Adam Kangiser, Iviry’s Compliance Analyst
The FBI’s 2024 IC3 Report revealed an alarming milestone: $16.6 billion in cybercrime losses in a single year—more than double the $7 billion reported just four years earlier. From phishing to ransomware, attackers are exploiting weaknesses across industries, and the numbers underscore what security leaders have long known: basic protections are no longer optional.
This backdrop makes the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program more urgent than ever. With CMMC requirements set to appear in DoD solicitations by the end of 2025 and enforcement ramping up between 2026 and 2028, contractors that fail to prepare now risk both compliance penalties and missed business opportunities.
CMMC in Context: Bridging Compliance and Security
CMMC was designed to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within the defense supply chain. It establishes three levels of maturity:
- Level 1– Basic safeguarding of FCI.
- Level 2– Advanced practices aligned with NIST SP 800-171.-
- Level 3– Expert controls mapped to NIST SP 800-171 AND NIST SP 172.
These are not arbitrary checkboxes; they directly address the attack vectors highlighted in the IC3 report.
From IC3 Findings to CMMC Controls
The FBI’s data provides a clear “why now” for CMMC adoption:
- Phishing and BEC– MFA is one of the simplest yet most effective ways to prevent credential theft and fraudulent transfers.
- Data Breaches– Encryption and access controls, both required under CMMC, limit the damage when attackers penetrate defenses
- Ransomware– Regularly tested backups and incident response planning ensure operations can continue without paying a ransom.
These practices are not only compliance requirements—they are frontline defenses against the most common and costly cyber threats.
Business Risk and Competitive Advantage
Non-compliance with CMMC will soon mean more than fines—it will mean losing the ability to bid on and win DoD contracts. At the same time, businesses that achieve certification signal to partners and clients that they are serious about protecting sensitive data and resilient in the face of cyber threats.
In an environment where cybercrime costs are skyrocketing, CMMC offers a framework for aligning compliance with real security outcomes.
The Path Forward in 2025
As the deadline approaches, defense contractors should:
- Conduct a gap analysisagainst CMMC Level 2 or 3, depending on the contract.
- Prioritize quick winslike MFA, patching, and endpoint monitoring.
- Document every control—because CMMC will require evidence!
