By Payam Pourkhomami, President & CEO of OSIbeyond
The DFARS acquisition rule took effect in November 2025, and DOW contracting officers are now inserting certification requirements into new solicitations. As such, the clock is running for defense industrial base companies handling federal contract information, or FCI, or controlled unclassified information, or CUI, since no certification means no contract awards.
While most contractors today already understand that CMMC compliance is now a condition of doing business with the DOW, many are still figuring out how to actually achieve and maintain it without spending $50,000 to $100,000+ upfront, coordinating three to six vendors and then watching their controls degrade six months after go-live. A different delivery model is emerging to address this challenge.
The CMMC Compliance Problem Facing DOW Contractors
The DFARS final rule identifies approximately 337,968 unique entities (primes and subcontractors) that fall under CMMC requirements. About 229,818 of them, roughly 68%, are small businesses. At Level 2, that means meeting all 110 security requirements from NIST SP 800-171 Rev. 2 and, for roughly 80,000 contractors, passing a third-party assessment conducted by a CMMC third-party assessment organization, or C3PAO.
According to DOW’s own Regulatory Impact Analysis (PDF), a Level 2 C3PAO certification cycle costs a small entity approximately $104,670 over three years. But that number only covers the assessment itself. It assumes the contractor has already been compliant with NIST SP 800-171 since 2017, when DFARS 252.204-7012 first required it. It does not include remediation, tooling, environment migration, or internal labor.
Another part of the CMMC compliance problem facing DOW contractors is that most end up coordinating multiple vendors across IT, security and compliance, often three to six separate providers operating independently with no single point of accountability.
- One vendor manages the cloud environment.
- Another handles endpoint security.
- A third writes the policies.
- A fourth prepares the documentation for assessment.
Each has its own scope of work, its own timeline and its own definition of “done.” The contractor’s internal team becomes the de facto project manager, responsible for making sure all of it aligns with the 110 requirements in NIST SP 800-171. For small and mid-sized firms without dedicated compliance staff, that coordination burden alone can stall an implementation for months.
Then there is what happens after the assessment.
As I discussed in a previous article on what defense contractors must do now that CMMC Phase 1 is here, the 32 CFR final rule requires an affirming official from each organization to attest that the company has implemented and will maintain implementation of the applicable security requirements. That affirmation is required at the time of assessment and annually thereafter. If an organization fails to complete its annual affirmation, its CMMC status can lapse. Level 2 and Level 3 assessments are required every three years, and Level 1 self-assessments are annual, according to the DOW CIO FAQ (PDF).
Organizations are required to monitor security controls on an ongoing basis, develop and periodically update system security plans and have an up-to-date SSP at the time of assessment. Supporting evidence for controls marked as MET must be in final form. Drafts and unapproved policies are not acceptable.
Passing an assessment is temporary. Maintaining compliance is where most organizations fail. The result is a compliance posture that erodes steadily between assessments, which is exactly the kind of gap that the DOW designed CMMC to eliminate, not due to lack of intent, but due to the absence of an operational model aligned with continuous compliance requirements.
Compliance as a Service as an Alternative to the Traditional Consulting Model
A good registered practitioner organization or compliance advisor can help a contractor understand its gaps, map its environment to NIST SP 800-171 and prepare for assessment. Many contractors will need that expertise, and the Cyber AB marketplace lists qualified providers for exactly this purpose.
The problem is that a traditional consulting engagement follows a predictable arc:
- The contractor hires a consultant to conduct a gap assessment and provide guidance.
- Separate vendors are brought in to implement tools and build out the environment, GCC or GCC High, endpoint security, SIEM and so on.
- Documentation is created to satisfy the assessment.
- The contractor passes (or gets close), and the engagement ends.
- From that point on, the contractor owns everything (ongoing monitoring, control enforcement, documentation updates, annual affirmations and preparation for the next triennial assessment).
The consultant’s scope was to get the organization ready, not to keep it compliant, which is a problem because CMMC is a continuous operating requirement, and misrepresenting compliance status carries real consequences, as the Department of Justice’s $4.6 million False Claims Act settlement with MORSECORP in March 2025 made clear.
This is where a structural limitation of the traditional consulting model becomes apparent. The delivery model should match the compliance model. If the requirement is continuous, the service should be too, and that is the logic behind Compliance as a Service, or CaaS.
Rather than treating CMMC as a consulting project that ends at assessment, CaaS treats it as an ongoing managed service. The concept is not new nor unique to CMMC. It has existed in healthcare (HIPAA), financial services and payments (PCI DSS) for years. What is new is its application to the defense industrial base, where the combination of NIST SP 800-171’s 110 requirements, the annual affirmation cycle, and the FedRAMP-equivalent environment mandate creates a compliance workload that fits the managed service model well. This shift reflects a broader move toward operationalizing compliance rather than treating it as a one-time certification effort.
