CMMC Level 2 contract-gating is ~5 months out. SPRS scores are a False Claims Act trap. China-linked threat actors are already inside DIB networks. One breach at a Fort Worth prime cascades through 800+ TX subcontractors in 72 hours.
| Prime | Location | Programs | CUI Exposure |
|---|---|---|---|
Lockheed Martin Aeronautics Air Force Plant 4, Fort Worth |
Fort Worth, TX | F-35 JSF (primary), F-16, F-22, C-130 | EXTREME |
L3Harris Technologies Greenville, TX (ex-Aerojet facility) |
Greenville, TX | C-130 avionics, ISR payloads, classified comms | HIGH |
Raytheon Missiles & Defense (RTX) |
McKinney, TX | Patriot GEM-T, SM-6, precision fire systems | HIGH |
BAE Systems |
Austin, TX | M109A7 Paladin howitzer, electronic warfare | HIGH |
Bell Textron Hurst, TX campus |
Fort Worth area, TX | V-22 Osprey, UH-1Y, AH-1Z | MEDIUM-HIGH |
Boeing Defense |
Dallas-Fort Worth corridor | T-7 Red Hawk, F-15/F-18 sustainment | MEDIUM |
Wave 1 Prospect Profile: InterConnect Wiring (Joshua Bryant, President, Fort Worth TX) is sole Lockheed Martin F-16 electrical products licensee — one of 5 companies contracted to build wiring harnesses for the entire USAF F-16 fleet. SSLP MOU with Lockheed Martin signed 2025. Program data (wiring diagrams, config management, mission data files) = exactly what APT40 and VOLT TYPHOON target.
Verified incidents from DoJ, Maine AG disclosures, CISA advisories, and security vendor research. Sources cited in Section 10.
| # | Date | Company | Attack Vector | Data Exposed | Threat Actor | Downstream Prime Impact |
|---|---|---|---|---|---|---|
| 1 | 2024–2025 | Extant Aerospace / Symetrics Industries LLC FL; DoD programs |
Not disclosed | SSNs 3,012; defense electronics data | Unknown |
DoD military/commercial programs |
| 2 | 2013–2015 (settled July 2022) |
Aerojet Rocketdyne CA; NASA, MDA, Army, AF |
Nation-state intrusion | FCA misrepresentation of controls | China-linked (per DOJ) |
NASA, Missile Defense Agency, Army, Air Force |
| 3 | ~2023 (settled Mar 2025) |
MORSECORP Inc. MA; DoD CUI subcontracts |
NIST 800-171 gaps + unapproved cloud | Compliance misrepresentation in SPRS | Whistleblower-initiated |
DoD CUI subcontracts |
| 4 | ~2024 (settled May 2025) |
Raytheon Missiles & Defense (RTX) Patriot, SM-6 programs |
Undisclosed | Failed DoD cybersecurity obligations | Unknown |
Patriot GEM-T, SM-6 |
| 5 | 2022–2023 ($11.3M, 2023) |
Guidehouse / Nan McKay Government consulting |
Undisclosed | Failed cybersecurity requirements | Unknown |
Government consulting contracts |
| 6 | 2023–2025 | Multiple DIB companies TX/National DIB |
Fortinet FortiGate CVE exploitation | Pre-compromised network edge devices | The Gentlemen (pre-exploited FortiGate chain) |
Undisclosed TX/National DIB |
| 7 | 2023–2024 | Lockheed/Boeing/Honeywell employees Military personnel, contractor data |
Infostealer malware via pirated software, fake job postings | Military data, clearance info, geolocation ($10/computer on criminal marketplaces) |
Criminal marketplaces (RacStealer, RedLine) |
Military personnel, contractor data |
| 8 | 2024 | Unnamed DIB supply chain (VOLT TYPHOON pattern) Undisclosed |
Living-off-the-land via SOHO devices, valid account abuse | Network persistence, CUI-adjacent exfil | VOLT TYPHOON (PRC) |
Undisclosed DIB programs |
| 9 | 2024–2025 | L3Harris / associated DIB Defense comms, ISR |
Not fully disclosed | Classified-level corporate/personnel data | Unknown |
Defense comms, ISR |
| 10 | 2023–2024 | Commercial Spy Tracker breach — US Army US Army, defense contractor networks |
Commercial spyware vendor compromise | Military personnel geolocation, emails, browsing | Commercial surveillance firms (sold to state actors) |
US Army, defense contractor networks |
| Threat Category | Median Dwell Time | Source |
|---|---|---|
| DIB overall median | 26 days | Mandiant M-Trends 2025 |
| Nation-state (VOLT TYPHOON / APT40) | 18–24 months | CISA AA23-144A / Mandiant |
| Criminal RaaS (LockBit / BlackSuit) | 5–14 days before encryption | CISA / IBM X-Force 2025 |
Note: Dwell time is the median — nation-state actors have been inside some DIB networks for years before detection. The 26-day DIB median masks longer dwell in more sophisticated intrusions.
