StealthTech
A System Security Plan can be complete, a SPRS score can be submitted, and a contractor can still be one phishing email away from a reportable incident. That gap — between documentation that satisfies an assessor and an environment that actually resists an intrusion — is where most CMMC programs quietly fail. It’s not a knowledge problem. Most primes and subs know the 110 controls in NIST SP 800-171 exist. The failure is treating certification as a destination instead of an operating discipline that has to survive contact with daily business.
This matters more in 2026 than it did two years ago, because the DoD CMMC Program has moved from proposal to enforcement, and contracting officers are starting to write CMMC level requirements directly into solicitations rather than treating them as future obligations. Contractors who spent the last three years assuming they had time are now finding out they don’t.
The SPRS Score Was Never the Point
A Supplier Performance Risk System score is a self-attestation of where you stand against the 110 controls, and for a lot of contractors it became the entire compliance strategy — get the number high enough, file it, move on. The problem is that a SPRS score measures documentation posture at a point in time. It says nothing about whether your endpoint detection actually catches lateral movement, whether your backup jobs are tested restores or silent failures, or whether the subcontractor holding your CUI has any of this figured out at all.
Contractors who build their program around managed IT services that actually monitor the environment — not just patch it — tend to close that gap faster, because the SPRS number becomes a byproduct of operational security rather than the goal itself. We wrote about this dynamic in more depth in our piece on measuring security maturity without leaning entirely on compliance frameworks, which is worth reading if your team is still equating “compliant” with “secure.”
Where CUI Actually Lives in Your Environment
Ask five people at a mid-size contractor where Controlled Unclassified Information lives and you’ll usually get five different answers, and none of them will be complete. CUI shows up in drawing packages sitting in a shared drive nobody scoped, in email attachments sent to a subcontractor because the secure portal was slower, in a project manager’s laptop that syncs to a personal cloud account by default, and in printed documents left on a desk in an office nobody remembers to badge-restrict.
Scoping the CUI boundary correctly is the single highest-leverage exercise in a CMMC program, because every control after that inherits from it. Get the boundary wrong — too narrow — and you leave data exposed outside your protections. Get it too broad, and you spend budget locking down systems that never needed Level 2 controls in the first place. We’ve seen this exact failure play out with something as mundane as file transfer habits; our breakdown of secure file sharing practices for hybrid teams covers the specific patterns that quietly push CUI outside the boundary without anyone noticing.
The DFARS Clause That Makes This Non-Negotiable
None of this is optional once DFARS 252.204-7012 is flowed into your contract, which it is for nearly every defense contract touching covered defense information. The clause requires adequate security under NIST SP 800-171, mandatory reporting of cyber incidents within 72 hours of discovery, and — critically — flow-down of the same obligations to every subcontractor handling that information. A prime that assumes its own compliance covers the supply chain is misreading the clause.
The 72-hour reporting window is where a lot of otherwise-compliant contractors get caught flat-footed, because detecting an incident within that window requires monitoring infrastructure most small and mid-size contractors don’t build until forced to. This is one of the clearer arguments for co-managed IT arrangements over a purely internal setup — an internal team stretched across help desk tickets and infrastructure projects rarely has the bandwidth to also run continuous detection. Our comparison of co-managed versus fully outsourced IT models walks through how contractors typically split that responsibility.
Building Controls That Survive an Assessor’s Questions
Documentation that reads well and controls that hold up under questioning are not the same thing. A C3PAO assessor doesn’t just check whether a policy document exists — they ask how it’s enforced, who owns it, and what evidence proves it’s operating day to day. The controls that tend to survive that scrutiny share a few characteristics:
- They’re technically enforced, not just written down — access restrictions implemented in the identity platform, not a policy PDF nobody reads.
- They generate their own evidence — logging and alerting that produce an audit trail automatically, rather than requiring someone to reconstruct history after the fact.
- They’re owned by a named role, not “IT” as an abstraction, so an assessor gets a specific, confident answer instead of a shrug.
- They’ve been tested against a real scenario — a tabletop incident response exercise, a simulated phishing campaign, a restore-from-backup drill — not just described in a plan.
That last point deserves emphasis, because backup and recovery is one of the most frequently checked-but-not-tested controls we encounter. A backup and data recovery strategy that’s never had a full restore attempted is a documentation control, not a working one, and assessors are increasingly asking contractors to prove the difference.
The Vendor and Subcontractor Problem Nobody Budgets For
Every prime’s compliance posture is only as strong as its weakest subcontractor, and most primes have no real visibility into that weakness until a flow-down audit or an incident forces the question. This is compounded by the software supply chain itself — the project management tools, CAD platforms, and collaboration apps that departments adopt independently, often without anyone checking whether the vendor’s own security posture is adequate for handling CUI-adjacent workflows.
