Are You the Weakest Link?

OverviewExecutive Summary

Supply chain risk in the Defense Industrial Base is broad, multi-dimensional, and unavoidable. It is also not primarily a cybersecurity problem. Cyber is one thread among many that includes financial fragility, foreign dependency, regulatory complexity, and structural concentration.

Non-compliance is not a paperwork gap. Contracts can be disqualified, deliveries halted, and a single breach anywhere in a supply chain can cascade in both directions. The government is tightening third-party assessment requirements. Primes are holding supply chains accountable. The window to get ahead of this is narrowing.

This paper identifies the ten most common supply chain challenges in the DIB, clarifies what DFARS and CMMC actually require, and lays out the mitigations that matter most: risk scoring, diversification, supply chain illumination, and continuous monitoring.

Section 1The Stakes

Every defense contractor sits inside a supply chain. Consider the F-35. Lockheed Martin is the prime contractor, but more than 5,000 companies sit within the broader F-35 supply chain. Tier 1 subcontractors include Northrop Grumman, BAE Systems, and RTX. Below BAE Systems sits L3 at Tier 2; below L3 sit its suppliers at Tier 3, including Pratt & Whitney; below Pratt & Whitney sit suppliers such as Woodward at Tier 4 and 5. The chain extends much further still. A weak link anywhere along this chain can degrade the security, schedule, or integrity of the overall program.

Risk runs in both directions: the risk a contractor poses to its customers, and the risk its own supply base poses in return. Whether you are a $5M machine shop or a Tier 1 systems integrator, you serve customers above you in the chain. You are obligated to deliver to specification, on schedule, and in compliance with the cybersecurity and regulatory requirements your customers flow down to you. The risk you represent to your customers is real, and it is increasingly being measured.

At the same time, every contractor depends on its own suppliers, who depend on theirs, and so on. A breach, financial collapse, or production failure several tiers below your own walls can disqualify your bid, halt a delivery, or expose your most sensitive data. Supply chain risk must therefore be evaluated from two perspectives at once: the risk you represent to your customers, and the risk your suppliers and their suppliers represent to you.

Small sub-tier suppliers rarely have the resources, expertise, or budget of the large primes. One might expect Lockheed, BAE, or RTX to invest in helping their smaller suppliers reach an adequate security baseline. In practice, most do not. Liability concerns mean primes typically avoid prescribing specific security measures to smaller suppliers. The most vulnerable links are left to navigate compliance alone.

“Small, non-traditional contractors are the most vulnerable link in the defense supply chain – the ‘soft underbelly.’”

– Ellen Lord, former Under Secretary of Defense for Acquisition and Sustainment

Section 2Risk Is Multi-Dimensional

Supply chain risk cannot be reduced to cybersecurity. A supplier that scores well on cyber can still represent serious risk across other dimensions. Decisions and conversations about suppliers must therefore be evaluated across the full set of dimensions, not just one.

• Cyber: Unpatched systems or compromised accounts anywhere in a supply chain are potential entry points. Smaller suppliers are disproportionately targeted and often hold sensitive data they do not recognize as such. A low-security supplier with network access to a higher-security prime is a lateral movement vector.
• Compliance: If a critical supplier fails its CMMC assessment, the delivery chain above it may be disqualified. Flow-down responsibility means contractors are accountable for their supply chain’s compliance, not only their own.
• Financial: Suppliers on thin margins can fail without warning. A missed delivery is usually the first visible signal, not a bankruptcy notice. Single-source dependencies amplify this risk significantly.
• Operational: The prime contractor base has shrunk from 51 companies in 1990 to 5 dominant primes today. Consolidation converts distributed risk into correlated, systemic risk: when one large node fails, every program it touches is affected.
• Geopolitical: Approximately 85% of rare earth processing is in China. Semiconductor fabrication is concentrated in Taiwan. These dependencies cannot be unwound quickly. A foreign acquisition can change the risk profile of a long-standing supplier with no visible warning.
• Concentration: Widely used commercial software creates horizontal single points of failure across the ecosystem. The SolarWinds compromise demonstrated the scale. Similar exposures exist across the DIB today.

Real-world examples are not theoretical. Foreign acquisitions have placed Chinese-controlled robotic arms inside U.S. defense assembly lines. Submarine shipbuilders dependent on titanium castings continue to source from foreign suppliers. Each of these is a separate dimension of the same supply chain risk. These risks also interact. Consolidation reduces visibility. Poor data integration prevents compliance. Regulatory complexity drives smaller suppliers out of the DIB. Attrition concentrates risk on those who remain. No single intervention resolves the system.

Section 3The Top Ten Most Common Challenges

DIB contractors – and especially small contractors – face a remarkably consistent set of supply chain challenges. The following ten, presented in descending order, capture what we see most often. Their ranking depends on the contractor’s tier and industry; many practitioners would argue that any of these could be number one for them.

Section 4Regulatory Obligations

Members of the DIB have explicit responsibilities tied to the type of data they handle. Those responsibilities will increase as CMMC transitions from NIST SP 800-171 Rev. 2 to Rev. 3. The starting point is understanding what flows down, to whom, and on what terms.

Flow-Down Requirements Under DFARS 252.204-7012

DFARS 252.204-7012 requires prime contractors and subcontractors to include the clause, in its entirety, in all related subcontracts without alteration except to identify the parties. The clause states explicitly:

“The Contractor shall include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer.”