FBI Director Wray, January 31, 2024: "the defining threat of our generation." Pre-positioning in U.S. critical infrastructure for potential destructive/disruptive ops in a Taiwan/SoChinaSea conflict scenario. Uses living-off-the-land (LOLBins) — no custom malware. EDR signatures miss them entirely.
| Tactic | Technique |
|---|---|
| Initial Access | T1078.002 — Valid Accounts: Domain |
| Persistence | T1053.005 — Scheduled Task/Job: MSSQL agent jobs |
| Defense Evasion | T1064/T1059 — LOLBins: wmic, netsh, certutil |
| Discovery | T1016 — System Network Configuration Discovery |
| Collection | T1005 — Data from Local System |
| C2 | T1573.002 — Encrypted Channel: RC4 in TCP |
Attributed by Five Eyes MSS to Hainan State Security Department. Cyber-espionage mission: stealing naval/weapons design data, aerospace research, defense technology. Conducts reconnaissance of defense contractors BEFORE intrusions — researched LinkedIn, trade publications, defense conference attendee lists to identify targets.
| Tactic | Technique |
|---|---|
| Initial Access | T1566.002 — Spear Phishing: Persona Impersonation |
| Initial Access | T1190 — Exploit Public-Facing App |
| Initial Access | T1200 — Hardware Additions |
| Persistence | T1078 — Valid Accounts (on-prem + cloud) |
| Collection | T1052 — Collecting from Removable Media |
| C2 | T1090.003 — Proxy: Multi-hop Proxy |
Operation Cronos (Feb 2024) took down infrastructure — key affiliates dismantled. But affiliates rebuilt, rebranded, and LockBit remains active as of 2026. Opportunistic: targets unpatched VPNs, exposed RDP, FortiGate CVEs. TX sub-tier with no SOC is a Monday morning target.
Russian RaaS actively recruiting affiliates from ALPHV and LockBit ecosystem. Evolved from Royal ransomware with improved code. Actively targeting U.S. critical infrastructure including manufacturing and defense-adjacent sectors.
DPRK state-sponsored. Financially motivated — crypto heists fund state cyber operations. Uses supply chain compromise (trojanized software updates), fake job postings to target defense contractor employees, and shell company infiltration of DoD supply chains.
| Phase | Date Range | What Happens |
|---|---|---|
Phase 1 |
Nov 10, 2025 – Nov 9, 2026 NOW |
CMMC clauses appear in new contracts; self-assessment scores required in SPRS. Self-assessment pathway only during this phase. |
Phase 2 |
Nov 10, 2026 – Nov 9, 2027 |
Level 2 C3PAO assessment required for contracts above $10M involving CUI. Scoped assessment pathway opens. C3PAOs booked 6–9 months out. If you start today, you're scheduling for Q1 2027 at the earliest. |
Phase 3 |
Nov 10, 2027 – Oct 31, 2028 |
Full rollout — Level 2 required on all CUI contracts above $10M. |
Phase 4 |
Oct 31, 2028+ |
100% of DoD contracts with CMMC requirements. |
Texas CMMC reality: Fewer than 500 DIB companies nationwide have achieved Level 2. C3PAO reporting indicates approximately a 50% pass rate on first C3PAO assessment. Sub-tier companies starting their assessment journey today face a Nov 2026 Phase 2 deadline that has already begun.
The 72-hour clock runs continuously. Breach Friday afternoon → DC3 report due Monday morning. DFARS 252.204-7021 (CMMC clause) sits alongside 7012 — it is NOT a replacement. Both apply simultaneously.
