5 reasons the commercial and private sector got serious about cybersecurity models: CMMC and CPCSC

Security incidents are on the rise, and, as a result, security frameworks like the Cybersecurity Maturity Model Certification (CMMC) are gaining more general attention.

There are five significant reasons for this focus:

1. Supply chain attacks are now the costliest and slowest to contain
2. Cyber insurers are underwriting around it
3. Legal exposure now reaches beyond direct contractors
4. Other federal agencies are eyeing the same model
5. Early movers gain a competitive and M&A advantage

I’ll discuss each one in detail, but first let’s clarify what the CMMC is.

Defining the CMMC:

The main objective of CMMC is to ensure safeguards around Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) are in place, so in the event of a security incident, impact can be limited.

The CMMC was once viewed as a US Department of Defense initiative, something only prime contractors and their direct subcontractors needed to consider. Under the CMMC, the risk exposure for disclosing critical data is significantly decreased, and when coupled with FedRAMP, it's even harder to get the crown jewels.

Similarly, the Canadian Program for Cyber Security Certification (CPCSC) is Canada's defence supply chain cybersecurity framework, designed to protect sensitive defence information, analogous to the US Department of Defense's CMMC.

Canada is pursuing the same goal through CPCSC, managed jointly by Public Services and Procurement Canada and the Department of National Defense. CPCSC is built on ITSP.10.171, Canada's adaptation of NIST SP 800-171 and protects what Canada designates as Specified Information, its equivalent of Controlled Unclassified Information. Like CMMC, CPCSC rolls out in phases across three certification levels, with Level 1 self-assessment requirements beginning to appear in select defence contracts this summer.

Public Services and Procurement Canada has stated the program is intentionally designed to align closely with CMMC's technical controls and pursue mutual recognition between the two countries, so suppliers working across both nations' defense industrial bases aren't forced to run two separate certification tracks.

However, one gap still exists on the Canadian side: the accredited third-party assessor network needed to validate Level 2 and Level 3 certifications, which is still being built out. CPCSC is currently further along on policy than on assessment infrastructure.

Both certifications have a tiered approach: CMMC has three levels (Foundational, Advanced, Expert), and CPCSC also has levels. Higher tiers impose stricter requirements for organizations handling more sensitive data.

The important news is the perception these certifications are narrowly focused on contractors has shifted significantly.

Why the CMMC is critical for more organizations today

Even after the US Department of Defense / Department of War suspended CMMC Phase 2's mandatory third-party assessment requirement in July 2026 and opened a 60-day Reform Task Force review, interest in CMMC-aligned cybersecurity practices keeps climbing among both commercial and private-sector organizations with no direct DoD contract at all.

Here are five reasons why the CMMC is getting so much attention now:

1. Supply chain attacks are now the costliest and slowest to contain. Verizon's 2025 Data Breach Investigations Report, which analyzed more than 22,000 security incidents and over 12,000 confirmed breaches worldwide, found that third-party involvement in breaches doubled year over year, jumping from 15% to 30%. Exploitation of vulnerabilities as an initial attack vector surged 34% in the same period, and other recent cybersecurity incidents showed how quickly a vendor's weakness becomes a customer's crisis. With nearly a third of breaches now tracing back to a partner or supplier, boards and CFOs increasingly treat third-party risk as a financial issue, not just an IT one. CMMC's control set, built on NIST SP 800-171, gives commercial vendors a ready-made, externally recognized way to prepare and mitigate risks from threat vectors and data exfiltration.

2. Cyber insurers are underwriting around it. Cyber insurance has moved from a discretionary purchase to something regulators, lenders and business partners expect. Underwriting guidance published in 2026 shows insurers increasingly treat alignment with NIST 800-171 and CMMC as a material factor in coverage decisions and pricing, alongside baseline controls like multi-factor authentication and documented incident response. For private companies with no federal contract, CMMC-equivalent maturity is becoming a practical way to keep premiums manageable and avoid coverage exclusions after a claim. FedRAMP rev 5 (NIST 800-53) is more targeted around the security of the govcloud boundary.

3. Legal exposure now reaches beyond direct contractors. The Department of Justice's (DOJ) Civil Cyber-Fraud Initiative has made cybersecurity misrepresentation a False Claims Act issue with real financial teeth. DOJ recovered more than $52 million across nine cybersecurity-related settlements in fiscal year 2025 alone, including an $8.4 million settlement with Raytheon and smaller resolutions reaching into the subcontractor and supplier tiers. A senior DOJ official described the enforcement trend as a significant upward trajectory, noting these cases center on misrepresenting security posture rather than on breaches themselves. Risks flow downstream through the supply chain, giving private companies that sell to contractors (not just the contractors themselves) a reason to get their compliance story straight.

