The US Defense Department has begun rolling out the Cybersecurity Maturity Model Certification (CMMC), a long-delayed framework aimed at protecting sensitive government information across the defense supply chain.
While designed to strengthen cybersecurity, the new rules are prompting some small suppliers to reconsider military contracts due to high compliance costs and operational uncertainty.
What Is CMMC?
The CMMC, introduced in 2019 and launched in phased form last November, applies to companies handling controlled unclassified information (CUI) tied to federal defense contracts.
Three Levels:
- Level 1 – Self-assessment (currently required).
- Level 2 – Independent audits (expected to begin by November).
- Level 3 – Highest security level (for the most sensitive work).
The goal is to prevent cyber breaches that could expose military designs, logistics systems, and operational data.
Why Small Suppliers Are Concerned
1️⃣ High Compliance Costs
Industry sources report that:
- Small firms may need to spend hundreds of thousands of dollars to meet Level 2 audit standards.
- One Canadian aerospace executive estimates C$500,000 in compliance costs for U.S. and European cybersecurity standards.
For businesses operating on thin margins, especially those serving both commercial and defense markets, these costs are significant.
2️⃣ Audit Delays and Confusion
Executives say:
- There are months-long waits for certification audits.
- There is ongoing confusion about what qualifies as controlled information.
- Some contractors are demanding higher cybersecurity standards from suppliers even when they do not handle sensitive data like fighter jet technical drawings.
This uncertainty adds administrative and legal burdens.
3️⃣ Risk to the Defense Supply Chain
Small businesses make up:
- 88% of aerospace firms, according to U.S. House data.
Many are:
- Sole-source providers of specialized components.
- Critical to maintaining production for major defense programs.
If small firms exit the defense market, it could:
- Reduce competition.
- Increase costs.
- Create bottlenecks.
- Undermine efforts to expand and diversify the defense industrial base.
This comes at a time when the Trump administration is pushing contractors to boost output and strengthen supply resilience.
Industry Reactions
Margaret Boatner, Vice President at the Aerospace Industries Association, warned:
“The accumulation of complex and costly regulatory requirements is forcing some firms to reconsider—if not exit—the defense marketplace altogether.”
Legal experts note additional complications for international suppliers, who must comply with both:
- US CMMC rules
- European data privacy and cybersecurity laws
Conflicting standards may create legal and operational tensions.
The Bigger Picture
CMMC aims to:
- Strengthen national security.
- Protect sensitive military data.
- Standardize cybersecurity expectations across contractors.
However, the rollout highlights a difficult balancing act:
Stronger security vs. maintaining a resilient and competitive supply chain.
If compliance becomes too expensive or complex, the defense ecosystem may shrink—potentially increasing long-term strategic risks rather than reducing them.