For years, the DoD has lost sensitive Controlled Unclassified Information (CUI) through breaches in the Defense Industrial Base (DIB). Adversaries targeted smaller, less secure subcontractors to steal valuable intellectual property tied to weapons and technology. The Cybersecurity Maturity Model Certification (CMMC) was created to stop these leaks by enforcing a unified cybersecurity standard across the entire defense supply chain.
Enforcement for CMMC 2.0 is slated to begin on November 10, 2025, changing the conversation from “what if” to “what now.” It should also serve as a reminder of the uncomfortable truth that adversaries don’t work to our calendars. Software supply chains are being tested every day, and the DIB remains a sprawling, uneven landscape of practices, tooling, and readiness levels.
Awareness of CMMC is at an all-time high, but true operational readiness remains low. Many contractors have adopted a “wait and see” approach. According to CyberSheath’s State of the DIB report, only about one percent of contractors are audit-ready, and a large portion still lacks basic controls, such as vulnerability management, patch management, and multifactor authentication. Other alarming statistics in the report show that most organizations lack basic cyber hygiene measures, vulnerability management (79%), patch management (78%), and MFA (73%), revealing a wide gap between awareness and action.
Awareness is not the problem. Operationalization is.
The author, Antoine Harden, is Regional Vice President, Federal Sales at Sonatype.