CYBERSECURITY

The CMMC Readiness Gap: Why Many Small Manufacturers Are Unprepared

Although small businesses account for more than 70 percent of all DoD suppliers, many are discovering gaps in their CMMC readiness as enforcement approaches.

By Greg Rankin

As the Cybersecurity Maturity Model Certification (CMMC) program moves forward with its phased rollout, a significant portion of the Department of Defense (DoD) supply chain is approaching a critical inflection point. Small businesses account for roughly 73 percent of the companies that support DoD programs, yet many of those suppliers remain far less prepared for formal cybersecurity assessments than they believe.

On the surface, many small and mid-sized manufacturers look highly advanced. CNC machines run around the clock. Advanced robotics operate autonomously. Production systems are tightly integrated to meet demanding tolerances and delivery schedules.

What often gets overlooked is how deeply connected these environments really are.

“For many manufacturers, when they think about cybersecurity, it’s the front-office computers,” said Michael Eaton, executive director of the Missouri Association of Manufacturers (MAM). “Owners think about accounting systems or email. They don’t always think about the shop floor machines tied to the internet.”

Since taking on the leadership role at MAM six years ago, Eaton has spent most of his time with his boots on the ground, visiting more than 330 manufacturing operations across Missouri. Those visits have given him a clear view of where small manufacturers inside the defense industrial base stand when measured against the scope of a CMMC assessment.

“The gap between where an owner might think they are and the reality of their situation is often significant,” Eaton added. “No one is hitting the panic button just yet, but that might only be because they don’t fully realize the scope of what CMMC requires and then the timing of when you have to have it all completed.”

World-Class Production, Blind Spots in Digital Scope

For four consecutive years, manufacturing has been the most targeted industry for cyberattacks. According to IBM’s 2025 Threat Intelligence Index, attackers continue to focus on manufacturers because of the financial leverage, intellectual property, and operational disruption they can extract. In many cases, that exposure is tied to legacy systems and environments that were never designed with modern cyberattacks in mind.

This reality is one of the primary reasons the DoD moved forward with implementing CMMC, which officially rolled out in November 2025, compelling companies to meet contract requirements that have existed since at least December 2017. Sensitive defense information has been leaking through supply chains for years, often not through prime contractors, but through smaller suppliers with fewer resources, limited cybersecurity staff, and incomplete visibility into how data moves through their organizations.

Cybersecurity Maturity Model Certification is intended to close that gap. However, for many small and mid-sized manufacturers, the gap between intention and readiness is often far larger than they realize.

“Manufacturers are exceptionally good at solving tangible problems,” explained Eaton. “If something breaks on the shop floor, it gets fixed. If a process slows production, it gets reworked. Cybersecurity, on the other hand, is invisible. I once had an owner tell me, ‘My nephew dabbles in computers, so I let him handle all the IT stuff.’”

The Self-Assessment Hangover

For years, manufacturers were allowed to self-assess their cybersecurity posture under NIST 800-171. Many did exactly that, believing they were making reasonable efforts, without fully understanding the scope and documentation requirements, or how compliance would ultimately be validated and enforced by third party certification assessments.

That misunderstanding is now colliding with enforcement.

SSE, Inc., a Registered Provider Organization (RPO) that works with manufacturers preparing for CMMC, has conducted more than 60 gap assessments across small and mid-sized defense suppliers. On average, companies entered those assessments believing they were far closer to compliance than they actually were.

“The difference between an organization’s self-assessed score and its evidence-based post-assessment score averaged negative 133 points,” said Bob Duffy, chief operating officer at SSE.

The discrepancy is rarely tied to a single technical failure. More often, it stems from incomplete documentation, misunderstood control boundaries, or incorrect assumptions about what systems, processes, and data flows fall in or out of scope.

“Most manufacturers are doing a lot of the right things,” said Duffy. “The problem is they don’t realize how much is involved once you look at data flow, documentation and evidence, and how everything connects.”

In practical terms, that realization often comes during a gap assessment, when an organization sees for the first time how many controls require formal policies, repeatable processes, and documented proof. What once felt like a manageable compliance task quickly becomes a cross-functional effort touching IT, operations, HR, leadership, and the shop floor.

When Readiness Becomes a Business Problem

For small manufacturing subcontractors whose defense work represents a significant portion of revenue, losing eligibility for new awards can force difficult decisions. Primes feel the impact as well. When suppliers fall out of compliance, prime contractors face critical schedule risk, sourcing delays, and the cost of qualifying new vendors. Supply chains become less stable precisely when resilience matters most.

One of the most persistent misconceptions among small manufacturers is that CMMC readiness can be handled internally, incrementally, and in their spare time.

In practice, demonstrating readiness as required can take six months or more, depending on how far along a manufacturer truly is. The work is not just technical. It involves defining system boundaries, mapping how data moves through the organization, creating policies that reflect reality, implementing controls consistently, and gathering evidence that proves those controls are working over time.

For many manufacturers, especially those starting well below required thresholds, the lift is substantial.

