Don't Scrap CMMC. Fix How It Is Enforced.

Since 2017, defense contractors handling covered information under applicable contracts have been required to protect sensitive defense information such as blueprints, technical data, and logistics details our adversaries actively steal. For years, enforcement relied largely on the honor system: companies graded their own security and reported the score. It did not work.

The Pentagon’s answer was to require nearly every contractor to pass a professional third-party assessment. That was a sound instinct, but that model imposed costs and capacity demands that only large companies could bear. Pentagon estimates have suggested that tens of thousands of companies could ultimately require third-part assessments. SBA's Office of Advocacy has also questioned whether the authorized assessment ecosystem can meet that demand without creating significant cost and capacity constraints. Layer on assessment and compliance costs that routinely run into six figures, many times what the security itself should cost, and you don’t have a security program. You have a traffic jam with a luxury toll. The Small Business Administration (SBA) said as much, and it was right.

1. Require consent up front. When a company reports its security score to the government, it would also consent to a potential audit on 30 days’ notice. This would not create a separate mandate, but rather, would become a condition of doing business with the Department of War (DoW), the same way self-certifying your size is a condition of competing for a set-aside.
2. Test an affordable assessment rate. Companies selected for verification could pay for their own assessments, while participating assessment firms accept a standardized program rate. A pilot could test a target price of approximately $15,000 for a narrowly scoped remote assessment, with defined line items for travel, additional complexity and locations, and other changes in scope.
3. Assign the assessor. A neutral accreditation body (one already exists) would assign each audit based on assessor availability and enforce a 30-day clock. Companies would not be allowed to select a preferred assessor, and assessments would no longer be delayed by scheduling limbo.
4. Tie consequences to verified findings. Limited gaps could place a company on a corrective action plan. More significant gaps could restrict eligibility for new awards until the issues are fixed. The most serious failures could trigger a work stoppage, subject to standardized review and appeal procedures
5. Use contract administration first. A failed audit should generally begin as a contract administrative and remediation matter, not a penalty proceeding under long-standing rules. Correct the deficiencies, pass a re-assessment, and the company becomes eligible for the work again.
6. Treat false statements differently from ordinary gaps. A control gap can often be remediated. A knowing misrepresentation is different. A company whose claimed score wildly exceeds its audited score gets referred to the appropriate fraud review, the enforcement track the Justice Department is already using.
7. Subsidize only those who truly need help. At an affordable assessment price, many firms can pay their own way. For the smallest suppliers, the Pentagon could cover an initial audit through existing small-business and industrial-base programs, including efforts such as the Army’s NCODE contract vehicle, on which ATX Defense is an awardee.