Supply chain risk is one of the least understood and most urgent challenges in Cybersecurity Maturity Model Certification (CMMC) compliance today.
Dig deeper below to learn more.
Supply chain is the part of CMMC that is not getting the attention it deserves.
Firms closer to the Washington D.C. beltway are generally moving. Those farther out, and those outside the cleared facility space, often have little idea what is expected of them.
The data backs this up. According to Redspin's 2025 DIB readiness report, nearly half of subcontractors surveyed had already received a CMMC flow-down request from a prime, meaning enforcement pressure is arriving well ahead of the formal rollout schedule.
ISI Chief Executive Officer David Lawrence has seen the same pattern firsthand, noting that "even the ones that are saying they're moving towards Level 2 probably aren't. One company didn't even know what DFARS was. Others said they had an SPRS score but didn't know how to submit it."
The problem compounds as you move deeper into a supply chain. By tier three, four, and five, awareness drops sharply. For many of these firms, DoD work is a small fraction of revenue, making CMMC feel low priority until a contract is suddenly at risk.
Two trends are emerging in recent solicitations:
As cyber-attacks become more sophisticated and historic defense spending on the horizon, government agencies are requiring primes to implement more holistic and rigorous supply chain risk management strategies.
Lawrence is clear that "contracts that are up for recompete are going to require CMMC," and that primes need to be ensured their supply chain is getting to Level 2.
The firms that move early will have a real edge. Lawrence puts it plainly, saying "the firms that get their supply chain ahead of this are going to have a massive competitive advantage when bidding on new contracts."
Subcontractors face the same urgency with fewer resources. Start by:
On choosing an MSP, Lawrence advises asking whether they have taken anyone through a Level 2 assessment and whether they are Level 2 themselves, adding that "if the answer to either of those is no, they're probably not the right fit."
For smaller firms, a CUI enclave approach, where a limited group of personnel operate in a compliant environment using FedRAMP-authorized tools, can reduce scope and cost significantly. Some firms start with three to five people in an enclave, win work, and expand from there.
If CUI flows down to them, Level 2 requirements flow down as well. Primes are responsible for ensuring their supply chains are CMMC compliant before awarding them subcontracts.
Map which suppliers receive or handle CUI. Then assess whether they have a current SPRS score, any CMMC certification, and a credible path toward Level 2. Most contractors have never done this systematically.
Start identifying backup suppliers now. For irreplaceable vendors, direct support and introductions to compliance resources may be the only path to keeping that relationship.
In some cases, yes. If a small subcontractor uses a prime-provided device or enclave to handle CUI, they may not need independent certification. This requires careful scoping and agreement with the prime.