The Pentagon suspended CMMC Phase 2 in July, but prime contractors may not be as trusting of self-reported compliance scores as the government is. Earlier this year, L3Harris gave its suppliers roughly 80 business days to produce CMMC Level 2 certification or risk losing their place on programs. For subcontractors watching Washington for signals on when to act, the answer is already in their inboxes — their primes are setting the deadlines because supplier flow-down has consequences at the top.
At CMMC CON 2026, a panel session called “How Primes Are Prioritizing CMMC Readiness (and What They Expect from Subcontractors)” will bring that dynamic into focus. Doug Cherry, Brig. Gen., USA, Retired, CEO of Monterey Technologies, Inc., and Megan Downie, SVP of Technology and Corporate Operations at Spirit Electronics, join moderator Michael Bailie, VP of Solutions Engineering at CyberSheath, on Sept. 23 at 11 a.m. ET.
The session covers what cybersecurity requirements have become increasing non-negotiable for primes evaluating their supply chains, the most common compliance gaps among small and mid-sized suppliers, how primes actually verify that subcontractors meet NIST SP 800-171 requirements, and what distinguishes a preferred subcontractor from one that becomes a supply chain risk.
Cherry and Downie will also address what small businesses with limited cybersecurity budgets should prioritize first and how the prime-subcontractor relationship on compliance has changed over the past two years.
Register now for CMMC CON 2026, a free two-day virtual conference running Sept. 23-24, to hear directly from the prime contractor side of the compliance equation.