The updated Cybersecurity Maturity Model Certification (CMMC) represents a critical evolution in the Department of War (DoW) strategy to secure the Defense Industrial Base (DIB). It is more than a regulatory hurdle. It is a direct response to a rapidly changing and increasingly hostile threat landscape faced by the DIB.
Updated CMMC guidance issued in 2025 simplifies the prior framework, focusing on the most essential security practices aligned with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. Its fundamental purpose remains unchanged: to protect sensitive, unclassified defense information — specifically Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) — from foreign adversaries.
Horizon3
The updated CMMC phases. Image from https://dodcio.defense.gov/cmmc/About/
CMMC implementation phases
The CMMC requirements are being implemented in phases to ease the burden on both organizations and auditors.
- Phase 1 (Nov 10, 2025 – Nov 9, 2026): Focus on self-assessments for Levels 1 and 2
- Beginning Nov 10, 2026: Solicitations will require Level 2 certifications
For thousands of companies across the DIB— from prime contractors to small, specialized machine shops — compliance is not optional. It is the prerequisite for doing business with the DoW. It establishes a standardized, measured approach to cybersecurity across the supply chain.
A shift in adversary strategy
The strategic focus of adversaries has shifted. Rather than launching costly, direct attacks against well-defended prime contractors, they increasingly target the weakest link in the supply chain.
Suppliers and subcontractors often:
- Possess valuable intellectual property, schematics, and operational details
- Operate without the same security resources as larger defense firms
These operational activities create a pathway into the broader ecosystem. A breach at any tier can reverberate across the supply chain, exposing sensitive information and impacting mission outcomes.
The limitations of point-in-time security
The traditional model of cybersecurity compliance has relied on periodic, point-in-time assessments. This approach is fundamentally limited in the context of a dynamic and interconnected supply chain.
Security is not static. A posture that was compliant weeks ago can become vulnerable due to:
- New exploits or zero-day vulnerabilities
- System configuration changes
- Introduction of new technologies or shadow IT
The core issue is straightforward: You are only as secure as your last evaluation. In an environment that is constantly evolving, this model leaves a persistent gap between compliance and actual risk.
Enabling continuous validation
Horizon3.ai’s NodeZero Federal™ enables a more continuous approach to security validation. Unlike traditional penetration testing or vulnerability scanning, NodeZero identifies and validates exploitable weaknesses and demonstrates how they can be chained together.
This provides organizations with the ability to:
- Validate controls regularly: Demonstrate effectiveness on an ongoing basis, not just during audits
- Close the compliance gap: Move beyond documentation to show how controls mitigate real-world risk
- Identify attack paths: Understand how an adversary could move through the environment
This approach supports a more realistic understanding of security posture and risk.
Expanding the scope: From enterprise to ecosystem
Elevating supply chain security for FCI and CUI represents a broader shift in how the DoW approaches risk. The focus is no longer limited to securing individual networks. It extends across the entire DIB ecosystem.
The objective is not only compliance, but:
- Measurable risk reduction
- Greater resilience across interconnected environments
- Assurance of mission continuity
Implications for prime contractors
CMMC reinforces a long-standing reality: The security posture of a prime contractor is directly influenced by the posture of its suppliers.
This introduces cascading risks across the supply chain, particularly where subcontractors process, store, or transmit CUI.
Key implications include:
- Jeopardized prime contractor posture: A security incident at a supplier can impact the prime’s certification.
- Contract ineligibility and business impact: Non-compliance may lead to disqualification from DoW contracts.
- Mission assurance risk: Compromised CUI can affect operational integrity and outcomes
Common sources of compromise
Compromise often originates in predictable areas of the supply chain.
Third-party providers. Managed service providers (MSPs) and vendors supporting multiple organizations can introduce systemic risk. A single compromise can expose multiple environments.
Specialized suppliers. Small and medium-sized organizations may handle sensitive data but lack enterprise-grade security controls.
Interconnected access points. Common weaknesses include:
- Shared credentials
- Weak or misconfigured VPN access
- Federated identity systems without proper segmentation
Example: Assume-breach scenario
In a recent assume-breach test, NodeZero began with access to a single host without credentials. From that starting point, it enumerated domain users and executed a password spray, successfully obtaining a valid domain credential.
That account had local administrator privileges, enabling further actions:
- Deployment of a remote access tool (RAT)
- LSASS access and credential harvesting
This scenario highlights a common issue: controls that are assumed to be in place may not perform as expected in practice.
Why the legacy model does not scale
The legacy model of periodic assessments does not account for the dynamic nature of modern environments.
Risk is introduced through:
- Supply chain changes and new vendors
- Ongoing system reconfigurations
- Expansion of SaaS, APIs, and cloud services
- Gradual degradation of controls over time
As a result, a point-in-time certification can quickly become outdated.
Continuous readiness under CMMC
The updated CMMC guidance emphasizes continuous readiness rather than periodic validation. Self-assessments are expected to be supported by documented, day-to-day evidence of control effectiveness.
This reflects the need to maintain security posture over time, not just demonstrate it at a single point.
Continuous validation as a practical requirement
Moving to continuous validation helps organizations keep pace with:
- Changing threat activity
- Evolving supplier ecosystems
- The need to maintain confidence in control effectiveness
Without this, organizations rely on outdated assumptions about their environment and exposure.
Closing the gap between compliance and security
HORIZON3.ai’s NodeZero® Proactive Security Platform helps bridge the gap between compliance and operational security. By validating controls through real-world attack scenarios, it provides evidence of effectiveness and identifies gaps across both internal environments and critical suppliers.
This enables organizations to treat CMMC not just as a compliance requirement, but as part of an ongoing risk management program.
Final thought
True security posture is not defined by a completed assessment.
It is defined by how systems perform under real conditions, and how quickly organizations can identify and address weaknesses as they emerge.
Learn more about how Horizon3.ai strengthens supply chain security for CMMC.
Please refer to the full white paper.
