Blog · Cybersecurity Policy

Two Sides of a Breach: Priced Compliance for Suppliers, an Unused Penalty for Attackers

Chris A. Grable · October 4, 2026

Every intrusion into a defense supplier leaves two parties the government could act on: the company that was breached and the actor who breached it. Compare where the government's effort goes and the imbalance is hard to miss. The supplier faces a detailed compliance regime with a price on it. The attacker faces a sentencing enhancement that, by the Sentencing Commission's own published tables, has not been applied in four fiscal years.

What the supplier carries

A supplier whose systems fall under DFARS 252.204-7012 has to meet the 110 security requirements in NIST SP 800-171 Revision 2, and under CMMC it must pass an assessment that proves it. The CMMC final rule (89 FR 83092, 15 October 2024) prices a small company's first Level 2 certification assessment, together with its first affirmation, at $101,752 (pages 83185 to 83186), and states that the estimate assumes the security work is already done.

That point deserves emphasis. The $101,752 buys no firewall, no encryption and no monitoring. It pays for preparing for an assessment, sitting through it and documenting it. That cost is counted down to the dollar. On the benefit side (pages 83192 to 83193) it puts no number on the intrusions CMMC would stop; it outlines the threat and states that the program gives DOW "assurance."

In July, DOW halted the transition to CMMC Phase 2, citing cost and bureaucratic burden that were pushing companies out of the industrial base (see the implementing memorandum of 13 July 2026). The suspension paused the mandatory third-party rollout. It left the underlying safeguarding and self-assessment duties in place, and small firms still carry them.

A label the supplier does not control

Those duties attach to Controlled Unclassified Information (CUI), and the government decides what counts as CUI. Under 32 CFR Part 2002, the government is supposed to designate CUI and mark what it hands over (2002.20). If the marking is missing, the contractor still has to apply the contract's definition of covered defense information, which turns on how the information was provided or developed and what it contains, and that can leave real uncertainty. The contractor may request documented clarification or challenge a designation (2002.50), and it must keep protecting the information while the question is pending. Part 2002 also states that it binds no one outside the executive branch directly and confers no enforceable right (2002.1). The duty arrives through the contract. Part 2002 gives the contractor a challenge process, and any further remedy depends on the contract itself.

What the attacker faces

The 2025 Guidelines Manual contains an enhancement aimed at exactly the attack the defense community says it fears most. Under section 2B1.1(b)(19), an offense under 18 U.S.C. 1030 that caused a substantial disruption of a critical infrastructure carries a six-level increase, with the offense level raised to at least 24.

The Commission's guideline-calculation tables for fiscal years 2022, 2023, 2024 and 2025 record that enhancement applied zero times. Read precisely, the tables do not show that attackers escape prosecution. They show that this specific enhancement does not appear in the Commission's reported calculations for any of those four years.

In UDC's judgment, part of the explanation is a drafting gap. The guideline defines critical infrastructure but never says what makes a disruption substantial, so a prosecutor has to guess and a judge has no test to apply. In July, Up Doppler Consulting urged the Commission to close that gap. The final 2026–2027 priorities, adopted on 27 August, leave it out.

Why the imbalance matters

Zero applications in four years raise a fair question about whether the enhancement is used in practice. Set the two sides next to each other: a ten-person machine shop can jeopardize its contracts by skipping a required assessment or omitting a required document, while the enhancement written for people who attack critical infrastructure has gone four years without use. Burden and deterrence point in opposite directions. Regulating the victim does little to deter an adversary who never expects to pay for the attack. What they do is raise the price of being a target.

What UDC recommends

• Go after offenders as energetically as the government enforces CMMC.
• Define the guideline's terms so existing penalties can actually be applied, prosecute the cases and report the outcomes.
• Before another dollar of burden lands on a small supplier, show what security that dollar buys.

In July, Up Doppler Consulting put this argument before DOW's reform task force and the Sentencing Commission. UDC sells no cybersecurity or compliance services.