Issue link: https://iconnect007.uberflip.com/i/1546025
24 SMT007 MAGAZINE I AUGUST 2026 Can you help us better understand the CMMC process to become certified? Our IT and compliance teams have been leading this initiative for several months alongside expe- rienced CMMC advisors. It's a significant investment, not only financially but organizationally, but one we believe is essential. We've been ITAR-registered for many years and maintain certi- fications, including AS9100 and ISO 13485. CMMC builds on that foundation by introducing a much deeper level of cyber- security governance, access control, continuous monitoring, and protection of CUI. More importantly, it changes culture. As compa- nies grow, processes that worked at $20 million don't necessarily work at $100 million. CMMC forc- es organizations to mature their cybersecurity prac- tices across technology, processes, and people, ul- timately making Omega a stronger company. For final certification, I understand you'll undergo a formal audit. Will that be with the same people who helped with your Level 2 assessment? No. The formal certification will be conducted by an accredited Certified Third-Party Assessment Orga- nization (C3PAO). Our consultants have helped us prepare for certification, but the actual assessment will be performed independently, as required by the CMMC program. What are the associated costs, and how soon will you see an ROI? Initially, we estimated the investment would be approximately $300,000. As we progressed through the assessment process, we recognized additional opportunities to strengthen our cyberse- curity infrastructure beyond the minimum require- ments. Today, we expect our total investment to approach $750,000, with roughly half representing one-time infrastructure and implementation costs and the balance consisting of recurring software subscriptions, monitoring, and compliance services. We're migrating to Microsoft GCC High, imple- menting CrowdStrike for endpoint protection, Nin- jaOne for systems management, Vanta for compli- ance automation, Abnormal AI for email security, and several additional security platforms that collectively provide the controls re- quired for CMMC Level 2. We don't view this as a tradi- tional ROI investment. We view it as a strategic investment that en- ables us to compete in markets where CMMC Level 2 certification is a prerequisite for doing business. Over time, these costs will naturally become part of the cost structure asso- ciated with serving the defense and aero- space markets. For a $100 million company, those recurring costs represent only a fraction of a percent of revenue. I agree. Our recurring cybersecurity costs are roughly double what they were previously, but in the context of a company our size, they're manage- able. More importantly, they're an investment in future growth and customer confidence. You've publicly committed to this initiative. How close are you? This is one of the most important strategic initia- tives we've undertaken in recent years. Our mili- tary and aerospace business continues to grow rapidly, and we're seeing increasing customer demand for CMMC-certified manufacturing part- ners. We've completed the assessment phase, we're executing against our remediation plan, and we're approximately 80% through our implementa- tion schedule. We're very confident we'll achieve certification on time. Are customers beginning to require CMMC? Absolutely. Virtually every new military and aero- space opportunity now includes discussions around CMMC readiness. Existing customers have also made it clear that cybersecurity maturity is an important supplier qualification. Had we not started this journey early, many of those opportunities simply would not be available to us. How does CMMC benefit customers outside the defense industry? That's one of the biggest misconceptions about Chris Alessio