Manufacturers and Defense Suppliers

What arrives

CMMC, or 7021
32 CFR Part 170 and DFARS 252.204-7021. Phase 1 began November 10, 2025, the effective date of the 48 CFR rule; Phase 2 begins one calendar year later.
Source
The SPRS score
DFARS 252.204-7019 and 7020. A NIST SP 800-171 DoD Assessment, not more than three years old, with its score posted in the Supplier Performance Risk System.
Source
7012
DFARS 252.204-7012. Safeguarding covered defense information on contractor systems, and reporting a cyber incident to DoD within 72 hours of discovery.
Source
NIST SP 800-171
CMMC Level 2 incorporates NIST SP 800-171 Revision 2 by reference (32 CFR 170.2). NIST withdrew Revision 2 on May 14, 2024, superseded by Revision 3.
Source
A machine hall, rows of equipment down its length, lit from the windows.

What the Institute has found here

The Vigil Library
A container port at night from above, stacked containers under working lights.

Institute

The Vendor as the Vector: Third-Party Risk Management Across Veterinary and Insurance Networks

Field notes · June 2026

Read it
A dark field of small points of light, close.

Institute

AI and the Expanding Attack Surface: How Generative Tool Adoption Creates New Risk Vectors in Mid-Market Businesses

Analyst · June 2026

Read it
A printed worksheet of numbered rows lying on a wooden desk.

Institute

The SMB Security Paradox

Analyst · February 2026

Read it

Request an Introduction