In the fall of 2024, the Department of Defense finalized one of the most consequential regulatory shifts to hit the defense industrial base in decades. The Cybersecurity Maturity Model Certification (CMMC) program established a tiered verification regime requiring any organization handling controlled unclassified information (CUI) on behalf of the DoD to demonstrate, and in many cases independently prove, that it meets defined cybersecurity standards.

Most of the conversation since has centered on deadlines. When does enforcement begin? How fast can we get certified? What controls do we need to implement? These are legitimate questions. But they obscure a more fundamental reality: CMMC is not a compliance project with a finish line. It is an ongoing eligibility condition that introduces persistent, enterprise-wide risk—the kind that belongs on a board agenda, not buried in an IT department’s backlog.

For the roughly 220,000 organizations in the defense industrial base, the strategic question is no longer whether to pursue certification. It is how to govern the operational, financial, supply chain, and liability risks that certification creates as a permanent feature of doing business with the Department of Defense.

What CMMC Actually Requires

Before unpacking the risk implications, it is worth establishing what CMMC is and what it demands, since the program’s structure directly shapes the risk profile it creates.

CMMC is organized into three levels. Level 1 applies to organizations that handle only federal contract information and requires implementation of 15 basic cybersecurity practices drawn from FAR 52.204-21. Organizations self-assess and self-affirm annually. The bar is low, but the obligation is real.

Level 2 is where the program’s weight lands. It applies to any organization handling controlled unclassified information, or CUI, and requires implementation of all 110 security requirements from NIST SP 800-171. Depending on the sensitivity of the CUI involved, Level 2 may require either self-assessment or third-party assessment conducted by a certified assessor organization known as a C3PAO. In either case, a senior official within the organization must sign an affirmation attesting to the accuracy of the assessment results.

Level 3, reserved for the most sensitive programs, layers on additional requirements from NIST SP 800-172 and involves assessment by the Defense Contract Management Agency itself.

What matters from a risk governance perspective is the structure beneath these levels. CMMC is not a one-time audit. Certifications carry a three-year validity window, but the affirmation requirement is annual. The underlying security posture must be maintained continuously. And crucially, CMMC status is now a condition of contract award—meaning a gap in certification is not merely a compliance finding but a direct threat to revenue.

The Operational Continuity Problem

The most immediate risk CMMC creates is operational. An organization that fails to achieve or maintain certification cannot be awarded new contracts requiring that level and may face challenges sustaining existing ones. This transforms cybersecurity posture from a back-office concern into a front-line business continuity issue.

The challenge is compounded by the current state of the assessment ecosystem. The number of accredited C3PAOs is growing but remains limited relative to demand. Assessment timelines are difficult to predict. An organization that begins the certification process with what it believes is adequate lead time may find itself waiting months for an available assessor, then discover during the assessment that a subset of controls requires remediation—triggering another cycle of implementation, documentation, and re-assessment.

During that window, the organization’s ability to bid on or receive new work is constrained. For companies where defense contracts represent a significant share of revenue, this is not an inconvenience. It is a material business disruption. The risk compounds when contract recompete timelines intersect with certification timelines, creating scenarios where an incumbent contractor could lose work not because of performance failures but because of verification timing.

Smart risk managers are already mapping CMMC certification windows against their contract portfolio—identifying where expiration dates, recompete periods, and assessment schedules converge to create vulnerability.

Financial Forecasting Under Uncertainty

CMMC also introduces a category of financial risk that most defense contractors have not had to model before. The cost of achieving and maintaining certification is real but manageable. The deeper issue is the uncertainty it layers onto revenue forecasting.

Consider a mid-tier defense contractor with several active contracts and a pipeline of new opportunities, all requiring Level 2 certification. The company completes its assessment and receives its certification. Three years later, it must recertify. But what if the assessment ecosystem has tightened? What if the assessor identifies new gaps based on updated guidance? What if a key technology vendor has changed its architecture in ways that affect control implementation?