ITAR (22 CFR Parts 120–130): Controls export of USML defense articles/technical data. ITAR-controlled data in a DoD contract = CUI under NIST 800-171/CMMC. A CMMC assessment reviews ITAR data handling controls. ITAR violations through cyber breach also trigger State Dept DDTC notification.
Microsoft GCC High is the standard environment for ITAR + CMMC L2 compliance. DoD contractors handling ITAR data need GCC High, not standard commercial GCC.
FCI (Level 1): Government information not intended for public release. 15 controls, annual self-assessment only.
CUI (Level 2): Government information requiring safeguarding per law/regulation/policy. 110 controls, C3PAO assessment required.
Warning: Every engineering drawing from Lockheed, every technical spec from a prime, every SOW with program data IS CUI. If your contract has DFARS 252.204-7012, you are handling CUI. Level 1 is not an option for defense subcontractors.
| Scenario | DoD Contract Exposure | FCA Exposure |
|---|---|---|
| No SPRS score | Ineligible to bid on CMMC contracts | N/A — no misrepresentation |
| Accurate but low score (45/110) | May lose bids; Level 2 required | No FCA — "honest score with POA&M" is the right path |
| Inflated score (claimed 95, actual 45) | Contract eligibility at risk if audit | FCA liability — treble damages + $10K+ per violation |
| C3PAO assessment failed | Cannot bid until passed | Not a false claim — failed assessment alone is not fraud |
| CEO signed CMMC affirmation with inaccurate score | Contract eligibility at risk | Personal FCA liability for executive who signed |
| Missed 72-hr DFARS report | Contract non-compliance, prime sanctions | DOJ Civil Cyber-Fraud enforcement target |
| False CMMC representations | Contract termination, debarment | DOJ criminal referral |
The Aerojet Pattern: Brian Markus, former Aerojet senior cybersecurity director, filed qui tam in 2015 after internal warnings were ignored. DOJ alleged Aerojet certified DFARS 7012/NASA FAR cybersecurity compliance while knowing controls were not implemented. No breach required. Relator share: $2.61M (29% of $9M settlement). Anyone who knows about a compliance gap and does nothing is a potential FCA relator target.
| Metric | Value | Source |
|---|---|---|
| SPRS score range | −203 to +110 | DoD SPRS |
| Required for CMMC L2 | +88 minimum (110 preferred) | 32 CFR §170 |
| Estimated unprepared sub score | −110 to −150 | Celerium DIB Strategy 2024 |
| Current DIB median | ~+32 | PTAC 2025; multiple compliance consultants |
| C3PAO pass rate (first attempt) | ~50% | C3PAO reporting 2024–2025 |
Typical score breakdown by family:
Why scores are bad: SPRS scoring misunderstood (intending vs. having), CUI boundaries misdefined, POA&Ms untracked, SSP incomplete. "Started today, you're assessing by August, implementing through December, scheduling C3PAO for Q1 2027. The November 2026 Phase 2 deadline is in the rearview mirror for anyone not already in progress."
NAVAIR solicitations already excluding contractors without current CMMC status. Raytheon already issuing L2 flow-down to sub-tier.
| Capability | Why It Matters to TX DIB Subs |
|---|---|
| SDVOSB Certified | Primes receive SDVOSB credit on subcontractor diversity scores (VSA score). CoreRecon clients help the prime's vendor sustainability assessment score — making you a more valuable subcontract. |
| C3PAO-Ready Methodology | Clients assessed against the same framework they'll face in official certification. Our assessment is not a checklist — it is the methodology C3PAOs use. No gap between "we passed the CoreRecon check" and "we passed the C3PAO." |
| 30-Minute IR SLA | DFARS 7012 requires 72-hour incident reporting to DC3. Most subs don't discover incidents for days — by then the 72-hour window is gone. CoreRecon is on the phone in 30 minutes. We manage the DC3 report while you manage the incident. |
| SPRS Score Accuracy First | We don't help inflate scores. We help get an accurate score, build the POA&M, implement controls, and get to +88 with documentation that survives C3PAO assessment. "Honest score with a documented POA&M" is the legally defensible path. |
| Gap-to-POAM Workflow | /tools/sprs-calculator → /tools/cmmc-poam-generator: "I don't know my score" to "I have a prioritized, documented remediation roadmap" in under 60 minutes. C3PAOs want evidence-backed POA&Ms, not blank templates. |