Understanding Recent CMMC Changes and What Manufacturers Should Do Next
If you’ve been following CMMC lately and wondering, “Wait... what’s happening now?” you’re certainly not alone.
Recent developments around the Cybersecurity Maturity Model Certification (CMMC) program have created plenty of questions for manufacturers in the Defense Industrial Base. Does a pause mean CMMC is going away? Should manufacturers keep investing in compliance? What requirements are still in effect? And what should businesses actually be doing right now?
Synagex recently joined our friends at MassMEP for the webinar “Understanding Recent CMMC Changes” to help manufacturers sort through the uncertainty. Synagex Founder and CEO John Sinopoli and Cathy Olieslaeger, VP of Information Security, joined MassMEP and MA APEX to discuss what has changed, what hasn’t, and why cybersecurity should remain a priority regardless of where CMMC goes next.
The short version? Don’t stop what you’re doing.
First, CMMC Isn’t Dead
Much of the recent confusion centers around the government reevaluating portions of the CMMC rollout. As Cathy explained during the webinar, the program is being reviewed, including questions around the cost and burden associated with certification assessments. But that doesn’t eliminate the underlying cybersecurity requirements manufacturers already face.
As John pointed out, CMMC has evolved several times since 2019. What hasn’t changed is the reason behind it: protecting sensitive government information and strengthening the Defense Industrial Base against cyber threats.
“If you want to do business with the government, you have to protect governmental data.”
The Cybersecurity Requirements Haven’t Disappeared
This is probably the most important distinction to understand: CMMC is an enforcement and certification mechanism. It isn't the origin of the cybersecurity requirements themselves.
During the webinar, Cathy explained that existing FAR and DFARS requirements continue to govern the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). For organizations handling CUI, NIST SP 800-171 remains central to meeting those obligations. Existing requirements around areas such as incident reporting also remain relevant.
MA APEX’s Jeff Brandt offered a useful way of thinking about it: CMMC is the certification process used to demonstrate that your cybersecurity meets the necessary standard, while the underlying contractual clauses and requirements exist independently of that certification process.
So, a change to CMMC does not mean cybersecurity requirements simply disappear.
Self-Assessments Still Matter
Another important takeaway from the webinar was accountability. Manufacturers still need to accurately understand and represent their cybersecurity posture. Cathy cautioned against claiming compliance without being able to demonstrate it, noting that organizations can still face assessments and potential consequences when their actual cybersecurity practices don't match what they've represented.
John shared that Synagex has seen real-world examples of organizations receiving relatively short notice of an assessment and then having to prove what was actually in place.
“It is a very real risk.”
The lesson? Don't treat self-assessment as a paperwork exercise. Understand where you really stand, document it accurately, and have a plan for addressing your gaps.
This Is Bigger Than Compliance
One of the biggest themes of the webinar—and something we talk about frequently at Synagex—is that CMMC shouldn’t distract us from what all these requirements are ultimately trying to accomplish: Better cybersecurity.
The panel discussed real risks facing manufacturers, including ransomware, malicious insiders, compromised email accounts, intellectual property theft, and other cyber incidents. For a smaller organization, the financial and operational impact of even one serious event can be enormous.
As John explained:
“Everyone’s a target and it really only takes... an email compromise or a piece of ransomware to just start a very bad situation.”
He also noted that Synagex has seen businesses lose millions of dollars because of security gaps, while cyber threats continue to become more sophisticated and potentially more destructive.
That’s why we encourage manufacturers to look beyond “What do I need to do for CMMC?” and ask a bigger question: “What do I need to do to protect my business?”
Protect the Business, Not Just the CUI
CUI may be the focus of many DoD cybersecurity requirements, but Cathy encouraged manufacturers to think more broadly about security. NIST-based cybersecurity practices can help organizations protect their people, systems, physical environment, business operations, and sensitive information—not just a particular CUI workflow. And one area she emphasized was incident response: businesses should assume that eventually something will happen and have a plan for responding when it does.
As Cathy explained, the goal is to make sure “people, process, and systems” are secured across the organization—Sound familiar? At Synagex, we talk about People. Process. Tools. all the time for exactly this reason. Cybersecurity isn’t one product you install or one compliance box you check. It’s a program.
Not Sure What Counts as CUI? Ask.
The webinar also tackled a question we hear frequently: What actually counts as CUI?
The answer isn't always as black and white as businesses would like. The panel discussed thinking about CUI through the lens of risk and understanding exactly what information is flowing through your organization. Technical drawings, specifications, and certain sensitive information may be very different from routine contract documents such as invoices or purchase orders.
The important part is not to guess. Understand what you're receiving, where it goes, who has access to it, and what happens to it throughout your workflow. If you're unsure about information connected to a contract, ask the appropriate contracting contact for clarification.
Cathy also recommended actually mapping the CUI workflow: How do you receive it? Do you print it? Does it need to move onto a USB drive or manufacturing equipment? Can it remain within a secure virtual environment? Understanding that flow can help determine how the information needs to be protected.
So, What Should Manufacturers Do Right Now?
This was ultimately the biggest question of the webinar.
And MassMEP summed it up nicely at the end:
“Whatever you were doing before, just keep doing... Don’t stop what you’ve been doing.”
Cyber threats aren't going away. Customers can still have cybersecurity expectations for their suppliers. And strong cybersecurity can make your business more resilient regardless of what happens next with CMMC.
Comments