By Cyber Defense Technologies October 23, 2026 4 min read
Small companies make up a large part of the defense industrial base. Machine shops, engineering firms, software developers and specialized service providers support major programs, often with a handful of IT staff or none at all. Attackers know this. Smaller suppliers can hold valuable technical data, and they may offer a path into the larger contractors and government customers they work with.
The good news is that most successful attacks still exploit basic weaknesses. A small organization that consistently gets the fundamentals right is much harder to compromise.
Start with what you have
Inventory your assets. List the computers, servers, mobile devices, network equipment, cloud services and software your business uses, and who is responsible for each. You cannot protect, patch or monitor what you do not know about.
Know where contract information lives. Identify where Federal Contract Information and any Controlled Unclassified Information are stored, processed and sent, including email, file shares, cloud storage and personal devices. This shapes everything else, including the scope of any CMMC assessment.
The priority basics
- Multi-factor authentication. Turn on MFA for email, cloud services, remote access and every administrator account. If you do one thing this month, do this.
- Patching. Enable automatic updates where possible. Patch internet-facing systems such as firewalls and VPNs quickly, and prioritize vulnerabilities in CISA's Known Exploited Vulnerabilities catalog.
- Backups. Back up important data with at least one copy offline or immutable, and test that you can restore it.
- Least privilege. Staff should use standard accounts for daily work. Keep administrator rights to the few people who need them, and use separate accounts for administration.
- Logging. Turn on audit logging in your email and cloud platforms, firewalls and servers, and keep logs long enough to investigate an incident.
- Endpoint protection. Run current endpoint protection on every computer and keep it updated.
Remove easy openings
Close remote desktop and other administrative services exposed directly to the internet. Disable accounts promptly when staff leave. Replace default passwords on network equipment and printers. Retire systems that no longer receive security updates, or isolate them if they run equipment you cannot replace yet. Each of these closes a path attackers routinely check for.
How this relates to CMMC Level 1
CMMC Level 1 applies to contractors that handle Federal Contract Information but not CUI. It is based on the basic safeguarding requirements in FAR 52.204-21, covering areas such as limiting system access to authorized users, identifying and authenticating users, sanitizing media before disposal, controlling physical access, protecting the network boundary, and keeping systems patched and protected against malicious code. Level 1 is met through an annual self-assessment and an affirmation by a senior official.
The hygiene practices above cover much of that ground, although Level 1 also expects you to document how each requirement is met. If you handle CUI, you will need a higher level based on NIST SP 800-171, and the planning should start early because the work takes time. Our CMMC readiness check is a quick way to see where you stand.
Make it someone's job
In small organizations, security often belongs to everyone and therefore to no one. Assign a named owner, even part time, with authority to make changes and a short monthly checklist: review accounts, confirm patches, check backups and look at alerts. Write down the basics of what to do and whom to call if something goes wrong, and keep it somewhere you can reach if your systems are down.
Train for the threats you will see
Short, practical training on phishing, phone scams, payment fraud and reporting suspicious activity is more useful than long annual modules. Make clear that reporting a mistake quickly is always the right choice.
Getting help
Many small suppliers rely on a managed service provider. Make sure the provider's own access is protected with MFA and limited to what it needs, and that your contract states who is responsible for patching, backups and monitoring. Free resources are also available from CISA and from programs that support the defense industrial base. When you bring in outside help, look for a clear scope, a prioritized plan and evidence you can maintain yourself after the engagement ends.
How CDT can help
CDT works with defense industrial base companies of every size, and our CMMC team helps small suppliers build a practical plan that fits their budget and the contracts they hold.
