The main failure is assuming policy statements are enough without independent proof that access, scope, and implementation are actually working. In defence supply chains, that creates a gap between what a contractor says it protects and what it truly protects. CMMC was designed to close that gap by making assessment, not self-declaration, the basis for trust.
Why self-attestation fails as a control model
Self-attestation breaks down when trust is placed in policy language instead of evidence. In defence contracting, the issue is not whether a contractor can write compliant statements, but whether the required access restrictions, scope boundaries, and technical safeguards are actually operating. That is a verification failure, not a paperwork failure.
Once trust is reduced to declarations, the buyer loses the ability to distinguish mature controls from aspirational ones. Independent assessment exists to close that gap by checking implementation, not just intent.
What the control failure looks like in a defence supply chain
The failure usually appears in three places: scope, enforcement, and accountability. A contractor may claim the right systems are covered, but leave enclaves, subcontractor paths, remote admin channels, or shared services outside the real control boundary. That means the stated security posture can look stronger than the enforced one.
This is especially dangerous in supply chains where multiple parties depend on the same environments and access paths. A self-declared control set can miss weak segmentation, excessive standing access, or incomplete logging, all of which matter more than the policy document itself. NIST Zero Trust Architecture frames the right posture as never trust, verify, because trust without verification is easy to overstate.
Why assessment-based trust matters more than certification language
The core problem is that attestation answers “what do you say is true?” while assessment answers “what can be proven true?” In high-consequence environments, that distinction determines whether a buyer is accepting real risk or merely documented reassurance.
Assessment-based models force contractors to demonstrate that controls are implemented, operating, and scoped correctly. That is why the strongest trust signal is evidence of testing, review, and repeatable validation rather than a signed statement. CMMC moves in that direction by tying trust to assessment outcomes instead of relying on self-declaration alone. For defence supply chain controls, the broader access and third-party governance problem is also well covered in Third-Party, B2B and Contractor Access Guide, which focuses on sponsorship, least privilege, and time-bounded external access.
Where the issue is access control verification, independent countermeasure mapping can also help teams translate claims into testable defensive requirements. MITRE D3FEND is useful here because it anchors control discussion in specific defensive mechanisms rather than in broad assurances.
Risk and Threat Considerations
Self-attestation creates false confidence, and false confidence is the real risk. In a defence context, the buyer may assume sensitive data, systems, or operational workflows are protected when the actual control boundary is incomplete or weakly enforced.
Failure mechanism: The contractor states compliance, but no independent evidence confirms that access, segmentation, and monitoring are implemented as claimed. That allows scope gaps, over-permissioned access, or untested controls to persist inside the trusted boundary.
Impact: Sensitive defence information, controlled environments, and supplier-connected paths can remain exposed while appearing governed, which increases the chance of undetected compromise, audit failure, or downstream supply-chain contamination.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CA-2 — Control Assessments | Assessment, not self-declaration, is central to the trust gap in contractor claims. |
| CA-7 — Continuous Monitoring | Ongoing evidence is needed to confirm controls still operate after initial attestation. | |
| AC-6 — Least Privilege | Excess access is a common gap when contractors self-attest to access controls. | |
| Recommendation — Require independent control assessments before accepting contractor security claims. Monitor control operation continuously instead of relying on one-time declarations. Enforce least privilege and validate that actual permissions match stated need. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | The subject is fundamentally about verify-first trust in access and control boundaries. |
| Recommendation — Design trust decisions so access is verified by evidence, not assumed from status. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Contractor access is a key place where self-attestation can hide overbroad or unmanaged access. |
| Recommendation — Review and remove contractor access that is not justified by verified business need. | ||
Practitioner Guidance
What to verify: Treat every attestation as a hypothesis until you can see evidence of implementation. The highest-value checks are scope boundaries, access paths, control operation, and whether the contractor can show recent validation rather than historical intent.
Decision rule: If a control is only documented, treat it as unproven. If a control is independently assessed and the evidence matches the claimed scope, it can support trust; if the scope is unclear, assume the gap is part of the risk until resolved.
Practitioner takeaway: In defence supply chains, the control failure is not merely weak security, it is unverified security, and unverified security should never be allowed to stand in for trust.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org