4. Other federal agencies are eyeing the same model. Momentum for the demand to know where a government’s data and information is located, stored and how its protected is the central issue. These verifications aren’t confined to the DoD. Trade press coverage has pointed to the Department of Homeland Security, the Department of Justice, and parts of the intelligence community as candidates for similar third-party verification requirements on contracts involving Controlled Unclassified Information. For vendors serving multiple federal customers (or hoping to) building toward a CMMC-equivalent baseline now hedges against a wider swath of government business requiring it later. Even beyond US Federal, CMMC is getting traction with allies, which are implementing CMMC or CMMC-like frameworks (e.g. CPCSC), both modeled on the same NIST-based controls.

5. Early movers gain a competitive and M&A advantage. Even with Phase 2 paused, Phase 1 self-assessment obligations and DFARS 252.204-7012 safeguarding requirements remain fully in force, and prime contractors keep flowing cybersecurity expectations down to private-sector suppliers by contract. Legal advisories following the July 2026 suspension have cautioned that a memo pausing federal enforcement doesn't erase a prime's contractual requirements or liability tied to prior compliance gaps. Companies that already have mature, well-documented security practices are better positioned to win business and clear supplier or M&A due diligence, regardless of where the Reform Task Force ultimately lands.

Is the CMMC relevant for your organization?

CMMC began as a defense-contracting mandate, but the underlying pressures (breach costs, insurance economics, legal liability and expanding government scrutiny) apply well beyond the defense industrial base. Even amid genuine uncertainty about the program's exact future shape, the commercial case for CMMC-aligned security maturity is standing on its own.

With cyberattacks on the rise, an important part of a cybersecurity posture is preparation and risk management for the inevitable attacks. Data governance and data safeguards, like the ones which can be implemented through our data and AI governance platforms, can assist with effectively safeguarding data and organizational risk exposure.

Collibra Platform for Government is FedRAMP rev 5 (NIST 800-53) compliant and centered on security, so it improves an organization's control of their data boundary.

If you want to learn more about security frameworks and zero trust from a US Federal perspective, check out “How Zero Trust Can Ready Your Data for AI.”

_________________________________________________________________________

Sources:

Verizon — 2025 Data Breach Investigations Report (official release) https://www.verizon.com/about/news/2025-data-breach-investigations-report

Mayer Brown — "False Claims Act Enforcement: Record-Breaking Year Signals Continued Attention to Cybersecurity" (2026) https://www.mayerbrown.com/en/insights/publications/2026/03/false-claims-act-enforcement-record-breaking-year-signals-continued-attention-to-cybersecurity

National Law Review — "DOJ Announces Record-Breaking False Claims Act Recoveries in FY 2025" (2026) https://natlawreview.com/article/doj-announces-record-breaking-false-claims-act-recoveries-fy-2025-what-stats

Akin Gump — "Top DOJ False Claims Act Official Confirms 'Significant Upward Trajectory' in Cybersecurity Enforcement" (2026) https://www.akingump.com/en/insights/alerts/top-doj-false-claims-act-official-confirms-significant-upward-trajectory-in-cybersecurity-enforcement

WilmerHale — "Pentagon Suspends CMMC Phase 2 Requirements and Launches Review of Cybersecurity Certification Program" (2026) https://www.wilmerhale.com/en/insights/client-alerts/20260720-pentagon-suspends-cmmc-phase-2-requirements-and-launches-review-of-cybersecurity-certification-program

Federal News Network — "Pentagon suspends CMMC phase two requirements, launches review of program" (2026) https://federalnewsnetwork.com/cybersecurity/2026/07/pentagon-suspends-cmmc-phase-two-requirements-launches-review-of-program/

HSToday — "Achieving CMMC Compliance: A Practical Guide for Defense Contractors and Government Vendors" (2025) https://www.hstoday.us/subject-matter-areas/cybersecurity/achieving-cmmc-compliance-a-practical-guide-for-defense-contractors-and-government-vendors/

• 

  Denise Vu Broady

  Denise Vu Broady

  Executive VP, Partners & Alliances and Global Public Sector

  Collibra