There’s a reason CMMC 2.0 is suddenly everywhere.
It’s not just because deadlines are real now. It’s that the old compliance model—check the box, buy the tool, move on—is dead.
Here’s the hard truth: You can invest in security and still fail.
Eighty nine percent of defense contractors have already suffered losses from a cyber incident. Most had security tools in place when it happened.1
So what’s missing? Not technology. Everything around it.
The Stack Was There. The Program Wasn’t
A mid-size defense manufacturer we worked with had already been through two data breaches in three years. After the second, they did what most companies do: upgraded the firewall, deployed endpoint protection, added email filtering.
It added up to more risk, disruption, and losses the manufacturing sector can’t afford, with global average cost of a data breach in 2025 hovering around $5 million.2
By any reasonable standard, they had a security stack. What they didn't have was a program.
No documented policies, no incident response plan, no formal access controls, no clear record of who could access what, and when. So when it came time for a CMMC assessment, they hit a wall. There was nothing for the assessor to evaluate. Because a security program is more than a list of tools. It's the structure, accountability, and process that make those tools matter. One that can trace where Controlled Unclassified Information (CUI) actually moves across systems, applications, vendors, and users.
The investment is real but invisible in all the wrong ways. The firewall is there. The endpoint agents are running. But there were logs no one reviewed, tools no one owned, controls no one documented. That’s just infrastructure waiting to be questioned.
What Assessors Actually Look For
A C3PAO assessor reviewing CMMC Level 2 is auditing more than your tech stack.
They’re auditing your program for proof that all 110 required controls are deployed—and owned, operated, reviewed, and sustained.
To get there, they focus on two key documents:
- System Security Plan (SSP) describes how each control is implemented.
- Plan of Action and Milestones (POA&M) accounts for every gap, and documents how it's being closed.
Without those, there’s no baseline.
It doesn't matter what's running in your environment. If it isn't documented to an evidentiary standard, it doesn't count. What does count is the policies, procedures, documentation, and the people who own them.
And from what we’ve seen, this is where the wake-up call hits home.
Roughly half of the 110 controls aren't technical. They’re governance. They’re things you can’t buy—and can’t make up as you go. They include:
- Written security policies that reflect how you actually operate.
- Documented procedures people follow (not just file away)
- Employee security training that’s tracked and repeatable
- Access reviews that happen on schedule and are recorded
- Incident response plans that have been tested and updated
- Configuration baselines that are maintained over time
A software license won’t solve these controls. An owner can: and in most mid-market manufacturing environments, that role doesn't exist yet.
The vCISO Difference: Where Compliance Actually Gets Built
The manufacturers that get through CMMC Level 2, and remain compliant time after time, all have one thing in common. A governance layer. That’s what a virtual CISO (vCISO) can deliver for smaller enterprises. Not more tools. Ownership.
A vCISO runs the program that tools alone can’t. They:
- Own the SSP and POA&M
- Maintain the policy framework
- Manage the evidence calendar
- Keep controls active, reviewed, and audit-ready
- Bridge IT, security, and the business
When that manufacturer brought us in to lead their program, we didn’t rip and replace their stack. We built around it, put structure, accountability, and governance in place. And that is key to filling the gap between ready or not.
Wake Up Your CMMC 2.0 Strategy
If you have security tools but no formal program, you’re not ahead of CMMC. You’re not even behind. You’re exactly where most of the Defense Industrial Base (DIB) is right now.
The good news: it’s not as complex as it feels. The gap is real, but it’s also the most straightforward one to close once you have the right support in place.
NexusTek builds the program around your stack—SSP, POA&M, policies, and vCISO governance—to the evidentiary standard C3PAO assessors require.
Reach out to help your team pass the assessment the first time https://www.nexustek.com/cmmc-2-0-compliance-services
Sources:
1. Merrill Research and CyberSheath, New Study Reveals Only 1% of Defense Contractors Fully Ready for Imminent CMMC Deadline, September 2025
2. IBM, Cost of a Data Breach Report, July 2025