Home / Industries / Defense & government contractors
Macomb County is the center of Michigan’s defense industry. If you handle Controlled Unclassified Information, the government expects real NIST SP 800-171 controls, evidence to back them up, and an honest score in SPRS.
Macomb County companies received $3.21 billion in Defense Department contracts in 2024, about 65% of Michigan’s defense contract dollars, with TACOM and the Ground Vehicle Systems Center at the Detroit Arsenal in Warren. That work comes with flowdown clauses, and they reach well past the primes.
The core requirement hasn’t changed in years: DFARS 252.204-7012, the 110 requirements in NIST SP 800-171 for any system that handles CUI, and a self-assessment score posted in SPRS. CMMC was meant to add third-party verification. The Pentagon suspended that phase in July 2026 for a review and, as of October 2026, hasn’t announced a new date. The obligations already in your contract still stand.
With self-assessment, your score is a representation to the government. The Justice Department has used the False Claims Act against contractors whose cybersecurity claims didn’t match reality. Getting the evidence right matters more now, not less.
Your contract clauses tell you which of these apply. If you handle CUI, it’s usually all of them.
Most of the defense supply chain says it’s compliant. The data says many contractors couldn’t prove it today. Here’s where the gaps are, with the numbers behind them and what I do about each.
The average self-reported SPRS score climbed to +51, yet contractors’ confidence that their own scores were accurate fell from 89% to 65% in a year.
What I doAn evidence-based gap assessment against all 110 requirements, a system security plan that describes what you actually run, and a plan of action that closes gaps in priority order.
Source: CyberSheath, 2026 State of the Defense Industrial Base
The case didn’t start with a breach or a whistleblower. Government assessors checked the contractor’s NIST SP 800-171 score and found it dramatically overstated. Third-party certification is paused; this kind of enforcement isn’t.
What I doA score built from evidence you can show an assessor, reviewed every year, with a senior official who understands what they’re affirming.
Source: Arnold & Porter, on the LOGZONE settlement (June 2026)
Multi-factor sign-in is one of the 110 requirements and one of the cheapest defenses there is. Only 25% had endpoint detection and response. Without these, one phished password can reach every CUI file the account can.
What I doMulti-factor sign-in everywhere CUI lives, starting with email, remote access and admin accounts, plus monitored endpoint protection on every computer in scope.
DFARS 7012 also requires a DoD-approved medium assurance certificate to file the report and preserving images of affected systems for 90 days. Learning that in the middle of an incident costs time you don’t have.
What I doAn incident response plan built around the DFARS reporting steps, the certificate in hand before you need it, and logs and backups that preserve the evidence.
Related services: Network security & cybersecurity · Managed IT services · Cloud, Microsoft 365 & Google Workspace · Secure AI · Staff training
AI can speed up proposals, compliance paperwork and technical writing. For anything involving CUI, the tool and the cloud behind it must be approved for CUI first, and the standard versions of popular AI services don’t qualify.
Defense suppliers can use the same vision and predictive tools as any plant. The difference is where they run. I build them inside an environment that meets your DFARS and NIST SP 800-171 obligations, not around them.
Computer vision for inspection and part traceability, run at the edge or in government cloud so controlled data stays controlled.
Best forSuppliers making parts to defense drawings and specs.
The evidence your NIST SP 800-171 assessment needs, collected continuously instead of the week before someone asks.
Best forContractors maintaining a SPRS score with a small team.
No. Certification assessments are performed by authorized third-party assessment organizations (C3PAOs). I help you get ready: scoping, a gap assessment against NIST SP 800-171, remediation and documentation, so your self-assessment holds up today and a certification assessment goes smoothly when it returns.
Everything already in your contract. DFARS 252.204-7012 and NIST SP 800-171 still apply, your SPRS score must be current and accurate, and contracts can still require a CMMC Level 1 or Level 2 self-assessment with annual affirmations. The suspension paused third-party certification, nothing else.
Generally not. CUI has to live in a cloud environment that meets FedRAMP Moderate or the Defense Department’s equivalency requirements, which usually means a government cloud offering. Scoping that boundary correctly is one of the first things I help with.
With scope. Find out exactly what CUI or Federal Contract Information you receive, where it goes and who touches it. Keeping that footprint small is the cheapest compliance decision you’ll ever make.
Figures and rules on this page were checked against these sources on October 27, 2026, using the latest edition available. This page is general information, not legal advice.
Bring the contract clause, the flowdown or the prime’s questionnaire. You’ll get a straight read on where you stand and what it takes to close the gaps.