The fault line

Walk the six operating faults on a defense manufacturer's floor.

Six faults most defense shops run with today, scored the way a buyer scores a part. Each names the exposure you already feel and the first move that clears it.

01 / 06NON-COMPLIANT

The unbuilt 800-171 floor

On July 13, 2026 the Department suspended CMMC Phase II, the mandatory third-party certification originally scheduled for November 10, 2026, and opened a reform review. Phase I did not move: a Level 2 self-assessment every three years against the 110 NIST SP 800-171 Rev 2 requirements, with annual affirmation into SPRS. DFARS 252.204-7012 binds today, and per CyberSheath's 2025 State of the DIB report only 1 percent of contractors feel fully prepared.

The exposure

The certificate paused. The obligation did not. Your prime cannot award you covered work without a current assessment.

The first move

Give each of the 110 controls an owner, then close the gaps before the next annual affirmation puts your name on them.

You have walked the line. The next move is naming the fault costing you the most.

Run the operational diagnostic →Request a strategic conversation
  • The unbuilt 800-171 floor. NON-COMPLIANT. On July 13, 2026 the Department suspended CMMC Phase II, the mandatory third-party certification originally scheduled for November 10, 2026, and opened a reform review. Phase I did not move: a Level 2 self-assessment every three years against the 110 NIST SP 800-171 Rev 2 requirements, with annual affirmation into SPRS. DFARS 252.204-7012 binds today, and per CyberSheath's 2025 State of the DIB report only 1 percent of contractors feel fully prepared. The exposure: The certificate paused. The obligation did not. Your prime cannot award you covered work without a current assessment. The first move: Give each of the 110 controls an owner, then close the gaps before the next annual affirmation puts your name on them.
  • Backlog outrunning cash. NON-COMPLIANT. The order book grows while working capital tightens. AlixPartners found the aerospace and defense cash conversion cycle lengthened from 138 to 159 days between 2018 and 2022. The exposure: You can book a record quarter and still miss payroll. Growth funded on the float breaks the month the float runs out. The first move: Put a weekly cash conversion number on the wall next to the backlog, and run the two as one system.
  • The Hidden Factory. ACTION NEEDED. Undocumented rework, tribal knowledge, and off-the-books problem solving. Armand Feigenbaum estimated this loss can reach 40 percent of total company effort. Your ERP sees none of it. The exposure: Two people leave and the knowledge leaves with them. The floor slows and no report tells you why. The first move: Make the rework visible first. You cannot cut a loss the system refuses to name.
  • SPRS score exposure. ACTION NEEDED. A wrong self-assessment score in the Supplier Performance Risk System is a false-affirmation risk. The DOJ Civil Cyber-Fraud Initiative pursues it under the False Claims Act. The exposure: An optimistic SPRS score is a signed federal claim. The government reads the gap as fraud, not paperwork. The first move: Re-score against the evidence you can show, then close the delta before it is tested.
  • IT and OT running as separate liabilities. ACTION NEEDED. MES, ERP, and SCADA sit on three networks with three owners, each a CMMC liability. Together they are the digital thread an auditor follows, or the one that fails. The exposure: Three owners, three networks, one auditor. The seams are where the assessment breaks. The first move: Draw one data border around the controlled work, and give the whole thread a single owner.
  • No full-time COO, founder at the limit. NON-COMPLIANT. A full-time COO is a quarter-million-dollar fully-loaded cost, and up. The founder is signing payroll, sitting the audit, and answering the prime's questionnaire, all at once. The exposure: The founder is the constraint. Every gate waits on one calendar, and it is already full. The first move: Install the operating system a COO would run, at the two or three days a week it takes.