Each of these scenarios is plausible, and each introduces the possibility that an organization could experience a gap between certification periods, during which new contract awards are at risk and existing contract modifications may be delayed.

For financial leaders, this means CMMC status needs to be treated as a variable in revenue forecasting, not an assumption. The question is not just “what does certification cost?” but “what is the probability-weighted revenue impact of a certification delay, and what mitigation strategies reduce that exposure?” Organizations that treat CMMC as a fixed cost rather than a dynamic risk factor are building forecasts on assumptions that may not hold.

Supply Chain Fragility

Perhaps the most underappreciated dimension of CMMC risk sits in the supply chain. Prime contractors do not operate in isolation. They rely on networks of subcontractors, many of whom handle CUI and therefore require their own CMMC certification. A prime contractor can be fully certified and still face disruption if a critical subcontractor fails to achieve or maintain its certification.

This is not a hypothetical scenario. The defense supply chain includes thousands of small and mid-sized businesses—machine shops, engineering firms, IT service providers—many of which lack dedicated compliance staff and operate on thin margins. For these organizations, the cost and complexity of CMMC implementation is proportionally much higher. Some will achieve certification. Some will exit the defense market entirely. And some will attempt certification, fall short, and create gaps in their prime contractors’ supply chains at precisely the wrong moment.

The risk governance implication is straightforward: prime contractors need visibility into their subcontractors’ CMMC status with the same rigor they apply to financial health or delivery performance.

The Impact of Subcontractor Certification Loss on Prime Contractors

When a subcontractor loses certification mid-contract, it can create a ripple effect that impacts the prime contractor’s ability to deliver on their commitments. This can lead to potential challenges in performing, delivering, or bidding on follow-on work. Procurement and supply chain teams must not only ensure that their vendors are currently certified but also consider factors such as recertification timelines, remediation capacity, and the availability of alternative qualified vendors.

The Legal Implications of CMMC Affirmation Liability

The Cybersecurity Maturity Model Certification (CMMC) introduces a unique requirement where a named senior official must personally affirm the accuracy of the organization’s assessment results. This affirmation is not simply a formality but a legally binding declaration submitted into the Supplier Performance Risk System. Any inaccuracies in this affirmation can expose the affirming official to potential legal issues under statutes like the False Claims Act.

This new requirement shifts the governance landscape, requiring senior officials to have full confidence in the assessment results. They need to understand how the assessment was conducted, the evidence supporting the findings, and any residual risks. Boards and chief risk officers must ensure that the governance infrastructure supports this affirmation with integrity to avoid legal consequences.

Key Questions for Boards and Chief Risk Officers

Boards and Chief Risk Officers need to address several critical questions regarding CMMC compliance:

• Have CMMC certification requirements been mapped against the organization’s contract portfolio and revenue forecast?
• Does the organization have a realistic understanding of the time, cost, and complexity of recertification?
• What is the exposure to subcontractor certification failure, and are contingency plans in place?
• Has the organization established robust governance processes around the annual affirmation?
• Is CMMC risk being reported to the board with the same rigor as other enterprise risks?

Transitioning from Compliance to Governance

Effective navigation of CMMC requires organizations to move beyond viewing it as a checkbox for cybersecurity compliance. It is a continuous business condition with interconnected risks across the enterprise. This shift necessitates elevating the conversation to the boardroom and treating certification timelines, assessment costs, subcontractor status, and affirmation obligations as critical governance responsibilities.

As regulatory requirements continue to evolve towards greater verification and accountability, organizations must focus on governing the risks created by certification as a core aspect of enterprise risk management. The true challenge lies not in meeting deadlines but in effectively managing the ongoing risks associated with CMMC certification.

“Please do not hesitate to contact me if you have any questions”

into a more formal tone:

“Should you have any inquiries, please feel free to reach out to me at your earliest convenience.”