HX5 passed its Certified Level 2 cybersecurity audit in the first half of 2026, after months of consultant fees, staff hours, and system upgrades spent clearing a bar the Pentagon had set for defense contractors. On July 13, 2026, the Department of Defense suspended the requirement that audit was built to satisfy, about four months before it was due to take effect.
When the Cybersecurity Maturity Model Certification program was announced, Margarita Howard, HX5’s founder and chief executive, put the company on an aggressive schedule, partly because she expected the pool of government-certified assessors to run short and the line of contractors behind them to back up.
“We knew that the limited number of government-certified third-party assessors would become a significant issue and that there would quickly be a backlog of defense contractors trying to get certified,” Howard says.
By late 2025, the shortage Howard had anticipated was plain: only about 550 to 560 certified CMMC assessors worked worldwide, each Level 2 assessment required three of them, and waitlists at assessment firms already ran past a year. More than 200,000 organizations were expected to need Level 2 certification, all drawing on the same short supply of qualified assessors.
Howard’s answer was to spend early. HX5 brought in outside consultants and firms that specialized in individual pieces of the standard, confirmed that its infrastructure, staff training, and system configurations met the guidelines, and held its whole team available through a long third-party assessment.
“The investment was very substantial, she says. “Money, staff hours, process changes, all of the above were required to meet the rigorous requirements,” Howard wrote. The audit itself was expensive, she added, and required the entire team to support the assessors’ requests over an extended period.
The suspension arrived after that work was finished. The Department of Defense halted the Phase II requirement on July 13, and the department’s chief information officer, Kirsten Davies, convened a reform task force to review the program and report back within 60 days. A Pentagon review had already drawn more than 1,100 industry responses, many of them from small and mid-sized firms that reported compliance costs were hitting them hard, according to DefenseScoop.
Not a ‘Stranded’ Investment
A company that had just spent heavily to satisfy a rule now on hold has reason to call the money wasted, but Howard rejects that reading. “We don’t believe any of that investment is stranded. The process improved our systems overall,” she says. The audit pushed HX5 to adopt newer technologies and rethink where its infrastructure needed to sit, and Howard argues the company now runs in a more secure position regardless of what the task force decides.
But she does expect the requirement, or something like it, to return. “It puts us in a much more secure position and prepares us for the reengagement of CMMC Phase II if the suspension is lifted, or for new requirements that may be implemented down the road,” she says. “Having spent the past several years building infrastructure that meets and exceeds CMMC requirements has paid dividends for us in a number of areas.”
The assessment firm Redspin reported that organizations which ran mock assessments and used outside readiness help passed on the first attempt 93.8% of the time. That figure runs in the same direction as Howard’s experience. Contractors that treated the audit as a real project cleared it, and those that waited ran into the backlog she had predicted.
HX5’s Bet on a Moving Target
Howard does not pretend certification was cheap, or that keeping it current is. “It was a lot of money and a lot of time, and maintaining it requires a tremendous amount of both. But it’s simply part of doing business nowadays,” she says.
HX5, a defense and aerospace services contractor with close to 1,000 employees across more than 20 states, supports Department of Defense and NASA programs in research, engineering, information technology, and mission operations, work that runs on access to sensitive government information.
That is why Howard treats the security upgrades as permanent whatever happens to the rule. The reform task force’s recommendations were not public as of late September, and the shape of any replacement is still open. Regardless, Howard reads the direction of defense cybersecurity as consistent over time, and she argues that a contractor paying attention does the work ahead of the mandate rather than after it.
“Even if the CMMC certification requirement itself is not ultimately upheld in its current form,” she says, “we believe the work we’ve done provides meaningful benefits for the company.”
