How CMMC Is Reshaping the Relationship Between Cybersecurity and Business Growth

Cybersecurity requirements are increasingly shaping eligibility for government contracts, with technical expertise alone no longer enough to compete. Although the Pentagon suspended the next phase of CMMC implementation in July 2026, existing rules remain in effect, leaving contractors pursuing higher-level certification with substantial technical and organizational compliance challenges.

Thanh Thai, Chief Information Security Officer and Vice President at Constellis, has extensive experience aligning cybersecurity programs with business requirements. He helped rebuild the company's security operations following a major cyber incident and led efforts to achieve CMMC Level 2 certification, strengthening technical controls while improving how security teams work with the broader organization.

"I don't think the question is, 'Should I go from Level 1 to Level 2?' It's, 'Do you want to do business with the government or not?'" Thai says. For contractors seeking opportunities that require Level 2, certification becomes part of their ability to compete. Meeting those requirements involves decisions about security investments, operational processes, and the evidence needed to demonstrate that controls work.

CMMC raises the stakes for government contractors

Contractors with Level 1 status remain ineligible for opportunities requiring Level 2, regardless of their ability to deliver the project. Thai sees similar requirements appearing beyond the Department of Defense, extending the commercial implications of compliance across government contracting. "If we want more contracts, we need to meet the government's requirements or our customers' requirements," he says, pointing to frameworks such as CMMC, NIST 800-53, and Cyber Essentials Plus. "Those are hard requirements to win contracts."

For contractors seeking certification, there’s a financial burden involved which depends partly on how they define the assessment scope. "Cost is interesting because if you don't scope it properly, it can cost you. Scope is very important," Thai explains. Defining which systems and processes fall within that scope helps organizations identify the controls they need to implement and the resources required to demonstrate compliance.

Security compliance requires operational evidence

Documented security policies establish expectations, but CMMC compliance also requires organizations to implement controls that enforce those policies and demonstrate their effectiveness. Technical safeguards can prevent unauthorized actions, while assessment evidence helps establish that security practices operate consistently across systems and teams. "We focused on controls so that you couldn't do something if it was against policy," Thai says. His team approached implementation by consistently asking, "How do I prove this?" That emphasis on evidence guided efforts to strengthen existing security systems and verify that controls worked as intended.

Meeting technical requirements can involve substantial changes to existing infrastructure. For example, configuring firewalls to operate in FIPS mode may affect established security rules and authentication processes. Thai encountered these complications firsthand. "The hardest part for us was putting all our firewalls into FIPS mode. I think it took us three solid weeks, and that was all we did. It broke a lot of existing rules and user authentication," he says. Implementing 802.1X introduced additional challenges, even with a security operations center and SIEM already in place.

Assessments also examine how employees apply security controls in practice. Beyond reviewing documentation and technical evidence, assessors may interview the engineers responsible for maintaining systems to verify their understanding of established procedures. Thai recalls that assessors spent little time interviewing him directly, concentrating instead on technical staff. "Because if the engineers don't know it, that means you don't do it," Thai says.

Security decisions extend beyond compliance checklists

Compliance frameworks define required controls, but organizations still make decisions about how to satisfy them. Those choices can produce different levels of protection even when the implemented controls meet the stated requirements.

Thai uses multifactor authentication as an example. Organizations may implement MFA through email or SMS, satisfying a basic requirement while leaving opportunities to strengthen authentication through methods such as FIDO security keys or authenticator applications. "It's about understanding the spirit of the requirement," Thai says. "Why are they telling you to use MFA? To protect your credentials."

Evaluating controls against their intended security objectives helps organizations make more informed implementation decisions. Thai's team followed this principle during its CMMC efforts, beginning with the security problems it needed to prevent and developing controls that could address them. "CMMC was important to us, but we didn't do it solely to be compliant," he says.

Long-term security requires organizational commitment

Building a mature security program requires more than implementing technical controls. Organizations also need to establish security as a shared responsibility, with leadership and business teams understanding how cybersecurity supports commercial objectives. Thai emphasizes the importance of connecting security investments to business priorities, particularly when compliance requirements influence contract eligibility. "When we frame it as pursuing more business, everyone understands," he says.

As cybersecurity requirements become more closely integrated into business operations, collaboration across departments becomes essential to maintaining effective controls and demonstrating compliance. For Thai, the long-term priority is developing security capabilities that strengthen the organization while supporting future certification requirements. "We're not aiming for certification. We're aiming for security, which then feeds easily into certifications," he concludes.