduce that exposure?” Organizations that treat CMMC as a fixed cost rather than a dynamic risk factor are building forecasts on assumptions that may not hold.
Supply Chain Fragility
Perhaps the most underappreciated dimension of CMMC risk sits in the supply chain. Prime contractors do not operate in isolation. They rely on networks of subcontractors, many of whom handle CUI and therefore require their own CMMC certification. A prime contractor can be fully certified and still face disruption if a critical subcontractor fails to achieve or maintain its certification.
This is not a hypothetical scenario. The defense supply chain includes thousands of small and mid-sized businesses—machine shops, engineering firms, IT service providers—many of which lack dedicated compliance staff and operate on thin margins. For these organizations, the cost and complexity of CMMC implementation is proportionally much higher. Some will achieve certification. Some will exit the defense market entirely. And some will attempt certification, fall short, and create gaps in their prime contractors’ supply chains at precisely the wrong moment.
The risk governance implication is straightforward: prime contractors need visibility into their subcontractors’ CMMC status with the same rigor they apply to financial health or delivery performance. A subcontractor that loses certification mid-contract creates a problem that cascades upward—potentially affecting the prime’s ability to perform, deliver, or bid on follow-on work. Procurement and supply chain teams need to be asking not just whether their vendors are certified today, but what those vendors’ recertification timelines look like, what their remediation capacity is, and whether alternative qualified vendors exist.
The Affirmation Liability Question
CMMC introduces something genuinely novel into the compliance landscape: a named senior official who personally affirms the accuracy of the organization’s assessment results. This is not a passive attestation buried in contract paperwork. It is an affirmative declaration, submitted into the Supplier Performance Risk System, that the organization meets the required security standards.
The legal and governance implications of this requirement deserve more attention than they have received. The affirmation is made under the same statutory framework that governs the accuracy of claims made to the federal government. A senior official who affirms compliance that turns out to be materially inaccurate faces potential exposure under the False Claims Act and related statutes. This is personal exposure; not merely corporate.
This changes the governance calculus. The affirming official needs to have genuine confidence in the assessment results, which means they need visibility into how the assessment was conducted, what evidence supports the findings, and where residual risks exist. They need a documented basis for their affirmation that can withstand scrutiny—not just from auditors, but potentially from federal investigators in the event of a breach or whistleblower complaint.
For boards and chief risk officers, the question is whether the organization has built the governance infrastructure to support this affirmation with integrity. Who is the affirming official? What information do they receive before signing? What independent verification exists? What happens if conditions change between annual affirmations? These are not IT questions. They are enterprise governance questions that carry legal consequence.
What Boards and CROs Should Be Asking
The common thread across all these dimensions is that CMMC risk does not live in any single function. It spans operations, finance, procurement, legal, and information security. Managing it effectively requires the same cross-functional visibility and executive attention that organizations apply to other categories of enterprise risk.
There are several questions that boards and CROs should be putting on their agendas now.
First, has the organization mapped its CMMC certification requirements against its contract portfolio and revenue forecast? Understanding which contracts require which certification level, and when those certifications expire relative to contract timelines, is the foundation of any risk management strategy.
Second, does the organization have a realistic assessment of the time, cost, and complexity required for recertification? Organizations that achieved initial certification through a concentrated effort may underestimate the ongoing investment required to maintain continuous compliance—particularly as the threat landscape evolves and controls are updated.
Third, what is the organization’s exposure to subcontractor certification failure? Identifying critical path subcontractors, understanding their CMMC status and timeline, and developing contingency plans for certification gaps should be a standard part of supply chain risk management.
Fourth, has the organization established governance processes around the annual affirmation? The affirming official should not be signing based on secondhand assurances. There should be a documented review process, supported by current evidence, that gives the official—and the board—reasonable confidence in the accuracy of the affirmation.
Fifth, is CMMC risk being reported to the board with the same regularity and rigor as other material enterprise risks? If the organization’s revenue depends on defense contracts, and those contracts depend on certification, then certification status is a board-level concern. Full stop.
From Compliance to Governance
The organizations that will navigate CMMC most effectively are not the ones that treat it as a cybersecurity checkbox. They are the ones that recognize it for what it is: a persistent condition of doing business with the Department of Defense that creates interconnected risks across the enterprise.
That recognition requires moving the conversation out of the security operations center and into the boardroom. It requires treating certification timelines as operational risks, assessment costs as dynamic financial variables, subcontractor status as supply chain risk factors, and affirmation obligations as governance responsibilities with personal legal consequences.
CMMC is not going away. The regulatory trajectory is toward more verification, not less. It’s toward greater accountability, tighter timelines, and higher expectations. The defense industrial base has spent the last several years asking how to get certified. The more important question now is how to govern the risks that certification creates, continuously, as a core discipline of enterprise risk management.
The deadline was never the hard part. The hard part is what comes after.
About the Author
Justin Beals is a serial entrepreneur with expertise in AI, cybersecurity, and governance. He founded Strike Graph in 2020 to eliminate confusion surrounding cybersecurity audit and certification processes by offering an innovative, right-sized solution at a fraction of the time and cost of traditional methods. As Strike Graph CEO, Justin drives strategic innovation within the company. He previously served as CTO of NextStep and Koru, which won the 2018 Most Impactful Startup award from Wharton People Analytics. Justin is a board member for the Ada Developers Academy, VALID8 Financial, and Edify Software Consulting. He is the creator of the patented Training, Tracking & Placement System and the author of a published paper in the International Journal of Emerging Technologies in Learning (iJET). Justin earned a BA from Fort Lewis College.
Justin can be reached online at [email protected] and on LinkedIn at https://www.linkedin.com/in/jubeals/
