The fault line

Walk the fault line.

Six faults most defense shops are running with right now, scored the way a buyer scores a part. Take them one at a time. Each one names an exposure you already feel and the first move that clears it.

01 / 06NON-COMPLIANT

The unbuilt 800-171 floor

On July 13, 2026 the Department suspended CMMC Phase II, the mandatory third-party certification step originally scheduled for November 10, 2026, and opened a reform review. Phase I did not move: a Level 2 self-assessment every three years against the 110 NIST SP 800-171 Rev 2 requirements, with annual affirmation into SPRS. DFARS 252.204-7012 binds today, and per CyberSheath's 2025 State of the DIB report only 1 percent of contractors feel fully prepared.

The exposure

The certificate paused. The obligation did not. Your prime cannot award you covered work unless your assessment is current, and whatever the review returns, the shop that built the floor is ready and the one counting down to a date is not.

The first move

Map the 110 controls to who owns each one, then close the gaps before the next annual affirmation puts your name on them.

You have walked the line. The next move is naming which fault is costing you the most.

Run the operational diagnostic →Request a strategic conversation

The unbuilt 800-171 floor. NON-COMPLIANT. On July 13, 2026 the Department suspended CMMC Phase II, the mandatory third-party certification step originally scheduled for November 10, 2026, and opened a reform review. Phase I did not move: a Level 2 self-assessment every three years against the 110 NIST SP 800-171 Rev 2 requirements, with annual affirmation into SPRS. DFARS 252.204-7012 binds today, and per CyberSheath's 2025 State of the DIB report only 1 percent of contractors feel fully prepared. The exposure: The certificate paused. The obligation did not. Your prime cannot award you covered work unless your assessment is current, and whatever the review returns, the shop that built the floor is ready and the one counting down to a date is not. The first move: Map the 110 controls to who owns each one, then close the gaps before the next annual affirmation puts your name on them.
Backlog outrunning cash. NON-COMPLIANT. The order book grows while working capital tightens. AlixPartners found the aerospace and defense cash conversion cycle lengthened from 138 to 159 days between 2018 and 2022. The growth story hides a cash crisis. The exposure: You can book a record quarter and still miss payroll. Growth funded on the float breaks the month the float runs out. The first move: Put a weekly cash conversion number on the wall next to the backlog, and run the two as one system.
The Hidden Factory. ACTION NEEDED. Undocumented rework, tribal knowledge, and off-the-books problem solving. Armand Feigenbaum estimated this loss can reach 40 percent of total company effort. Your ERP cannot see any of it. The exposure: Two people leave and the knowledge leaves with them. The floor slows and no report on your desk tells you why. The first move: Make the rework visible first. You cannot cut a loss the system refuses to name.
SPRS score exposure. ACTION NEEDED. A wrong self-assessment score in the Supplier Performance Risk System is a false-affirmation risk. The DOJ Civil Cyber-Fraud Initiative pursues exactly this under the False Claims Act. The exposure: An optimistic SPRS score is a signed federal claim. The government reads the gap as fraud, not paperwork. The first move: Re-score against the evidence you can actually show, then close the delta before it is ever tested.
IT and OT running as separate liabilities. ACTION NEEDED. MES, ERP, and SCADA sit on three networks with three owners. Each is a CMMC liability on its own. Together they are the digital thread an auditor follows, or the one that fails. The exposure: Three owners, three networks, one auditor. The seams between them are exactly where the assessment breaks. The first move: Draw the one data border the controlled work lives inside, and give the whole thread a single owner.
No full-time COO, founder at the limit. NON-COMPLIANT. A full-time COO is a fully-loaded cost of a quarter of a million dollars and up. The founder is signing payroll, sitting the audit, and answering the prime's questionnaire at the same time. The exposure: The founder is the constraint. Every gate waits on one calendar, and that calendar is already full. The first move: Install the operating system a COO would run, at the two or three days a week it actually takes.