The recent CMMC suspension put all of us in something of a state of shock and confusion, and I have been closely following the discussion in the Defense Industrial Base (DIB) community, including vendors, customers, and cybersecurity specialists. In a memo to my clients, I shared some details for the decision. A common theme among those reasons is cost and capacity. We’ve learned that CMMC has prohibitive compliance costs, with individual bills approaching $600,000; SBA estimates above $7 billion annually across the base, that there is a severe assessor shortage; roughly 100,000+ firms need assessments from only about 100 approved organizations and that the DoD stood up a 60-day CMMC Reform Task Force to recommend a lower-barrier replacement framework.

When the U.S. Department of Defense began signaling that cybersecurity self-attestation would eventually give way to mandatory third-party certification, San Francisco Circuits decided to get ahead of it. That decision, made in 2019, shaped everything that followed: the systems we implemented, the partners we engaged, and the audit we ultimately passed. This is the story of that process, including what worked, what added complexity, and what we'd tell other EMS companies and defense suppliers that are now facing the same path.

American Made Advocacy: American PCBs in Big Demand and Short Supply

Omega EMS Advances Toward CMMC Level 2 Certification

CMMC 2.0: The Defense Supply Chain’s Next Qualification Requirement