Every company selling into the federal government signs a contract containing cybersecurity language that most executives never read closely, and fewer still understand. That gap used to be an administrative nuisance. It is now a legal exposure with an executive’s name attached to it, because the Department of Justice (DOJ) has begun using the False Claims Act to pursue companies, and individuals inside them, for misrepresenting their security posture. Tracy R. Reed, a Lead Cybersecurity Maturity Model Certification (CMMC) Assessor and an International Organization for Standardization (ISO) 42001 Artificial Intelligence Management Systems lead auditor, watches organizations arrive at his door in a familiar state: they know a standard applies to them, they have purchased tools, they have produced documents, and they cannot say with confidence which of their obligations are truly satisfied. The failure is rarely technical. It is a failure to read the contract, locate the data, and draw the boundary.
Start With The Contract, Not The Control List
Reed breaks the work into four steps, and the order matters more than the content. Understand your real contractual obligations. Understand what kind of data you have to secure and where it lives. Understand the scope of the enterprise where the requirements apply. Then build a program that satisfies the requirements and keeps satisfying them. Most organizations skip straight to step four, buying controls before they know what they are protecting or where the perimeter sits. That is how a company ends up applying the National Institute of Standards and Technology (NIST) SP 800-171 to its entire network when only a fraction of it touches controlled unclassified information, or worse, applying it to the wrong fraction.
The first stumble, in Reed’s experience, happens even earlier than that. “Most organizations stumble in actually understanding what the mandate really is,” he says, “both in terms of the contract requirements and in terms of the requirements of the cybersecurity standard the contract calls for, such as NIST SP 800-171.” They typically lack the level of security experience required to properly interpret and implement them. This is an uncomfortable diagnosis for leadership teams who assumed compliance was a procurement problem. It is an interpretation problem, and interpretation cannot be outsourced to a platform. Reed’s own method is to map the environment first, then show the client where the security requirements apply, where they do not, how to meet them most effectively, and critically, how to prove it. Evidence is the deliverable. A control that works but cannot be demonstrated fails an assessment exactly the same way a control that does not work.
The Message The Pause Is Sending
Conventional wisdom holds that CMMC enforcement is tightening. Reed disagrees, and the disagreement is worth sitting with. With the pause of the CMMC 2.0 third-party assessment requirement, everyone can currently self-assess. He reads that as a signal the defense industrial base is receiving loud and clear. “It appears that they are not overly concerned about security and are not interested in enforcing CMMC compliance,” he says of the Department of Defense. The irony is that the third-party requirement existed for documented reasons. Assessors examined a number of suppliers in the defense industrial base and found too many of them were not properly securing controlled unclassified information (CUI). Independent verification was the mechanism that got suppliers moving.
Take the mechanism away, and the motivation goes with it. “The consensus is that they feel they have been let off the hook for an indeterminate and possibly long, given the speed at which government moves, length of time,” Reed says. For contractors, this creates a trap that looks like a reprieve. The underlying obligation has not disappeared. The contract language still binds, the data still has to be protected, and the DOJ is still prosecuting misrepresentation under the False Claims Act, including against individual executives personally. A company that stands down during the pause is not saving money. It is accumulating unremediated risk while losing the external deadline that would have forced the work. When verification returns, and Reed treats the reprieve as hopefully temporary, the firms that kept building will clear the bar. The rest will be starting from where they stood years ago, under time pressure, with a backlog of self-attestations they may have to defend.
Continuous Compliance And The AI Blind Spot
The deeper shift Reed identifies is the move from check-the-box self-attestation toward strict, legally binding third-party verification paired with personal executive liability. Governments are no longer trusting companies to simply promise they are secure. Independent audits are becoming mandatory across both defense and civilian frameworks. Alongside that, compliance is moving from static to continuous. The Federal Information Security Modernization Act and the Federal Risk and Authorization Management Program already emphasize continuous compliance and monitoring, and CMMC is rumored to be heading in the same direction. Two more pressures sit on top: supply chain audits for third-party risk, and readiness for rapid incident reporting. An annual snapshot satisfies none of this. The operating model has to change.
Then there is the gap nobody is paying for yet. Reed holds the ISO 42001 credential and is prepared to audit AI management systems. “So far, business in that area is very light,” he says. CMMC does not speak to AI (yet). The closest thing he sees in the federal space is the NIST AI Risk Management Framework 1.0, introduced back in January 2023. Meanwhile, AI is proliferating through the same organizations that struggle to inventory their CUI. Reed’s prediction is blunt and probably correct: “It is going to take a few AI-related disasters to produce some motivation in that area.” The companies that treat governance as something to build before the enforcement arrives are the ones who will not be rebuilding under subpoena.
Follow Tracy R. Reed on LinkedIn for more insights on CMMC assessment, federal cybersecurity compliance, and AI management systems auditing.