“This isn’t something you muscle through after hours,” Eaton explained. “Most owners are already spread thin. They don’t have the time or the internal resources to interpret what’s required, let alone to make sure it all gets completed and documented properly.”

This is where many manufacturers stall out. They know they need to act, but they are unsure where to start, what matters most, or how to avoid wasting time and money on the wrong fixes.

“My advice is always the same,” Eaton added. “Don’t try to go it alone. What we do at MAM is connect our members with an RPO.”

The Role of a Guide and the Timing Risk

Registered Provider Organizations were fostered by the DoD to help companies prepare for CMMC. These organizations are accredited by the Cyber AB and conduct gap assessments, identify deficiencies, assist with remediation planning, and help manufacturers build the policies, install tools, and collect evidence required for an assessment.

“They meet manufacturers where they are and map a path to the finish line,” said Eaton. “That clarity is what our members need. They don’t need more noise. They need someone who understands manufacturing and understands CMMC.”

As program requirements begin, flow down for new contracts and modifications over the next three years, demand for readiness and assessment services is increasing. When they hit the prime contractors, they cannot award contracts to subcontractors that have not already fully met the assessment requirements. Capacity to perform this work, however, is limited. Qualified expertise is finite, and assessment timelines are already beginning to compress.

Manufacturers that delay action risk finding themselves competing for limited resources just as compliance becomes a condition for new awards. For suppliers whose defense work represents the majority of their revenue, that timing risk is significant.

A Familiar Pattern and a Narrow Window

Manufacturers have faced moments like this before. New standards emerge. Expectations shift. The early adopters gain ground while others wait, assuming they have more time.

Once the problem becomes clear and tangible, manufacturers respond. The question now is whether clarity arrives early enough to act deliberately or only after contracts, schedules, and opportunities are already at risk, or have, for some, been lost.

Cybersecurity Maturity Model Certification is no longer a future consideration. It is a present reality, and readiness is quickly becoming a stark differentiator across the defense supply chain.

Greg Rankin is a Houston-based freelance writer with more than 20 years of experience writing about cybersecurity, technology, and the defense industrial base.

 

 

Defense Cybersecurity Market Projected to Reach $34.53 Billion by 2031

The increasing need to protect military IT networks, mission systems, command and control (C2) platforms, and defense data from cyber threats is driving growth in the defense cybersecurity market, according to a report by the management consulting firm MarketsandMarkets™.

In a release highlighting its analysis, the firm projected the market to grow from USD 20.34 billion in 2026 to USD 34.53 billion by 2031, a compound annual growth rate (CAGR) of 11.2 percent.

“More defense programs now depend on cloud, connected sensors, software-defined systems, and digital supply chains, which increases exposure to attacks,” the release stated. “Governments are also investing in zero trust, encryption, threat monitoring, and cyber validation to secure both existing and new defense platforms. Demand is further supported by a rising focus on protecting defense contractors and critical national security infrastructure.”

Modern defense operations rely on shared data across command systems, sensors, weapons, cloud platforms, and data centers. This creates demand for access control, encryption, monitoring, endpoint protection, and cyber testing to reduce disruption during missions and support secure information sharing, according to the release.

“Defense suppliers and military users face frequent cyber pressure from state-linked groups and ransomware actors. Governments are tightening supplier security, zero-trust plans, and cloud controls, which support demand for managed services, security operations, IAM, and sensitive data protection programs,” the release stated.

By end user, the homeland security segment is projected to register the highest CAGR during the forecast period. It is expected to grow at the fastest rate because border and coast protection units and special operations units need more defense cybersecurity solutions and services for a multitude of requirements. These include network security, endpoint security, cloud security, data security, and identity access management. They also include security operations, zero trust, cryptography, and cyber testing to protect mission systems, surveillance platforms, and critical public safety networks.

By platform, the defense industrial base and data centers segment is also projected to account for “a prominent market share throughout the forecast period,” according to the release. That’s because defense suppliers and data centers store, process, and share sensitive program, mission, and operational data.

“These environments need network security, IAM (identity and access management), encryption, backup, cloud security, monitoring, managed services, and cyber testing to reduce the risk of data loss, system disruption, and unauthorized access,” the release stated.

The report also projects Europe to be the fastest-growing market for defense cybersecurity industry during the forecast period. Defense agencies are increasing cyber spending after continued cyber and hybrid threats.

“NATO treats cyberspace as an operational domain, and the EU cyber defense policy calls for more cooperation and investment in cyber defense. This supports demand for secure networks, cloud security, IAM, encryption, monitoring, managed services, and defense supplier security,” according to the release.

Major players in defense cybersecurity are reported to include Booz Allen Hamilton Inc. (U.S.), General Dynamics Corporation (U.S.), Leidos (U.S.), BAE Systems (UK), and CACI International Inc. (U.S.) All of these companies are reported to have strong distribution networks across North America, Europe, Asia Pacific, and the rest of the world (RoW).