As a CMMC Level 2 certified managed service provider and Registered Practitioner Organization, OSIbeyond has developed a CaaS offering that bundles the environment, security operations, compliance implementation and ongoing management into a single integrated service with one provider, one platform and one point of accountability.
What a CaaS Model Looks Like in Practice
A CaaS model typically follows four phases that map directly to what the CMMC framework actually requires:
- Phase 1 (environment validation): A CaaS provider begins by assessing the contractor’s current infrastructure, identifies where CUI and FCI are processed, stored, or transmitted, and determines the contract requirements that define the target CMMC level (the CMMC Scoping Guide (PDF) gives organizations a choice in how they define their assessment boundary). Getting the scope right at this stage determines the complexity and cost of everything that follows.
- Phase 2 (secure infrastructure deployment): The provider builds and manages the compliant environment, whether that is a GCC High tenant, a GCC environment, or a segmented enclave, depending on the contractor’s needs. Under the CaaS model, the environment decision is itself a specialized undertaking included in the service and not a separate vendor engagement.
- Phase 3 (controls and documentation): This phase involves the implementation of the 110 security requirements from NIST SP 800-171 Rev. 2. Implementation alone is not sufficient; supporting evidence must also be developed for each control in final form at the time of assessment, including policies, procedures, the system security plan and plans of action and milestones.
- Phase 4 (continuous compliance): Ongoing monitoring, control validation and documentation updates are performed so that the contractor’s compliance posture does not degrade between assessments. When the annual affirmation comes due, the evidence is already current. When a triennial reassessment approaches, the organization is not scrambling to reconstruct a compliance posture that lapsed 18 months earlier.
The financial structure typically reinforces the continuous nature of the model, replacing large upfront implementation costs with predictable recurring fees based on environment and user count.
Who CaaS Is Built For
CMMC requirements are determined by the type of information a contractor handles, not by company size. Any organization that processes, stores, or transmits FCI or CUI as part of a DOW contract may be required to comply. That said, the compliance burden does not fall equally on every contractor, and CaaS is not designed for every situation.
The model fits best for small and mid-sized defense contractors that lack the internal staff to build and sustain a CMMC program on their own:
- Firms with up to 100 employees that may have a capable IT person or a small team but do not have a dedicated CISO, a GRC analyst, or a compliance program manager. The ISC2 2025 Workforce Study found that 95% of organizations report cybersecurity skills gaps, with 59% describing those gaps as critical or significant. For a 30-person machine shop or a 60-person engineering firm holding a DOW subcontract, hiring a full-time CISO at $200,000+ and a GRC analyst at close to $100,000 is not a realistic path to compliance. A managed service that bundles those functions into a monthly fee is.
- Contractors that have already tried the traditional approach and found it unsustainable. Maybe they spent six figures getting to assessment-ready, passed, and then watched their controls drift because no one was responsible for maintaining them after the consultant left. Or maybe they are still mid-implementation, stuck coordinating between an IT provider, a security vendor, and a compliance consultant who are not aligned on scope or timeline. A CaaS approach can replace that fragmented model with a single provider that owns the entire stack.
- For organizations that are still at the beginning of their compliance journey, a CaaS model can compress the timeline because the infrastructure, tooling and compliance processes are already built. That timeline advantage matters given what is coming next. Phase 2 begins November 10, 2026, when Level 2 C3PAO certification becomes mandatory for applicable new contracts, and Phase 3 follows in November 2027, extending that requirement to option exercises on existing contracts.
The model is less suited for large primes with mature internal security operations, organizations that only handle FCI and need Level 1 self-assessment, or contractors whose existing environment and compliance posture are already close to assessment-ready and just need targeted consulting support to close specific gaps. For those organizations, the traditional consulting model may be a better fit.
It is important to point out that CaaS does not shift the contractor’s legal responsibility. The 32 CFR final rule places the affirmation obligation on the organization’s own affirming official, and no outsourced service changes that.
In practice, the provider manages the environment, implements controls, maintains documentation and monitors compliance posture. But the contractor retains ultimate responsibility for meeting its contractual requirements.
What This Means for the DIB
Compliance as a Service does not solve every problem in the CMMC ecosystem. It does not fix the C3PAO capacity bottleneck, and it does not reduce the number of controls a contractor needs to meet.
However, it does change the way contractors get to compliance and stay there. The cost becomes predictable. The implementation is integrated under a single provider instead of split across three to six vendors. And the ongoing maintenance of controls, documentation and audit readiness becomes someone’s actual job rather than an afterthought that falls through the cracks between assessment cycles.
With Phase 2 enforcement less than seven months away, the window for contractors who have not yet started is closing fast.
As CMMC enforcement timelines approach, contractors will need to evaluate not just what they implement, but how they sustain it.
The delivery model itself may ultimately determine whether compliance is achieved once or sustained as an operational capability over time.
Discover a simpler, predictable path to CMMC Level 2 with $0 upfront costs, download more information on CaaS.
