The seller's management team said the company was CMMC compliant. Their MSP ran the program. There was a self-assessment on file.
None of that was wrong, exactly. It just wasn't the whole story.
In a recent buy-side engagement on a mid-market manufacturer in the defense supply chain, diligence found that the company had self-attested to CMMC Level 1. That covers basic Federal Contract Information. But the company was also receiving Controlled Unclassified Information (CUI) from defense contractors further up the chain. Handling CUI requires CMMC Level 2: the 110 security requirements in NIST SP 800-171. This company's contracts also called for an assessment by a certified third-party assessor (C3PAO).
Level 2 work had never started. The MSP had treated the Level 1 self-attestation as the finish line.
The company needed a full Level 2 program built from scratch, followed by a third-party assessment. That path was expensive, nobody had budgeted for it, and it materially changed the buyer's pricing of the deal.
That pattern is more common than most deal teams expect. And a recent change to the CMMC program makes it easier to miss, not harder.
Why the Phase 2 suspension doesn't let anyone off the hook
CMMC requirements began appearing in DoD contracts on November 10, 2025. Phase 2, which would have made third-party (C3PAO) Level 2 certification a requirement for contracts involving CUI starting November 10, 2026, never arrived. On July 13, 2026, the Department of War suspended Phase 2 and later milestones and launched a CMMC Reform Task Force to review the program (WilmerHale). The task force's recommendations were due in September; as of this writing they haven't been made public (Covington).
It's tempting to read that as a reprieve. It isn't. What remains in force:
- The underlying obligation. DFARS 252.204-7012 has required contractors handling CUI to implement NIST SP 800-171 for years. The suspension didn't touch it.
- Self-assessments, SPRS scores, and annual affirmations. Phase 1 requirements "remain firmly in place," and the Department says it will enforce NIST SP 800-171 through self-assessments and select government-led assessments.
- The legal exposure. Every self-reported score and signed affirmation is still a representation to the government.
What the suspension removed is the independent check. For now, a target's CMMC posture rests mostly on its own word. That makes the buyer's diligence the only real verification in the deal.
The program's final shape is still undecided, and third-party certification may come back in some form during a typical hold period. A target that has done the underlying work is ready either way. A target that hasn't is carrying a liability that the current pause hides.
Level 1 vs. Level 2: the gap sellers miss
The distinction is about the data, not the company.
| Level 1 | Level 2 | |
|---|---|---|
| Data it covers | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 basic safeguarding requirements | 110 requirements of NIST SP 800-171 |
| Assessment | Annual self-assessment | Self-assessment today; third-party (C3PAO) certification suspended pending DoD review |
| Plan of action allowed? | No | Yes, limited, with 180 days to close out |
A company can honestly hold a Level 1 self-assessment and still be badly out of compliance, because the CUI it receives was never in scope. The certification it has isn't the certification it needs.
Five places sellers get CMMC wrong
1. "Our MSP handles compliance." An MSP can implement controls. It is a poor judge of whether its own work meets the standard, and it has a commercial interest in saying yes. Treat MSP assurances as a starting point for verification, not evidence. (This is the same problem as an MSP grading its own work anywhere else.)
2. CUI scope drawn too narrow. CUI arrives through drawings, specifications, and technical data from primes, and it doesn't stay where it lands. It ends up in email, shared drives, engineering workstations, and the ERP. If the seller's scope covers one enclave but the data lives everywhere, the scope is wrong.
3. A self-assessment score nobody can defend. Contractors handling CUI report a NIST SP 800-171 score to the DoD's Supplier Performance Risk System (SPRS). In one 2025 settlement, a defense contractor had reported a positive SPRS score when its actual score was negative 142 (Holland & Knight). Ask for the score, then test it.
4. Flow-down clauses nobody read. Subcontractors inherit CMMC obligations through flow-down clauses in their prime contracts. The seller may not know which level their customers will require at renewal. The contracts will tell you.
5. An affirmation signed without verification. Every CMMC level requires an annual affirmation of continuing compliance from a senior company official. That signature is where the legal exposure starts.
The liability travels with the company
The DOJ's Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that misrepresent cybersecurity compliance. Under the FCA, "knowingly" includes reckless disregard, so signing an affirmation without checking can be enough. Damages are trebled, and whistleblowers who bring cases receive a share of the recovery.
Two 2025 settlements matter most to buyers (Holland & Knight):
- Raytheon and Nightwing, $8.4 million: the acquirer was named as successor in liability for cybersecurity failures at the acquired business that predated the deal.
- A California defense contractor and its private equity owner, $1.75 million: the PE sponsor was a party to the settlement.
A CMMC gap isn't only a remediation bill. It can be inherited exposure for past certifications the buyer never made.
What it costs to fix
The larger cost is remediation, and it applies whether or not third-party certification returns: closing gaps across 110 requirements, often including network segmentation, a compliant cloud or email environment, documentation, and the staff time to run it. For a company starting from zero, as the manufacturer above was, that is a significant program, not a project.
Certification adds to it. When the DoD finalized the CMMC rule, its own estimate for a small business going through a Level 2 C3PAO certification was roughly $105,000 per three-year cycle, before any remediation (PreVeil, citing the DoD rule). Whether and when that cost applies now depends on how the DoD review resolves and on what the target's customers require. Model it as a scenario, not a certainty.
What to verify in diligence
Request these documents directly from the target:
- Current SPRS score and the date it was submitted
- All CMMC self-assessments and affirmations, with the name of the affirming official
- The System Security Plan (SSP) and any Plan of Action and Milestones (POA&M)
- A list of contracts and subcontracts containing DFARS 252.204-7012, -7019, -7020, -7021, or -7025
- A data flow map showing where CUI enters, is stored, and leaves the environment
- MSP and cloud provider contracts, including any shared-responsibility matrix
- Cyber incident history, including incidents reported (or not) to the DoD
Then test them:
- Does the CUI scope match where CUI actually lives?
- Can the reported SPRS score be reproduced from the controls actually in place?
- What do the target's top customers require of subcontractors today, and what are they signaling for renewals?
- Has the affirming official seen evidence, or signed on the MSP's word?
A pre-LOI quick look can answer the first two questions in days. The rest belong in full buy-side technology due diligence.
What it changes in the deal
When diligence finds a CMMC gap, the buyer has several levers:
- Price: reprice for remediation, a possible third-party assessment, and revenue at risk if the target can't meet customer requirements.
- Specific indemnity or escrow: R&W insurance typically excludes issues the buyer already knows about, so a known CMMC gap usually needs its own protection.
- Representations: specific reps on SPRS scores, affirmations, and CUI handling.
- Pre-close covenants: require the seller to begin remediation or engage a C3PAO before close.
- 100-day plan: if the deal proceeds, CMMC remediation goes at the top of the post-close plan, with a named owner and milestones tied to the customer contract calendar.
The lesson
"Compliant" is a claim, not a finding. For PE-backed manufacturers in the defense supply chain, diligence has to test what data the company actually handles against the certification it actually holds, and price the difference.
Vertex CIO Advisory provides buy-side technology due diligence for PE sponsors evaluating defense-supply and industrial targets. See a sample diligence deliverable.
This article is general information, not legal advice. Consult counsel on False Claims Act and contract-specific questions.
