CS5 East 2026

Most Affirming Officials are affirming what they cannot see. Their direct CUI environment, sometimes. Their service providers and supply chain, rarely. This session looks at supply chain risk from the AO's chair, drawing on lessons learned from 100+ NIST 800-171 assessments across primes, mid-market, and small business suppliers. Attendees leave with a three-principle framework - visibility, tiering, action - for building reasonable assurance into their flow-down program.

Many OSCs approach CMMC as a compliance expense. The conversation often starts with: How much will this cost? What is the minimum we have to do? How do we get through assessment? Instead, ask different questions: • What revenue depends on this? • What contracts become available because of this? • What business risk are we reducing? • What operational capabilities are we building? This product-agnostic session reframes CMMC as a business and executive leadership discussion, not just a technical and compliance exercise. The most sustainable CMMC programs do not start with technical controls - they start with leadership understanding why those controls exist. Drawing from real-world CMMC environments, the session explores why successful programs are less about a specific technology stack and more about executive clarity, business objectives, and intentional architecture. If an organization spends $X to preserve eligibility for $X million in defense revenue, is that merely a compliance expense - or a business continuity investment? Attendees will work through executive-level questions such as: • How much annual revenue is tied to DoW contracts and subcontracts? • Could commercial revenue replace that loss within 12 months? • What value is tied to your reputation and position in the defense supply chain? • What is the cost of validating assumptions before implementation vs. discovering six months later they were wrong? "CMMC is not for us" may be the right answer - the goal is to make that decision intentionally, financially, and strategically. The CFO will be your best friend here. Time is reserved for facilitated audience discussion and Q&A on how organizations can slow down enough to make sound business decisions while moving fast enough to meet contract demand.

With the formal roll-out of CMMC, the stakes for DoW contractors have fundamentally shifted from operational eligibility to legal accountability. Under the DOJ's Civil Cyber-Fraud Initiative, the government is increasingly leveraging the False Claims Act (FCA) to pursue treble damages and hefty penalties against companies that knowingly misrepresent their cybersecurity posture in the Supplier Performance Risk System (SPRS). This session addresses a critical friction point in the DIB: the disconnect between the IT and security teams tracking technical controls and the C-suite executives who must legally sign off on compliance attestations. Through an objective, non-commercial breakdown of recent FCA cyber-fraud enforcement actions, we'll map out exactly where organizations stumble - how incomplete System Security Plans (SSPs), unvetted Plans of Action and Milestones (POA&Ms), and "paper compliance" create devastating legal liabilities. Participants receive a step-by-step framework to establish a legally defensible compliance process: executive validation protocols, absolute alignment between technical evidence and legal affirmations, and internal whistleblower mitigation strategies. This session moves past standard control checklists to deliver an essential governance playbook for surviving the new era of regulatory enforcement.