We’ve seen a handful of supply chain letters, memos, and notices over the last year or so. In these types of communications, prime contractors are essentially pointing to DFARS 252.204-7021 and saying, “Get on board.”
Parsons:
Boeing:Lockheed Martin:
Northrop Grumman:
Prime contractors have flow down requirements stipulating that every organization handling Controlled Unclassified Information (CUI) within their supply chain must also be Cybersecurity Maturity Model Certification (CMMC) Level 2 certified. As such, the pressure is on them to ensure that their subcontractors are compliant.
On April 6, 2026, L3Harris Missile Solutions circulated a supply chain notice titled “CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) - Action Needed.”
In this letter, L3Harris warns contractors handling CUI that they must be CMMC certified by July 30th, 2026:
"All suppliers on DoD programs who receive CUI at all tiers must be certified if required by the DoD prime contract, including small businesses and foreign suppliers. Certification may be needed to submit a proposal and prior to the contract award. Suppliers who do not qualify for certification at Level 2 will be precluded from the program. This requirement does not apply to suppliers who solely produce commercial-off-the-shelf (COTS) items as defined in FAR 2.101.."
This letter gives subcontractors around 80 business days of notice to provide a copy of their CMMC Level 2 certifications (issued by Certified Third-Party Assessor Organizations (C3PAOs)) and CMMC Level 2 Assessment Reports. In this notice, L3Harris advises that those who have not begun pursuing CMMC Level 2 certification should prioritize reaching out to CMMC C3PAOs. The problem is, if you haven’t begun, you won’t be CMMC Level 2 certified in 80 days.
If you’re familiar with the process of implementing National Institute of Standards and Technology (NIST) 800-171 requirements and undergoing third-party assessment, you’ll know that from start to finish, the certification process typically takes 6 to 12 months. If any of L3 Harris’s suppliers were waiting on this notice to get started, they’re not likely to make that deadline.
Speak to an expert at Summit 7 to get started with CMMC Level 2.