This is a continuous obligation – it applies every time a new subcontractor is brought on, and requires ongoing verification that subcontractors remain compliant at six months, one year, and two years into a contract. Most non-compliant contractors have subcontractors handling CUI who have never seen the clause.

CMMC Levels

Requirements vary by data type and CMMC level:

• Level 1 (FCI): 15 basic controls from FAR 52.204-21. Annual self-assessment and affirmation. Applies to any contractor handling federal contract information.
• Level 2 (CUI): 110 controls from NIST 800-171 Rev 2. Third-party or self-assessment as determined by the contracting officer. Contracts involving Controlled Technical Information, Critical Infrastructure Security Information, or Naval Nuclear Propulsion Information should expect third-party assessment requirements.
• Level 3 (High-Sensitivity CUI): 24 additional controls. C3PAO assessment followed by government DIBCAC certification.

ESG as a Dimension of Supplier Risk

Primes are increasingly evaluating their supply chains through the lens of Environment, Social, and Governance (ESG) standards. ESG evaluates how responsibly a company operates and its long-term sustainability – exactly the question raised by the recent abrupt closure of an MSP serving several companies in the DIB.

Three categories define ESG:

• Environmental: climate impact and carbon emissions, energy use and resource management, waste, pollution, and broader environmental stewardship.
• Social: employee treatment, safety, and diversity; human rights and labor practices; community impact and customer protection.
• Governance: board structure and oversight; business ethics and anti-corruption controls; transparency, accountability, and executive compensation.

For smaller contractors, ESG can appear to be a large-enterprise concern. It is becoming an increasingly important dimension of risk for the larger corporations that buy from them, and small contractors should expect ESG questions to appear more frequently in vendor assessments, RFIs, and RFP

Other Responsibilities

Beyond CMMC, contractors should treat the full regulatory stack as part of their responsibility set: ITAR, EAR, Section 889, Section 5949, GDPR (for any EU-touching operations), ESG expectations from increasingly demanding primes, and industry-specific frameworks. Compliance with one is not compliance with the others, and the cost of treating any of them as an afterthought is increasingly high.

Section 5Risk Mitigations That Matter

There are concrete steps DIB contractors can take to mitigate supply chain risk or, at minimum, to limit its potential impact. Three mitigations stand out:

Risk Scoring

Prioritization is the starting point. For each risk, assess likelihood and impact. Concentrate resources on high-likelihood, high-impact items first. A heat map is the typical visualization: high likelihood and high impact in the upper right (red); low likelihood and low impact in the lower left (green). Resources concentrate on the red, then on the orange, with the goal of bringing items into yellow and green over time.

The critical reminder: risk is multi-dimensional. A supplier may score “green” on cyber while presenting serious geopolitical, financial, or concentration risk. Risk scoring must reach across all dimensions, and supplier conversations must address all of them.

Diversification and Resilience

Resilience is the ability of a supply chain to anticipate, withstand, adapt to, and recover from disruptions while continuing to deliver required products or services. It requires visibility, diversified suppliers, contingency planning, and flexible operations so that failures at one point in the network do not halt the entire system.

Single-source dependencies are among the highest-risk items on most supply chain matrices and among the hardest to fix under pressure. Qualifying an alternative source takes months. This work must happen before a disruption, not during one.

• Map every single-source dependency for critical components.
• Qualify at least one alternative source for the highest-risk dependencies.
• Build contingency plans for the most fragile supplier relationships before they are needed.

Supply Chain Illumination

Most contractors have reasonable visibility into Tier 1. Almost none have reliable visibility below that – which is where the most dangerous risks tend to sit. Supply chain illumination addresses this directly

The challenges outlined above share a common thread: most of the risk in a defense supply chain is invisible until it becomes a problem. Compliance posture degrades between assessments. Suppliers experience financial or operational distress without signaling it upstream. Cybersecurity gaps persist at Tier 3 and below precisely because no systematic mechanism exists to surface them. Point-in-time audits and annual questionnaires were designed for a slower, more stable environment – not for a supply base of thousands of small businesses operating under overlapping regulatory frameworks, facing demand surges, and managing technology transitions simultaneously.

Section 6The Need for Continuous Monitoring

Compliance is not a project with an end date. In any given quarter: suppliers gain and lose certifications; ownership changes shift geopolitical risk; financial conditions change; infrastructure migrations introduce new gaps. Earlier this year, an MSP serving multiple DIB contractors closed abruptly, leaving its customers non-compliant with their shared responsibility agreements overnight.

Continuous monitoring means three things in practice:

• Supplier scores and POA&Ms are living documents, updated as environments change – not refreshed once per assessment cycle.
• Illumination tools surface changes in compliance posture in real time.
• Supplier risk reviews are cadenced – quarterly minimum for critical suppliers, with immediate triggers for ownership changes, financial stress, or scope changes.

The five core risk domains – visibility, cybersecurity variance, compliance complexity, data fragmentation, and consolidation – are interconnected. No single actor has the incentive or leverage to resolve the system unilaterally. Sustained investment, government mandate, and visibility deep enough to see problems before they become crises are all required.

Section 7Priority Actions

Section 8Summary and Key Takeaways

Supply chain risk in the Defense Industrial Base is broad, multi-dimensional, and unavoidable. Contractors who treat it as a one-time CMMC exercise will be exposed; contractors who treat it as ongoing operational discipline will compete and win.

Your customers, whether the government, a prime, or subcontractor, are evaluating the risk you pose. Some key points to remember:

The companies that internalize these principles will reduce their own risk and the risk they pose to their customers.