We ran into a version of this problem with a client mid-assessment, detailed in our piece on evaluating software before buying it rather than after it’s already embedded in workflows. The fix isn’t more paperwork from vendors — most of that paperwork goes unread anyway — it’s a standing intake process that treats new software the way you’d treat a new subcontractor: a real risk conversation before adoption, not an audit finding after.
Continuous Monitoring Is the Actual Job
A POA&M — a Plan of Action and Milestones — exists to document how you’ll close a gap, and for a while that’s treated as sufficient. But CMMC’s direction is unmistakably toward continuous demonstration of security posture rather than a periodic snapshot, and contractors still operating on an annual-review mentality are going to find themselves perpetually behind.
The threat landscape driving this shift isn’t abstract. CISA has been explicit about the sustained interest nation-state actors have in the defense industrial base specifically, not just prime contractors with obvious visibility, but the smaller subcontractors that are often easier entry points into the supply chain. That reality is exactly why continuous monitoring, not periodic review, has to be the baseline. A vCIO function — someone whose job is tracking your security roadmap against both the threat landscape and the compliance calendar — tends to be the difference between a program that drifts and one that stays current. We’ve also written specifically about the accumulated risk of deferring security work, in our piece on cybersecurity technical debt, which is essentially what a stale POA&M becomes if it sits unaddressed.
Metrics That Mean Something to Leadership
Compliance programs stall when leadership can’t see progress in terms that matter to them, and “we closed 12 of 47 POA&M items” doesn’t translate into a boardroom decision. The contractors who sustain compliance investment over multiple years are the ones who’ve translated technical progress into metrics leadership actually tracks — time to detect, time to contain, percentage of the CUI boundary under continuous monitoring, and the trend line on that SPRS score rather than its current value alone.
Our guide on cybersecurity metrics CEOs should track instead of just counting blocked threats goes deeper into which numbers actually predict resilience versus which ones just look reassuring in a slide deck.
Choosing a Partner Who Understands Defense Compliance, Not Just IT
A generalist MSP can keep a network running. Very few can walk into a CMMC Level 2 assessment and speak the assessor’s language, because the skill set required — DFARS flow-down obligations, CUI marking requirements under the National Archives CUI registry, enclave architecture, POA&M management on a real timeline — is a specialization, not a general IT competency.
Two things worth checking before you commit to a partner:
- Whether they’ve actually taken a contractor through a C3PAO assessment, not just implemented the technical controls in isolation.
- Whether they understand your specific compliance posture beyond the technology — the vCIO relationship, cybersecurity operations, and compliance documentation have to move together, not as three disconnected vendor relationships.
An AI integration initiative or a cloud transformation project undertaken without CMMC scoping in mind is one of the fastest ways to accidentally expand your CUI boundary — a generalist MSP focused purely on the technology upgrade may never flag that risk, because it isn’t the question they’re trained to ask.
What Boston, Tampa, and Sarasota Contractors Are Actually Facing
Regional supply chains matter here more than most contractors expect. Boston’s defense and advanced manufacturing base sits inside a dense cluster of primes, research institutions, and specialized subcontractors, which means flow-down obligations arrive faster and from more directions than in less concentrated markets — a dynamic we’ve covered specifically for Boston-area businesses evaluating a managed IT provider. Contractors working that market benefit from a partner who already understands the Boston defense ecosystem rather than one learning it on the client’s clock.
Florida’s Tampa and Sarasota markets present a different pattern — a fast-growing base of smaller manufacturers and engineering firms newly winning defense subcontracts, many of them encountering CMMC requirements for the first time. Our guide on choosing an IT provider that actually understands Florida’s contractor landscape addresses the specific gap we see most often there: budgeting for compliance as a one-time project rather than an ongoing operating cost, which is exactly the mindset that produces stale POA&Ms two years later.
What This Costs, Realistically
Contractors consistently underestimate the ongoing cost of CMMC compliance because they price the initial assessment and controls implementation, then stop budgeting once certification is achieved. Continuous monitoring, periodic re-assessment, staff training, and incident response readiness are recurring line items, not one-time projects, and treating them otherwise is how programs quietly decay between assessment cycles. Our realistic breakdown of what managed IT actually costs for a small business in 2026 includes the compliance-specific cost drivers that a generic IT budget conversation tends to miss entirely.
Conclusion
CMMC compliance built as a checklist exercise will pass an assessment and still fail the contractor the first time it’s tested by a real incident. The programs that hold up are the ones where the SPRS score, the SSP, and the POA&M are outputs of genuine operating discipline — properly scoped CUI boundaries, technically enforced controls, subcontractor accountability, and continuous monitoring — rather than the discipline itself. Read more on how these pieces fit together in our Insights library, or learn more about our team’s work with defense contractors across the Boston, Tampa, and Sarasota markets.
If your organization is planning its CMMC compliance journey, contact Stealth Technology Group today at (617) 903-5559 or visit the website to learn how modern cybersecurity infrastructure can accelerate your path toward certification readiness.
