Cybersecurity leaders and Defense Industrial Base (DIB) partners gathered at CS5 East 2026 to discuss protecting sensitive information and strengthening resilience across the defense supply chain. As organizations address Department of War (DoW) requirements, Cybersecurity Maturity Model Certification (CMMC) reform, supply chain security, controlled unclassified information (CUI) management and Artificial Intelligence (AI) are shaping cybersecurity and risk management strategies.
Conversations extended beyond certification timelines to resilience, data protection and the future of cybersecurity operations. Five insights define the path toward a more secure DIB.
CMMC Is Evolving into a Competitive Differentiator for the DIB
As CMMC matures, reforms aim to improve efficiency, reduce costs and align with other Federal programs while maintaining the core objective of strengthening cybersecurity across the defense supply chain.
Small businesses represent roughly three-quarters of DIB organizations, making affordable, right-sized certification approaches essential. Contractors balancing resources and assessment preparation increasingly see stronger cybersecurity as a way to reduce risk and demonstrate their ability to protect sensitive information.
The certification ecosystem is expanding to meet demand. As of September 2026, 117 Certified Third-Party Assessment Organizations (C3PAOs) were authorized or accredited and issued CMMC certificates grew 12% between August and September. Level 2 certification is becoming both a protective measure and an advantage that builds customer confidence and strengthens contracts competitiveness.
Organizations seeking certification must designate an affirming official to attest to its compliance posture. That individual need not lead compliance efforts but must participate in the assessment, whether conducted internally, by a C3PAO or by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
Supply Chain Security Extends Across Every Tier of the Defense Ecosystem
Supply chain resilience was a central theme throughout the event, reflecting cybersecurity’s reach across the DIB’s network of suppliers, manufacturers and service providers. More than 200,000 suppliers support defense systems, and five in six organizations responsible for safeguarding CUI are subcontractors, making supply chain security a national security priority.
As requirements flow between primes and subcontractors, understanding contractual obligations is critical. Required CMMC levels depend largely on the information contractors handle, and subcontractors may inherit corresponding requirements. Every supply chain tier contributes to overall security.
New supply chain provisions in the proposed Federal Acquisition Regulation (FAR) Part 40 rule and the dedicated Supply Chain Risk Management family in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev. 3. signal a broader focus on securing information across the defense ecosystem, not just within individual organizations.
Effective CUI Management Begins with Knowing What to Protect
Protecting CUI starts with identifying the information that requires protection and determining which requirements apply, establishing the foundation for technical controls. Contract language frequently provides the clearest guidance on obligations tied to how information is created, handled or shared.
Knowing where sensitive information resides is equally important. Email, Microsoft 365 environments, document repositories, collaboration platforms and shared devices may fall within the compliance boundary when they involve regulated information. As CUI guidance evolves, clear governance helps organizations consistently identify, classify and protect information, meeting compliance expectations while reducing operational complexity.
Risk Management Elevates Cybersecurity from Compliance to Resilience
Compliance frameworks remain essential, but sophisticated threat actors require capabilities beyond baseline controls.
Frameworks such as the NIST Cybersecurity Framework (CSF) 2.0 help organizations evaluate investments, prioritize security initiatives and align defenses with business objectives. Advanced controls and enhancements also improve detection, response and recovery from complex attacks. Discussions around NIST SP 800-172 addressed security enhancements for sophisticated adversaries, while recent Cybersecurity and Infrastructure Security Agency (CISA) guidance highlighted advanced tactics targeting critical infrastructure. Threat-informed strategies leveraging resources such as MITRE ATT&CK help teams understand attacker behavior and strengthen defenses.
These investments also have a clear business case. In 2025, the average U.S. data breach cost approximately $10.22 million per business, making resilience a strategic priority beyond a compliance objective.
AI Is Moving from Experimentation to Everyday Compliance Operations
AI is rapidly transitioning from experimentation to practical application across cybersecurity and compliance programs. Organizations use AI to automate routine tasks, accelerate analysis, improve readiness and maximize staff capabilities. Areas where AI is delivering the most immediate value include:
- Compliance documentation and policy development
- Evidence gathering and organization
- Assessment preparation and readiness activities
- Compliance framework mapping
- Incident response support
- Continuous compliance
These capabilities reduce administrative workloads while improving compliance-program consistency and visibility. For smaller contractors, AI can also make cybersecurity and compliance more scalable and cost-effective.
Responsible adoption remains a priority. In 2025, approximately 16% of investigated cyberattacks involved the use of AI, demonstrating how emerging technologies influence both defensive and offensive cybersecurity activities. Human oversight, documented processes and clear governance help ensure AI is used responsibly.
Building a More Resilient Defense Industrial Base
CS5 East 2026 reinforced that cybersecurity is evolving from compliance into a broader business resilience strategy. Key themes from the event emphasize strengthening the defense supply chain, protecting sensitive information, preparing for increasingly sophisticated threats and using emerging technologies to improve operations. As requirements, threats and capabilities evolve, organizations combining strong governance, effective risk management and responsible innovation will be better positioned to strengthen cybersecurity, support mission objectives and build a more resilient DIB.
As Carahsoft, The Trusted Government IT Solutions Provider™, supports defense and cybersecurity modernization, insights from CS5 East 2026 help guide industry partnerships with the DIB to protect sensitive information at every supply chain tier.
To learn more about achieving CMMC certification and protecting CUI across the supply chain, explore Carahsoft’s CMMC Portfolio or contact our team at CMMC@Carahsoft.com or (888) 662-2724.
To learn more about strengthening resilience against advanced threats, explore Carahsoft’s Cybersecurity Portfolio or contact our team at Cybersecurity@Carahsoft.com or (571) 591-6111.
