For six years, the Department of War has worked to raise the cybersecurity bar across the DIB. Finally, on November 10, 2025, that mission moved from planning to enforcement as the DoW began including CMMC requirements in all new solicitations and contract renewals. For every manufacturer and supplier handling Controlled Unclassified Information (CUI), cybersecurity readiness now determines contract eligibility. It's time to ask, 'Would you trust our National security to a self-assessment or a certified third-party audit?'
For years, self-attestation was enough. Those days have gone away. Level 2 assessments requires third-party validation, ensuring every contractor is held to the same high standard of readiness.
The DoW is expecting demonstrable compliance with NIST 800-171 Rev 2.
That means showing verifiable evidence:
CMMC enforcement is national defense.
Contract risk is real:
After Nov. 10, 2025 the DoD will start to include and enforce CMMC requirements in all new Solicitations, RFPs, RFQs, and Contract Renewals. Every manufacturer, supplier, and contractor handling Controlled Unclassified Information (CUI) is affected AND the liability is shifting from prime contractors to subcontractors (proof is replacing self-assessment). Cybersecurity readiness now defines contract eligibility.
It is estimated that there are more than 80,000 organizations in the current DIB who will need a CMMC Level 2 certification to meet requirements, but less than 500 have successfully completed Certification at this time. And shockingly, throughout the DIB, C3PAO’s are finding that only 1% of defense contractors are fully prepared for their CMMC audit.
Accepting a contract with a CMMC certification clause creates a clear legal obligation, and non-compliance carries serious consequences beyond simply losing the contract. Failing to comply (or falsely claiming compliance) can result in breach of contract, DOJ scrutiny, suspension or debarment, reputational damage, and whistleblower actions. Even more significantly, false certification of compliance can trigger penalties under the False Claims Act (FCA), including fines exceeding $10,000 per violation and up to three times the government’s damages.
CMMC is not just a compliance exercise, it’s a commitment to protect the U.S. warfighter, the mission, and the supply chain that powers them both.
At Offset Strategic Services, LLC (OSS), we don’t just meet cybersecurity standards, we set them. As one of the first 50 organizations in the Defense Industrial Base to achieve Final CMMC Level 2 (C3PAO) certification through NSF (2023), OSS stands as a trusted partner in national defense.
OSS is well on the way to meeting the next security stage, Level 2 Rev 3, and preparing to meet LEVEL 3 controls. We have already subscribed to the NSA CCC, established an Insider Threat Program, and are finalizing a Supply Chain Risk Management framework. Our investment also extends to our industry partners as well. We helped launch of the DoD Cyber Crime Center Commercial Sensor and participate in critical pilot programs like the MDA Cyber Assistance Team and the DoD-Defense Industrial Base (DIB) Collaborative Information Sharing Environment (DCISE). Viewing firsthand how impactful their support can be. We’ve also worked alongside MDA DIBCAC and NSA, giving us unique insight into what “right looks like” when it comes to secure, defense-ready environments.
Our additional certifications reflect more than compliance, they represent a mission-driven commitment to protecting America’s defense supply chain. OSS is a SDVOSB with AS9100D and ISO 9001:2015 quality certifications, NIST 800-171 compliance assessed by DCMA, a secure GCC High environment, and your trusted partner in national security.
Supporting and supplemental information on evolving Department of War cybersecurity requirements can be found in the following documents:
Many in the Defense Industrial Base (DIB) are feeling the pressure of rising cybersecurity requirements and compliance costs but there are practical steps you can take today to make meaningful progress.
Industry partner reminders:
These resources provide detailed insight into the latest CMMC program policies, implementation expectations, and overarching cybersecurity directives shaping the Defense Industrial Base.
At the OSS, our purpose is to make a difference. We want to make a difference in our employees' lives, their communities, this great Nation, and most importantly, the men and women who protect it.