Topic starter
10/07/2026 9:09 pm
TL;DR: Stacy Bostjanick argued that CMMC was designed to correct weak self-attestation, raise the cost of stealing defense information, and push contractors toward real cybersecurity maturity, according to Secureframe. The practical message is that certification is a baseline control, while supply chain resilience depends on scoping data, limiting exposure, and closing gaps faster than adversaries can exploit them.
Editorial analysis by NHI Mgmt Group, based on content published by Secureframe: “Former DoD Director of CMMC Stacy Bostjanick: "CMMC is just the bare minimum"”.
By the numbers:
- Over 1,000 organizations have already been certified at CMMC Level 2.
- Roughly 50% of CMMC Level 2 certified organizations are SMBs.
Key questions
Q: What is the main control failure when defence contractors rely on self-attestation?
A: The main failure is assuming policy statements are enough without independent proof that access, scope, and implementation are actually working.
Q: Why does weak supplier access governance increase defence supply chain risk?
A: Weak supplier access governance expands the number of accounts, systems, and people that can expose sensitive material.
Q: How should teams decide whether CMMC is enough for their programme?
A: Teams should treat CMMC as the minimum bar for eligibility and then evaluate whether their risk profile requires stronger controls, tighter data scoping, or more aggressive privileged access governance.
Practitioner guidance
- Tighten defence data scoping Map which suppliers truly need controlled information and remove broad sharing that is not required for contract delivery.
- Separate certification from maturity planning Use CMMC readiness as a baseline programme milestone, then track the additional controls needed for higher-risk environments and future customer requirements.
- Strengthen supplier access reviews Review third-party accounts, entitlements, and offboarding with the same discipline used for internal privileged access, especially where controlled information is exposed.
Bottom line: CMMC is positioned in the article as a baseline control, not a complete defence against supply chain compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
Certification is not a security outcome, it is a governance checkpoint. CMMC matters because it turns a paper standard into an assessed control environment, but the article is explicit that assessment alone does not equal resilience. Organisations that stop at passing an audit keep the same exposure paths that made the programme necessary. For defence contractors, the practitioner conclusion is to treat certification as evidence of minimum control maturity, not proof of supply chain safety.
A question worth separating out:
Q: What happens when sensitive defence data is shared more broadly than needed?
A: When data is over-shared, the attack surface widens and the consequences of one compromised supplier or account spread further than intended. That can turn a local security failure into a supply chain event. Organisations should minimise distribution, review third-party entitlements, and assume that unnecessary access will eventually be exploited.
👉 Read our full editorial: CMMC is only the floor for defense supply chain security