CMMC 2.0: A strategic governance imperative for Australian defence contractors in the AUKUS era

In November 2025, the US Department of Defence (‘DoD’ / Department of War - ‘DoW’) made Cybersecurity Maturity Model Certification (‘CMMC’) 2.0 contractually enforceable across all new DoD contracts. If your organisation works in the Australian defence supply chain, this affects you directly.

Previously, Australian defence contractors relied on domestic frameworks like the Defence Industry Security Program (‘DISP’), the "Essential Eight", and the Information Security Manual (‘ISM’). These frameworks are solid, but they do not satisfy CMMC 2.0 requirements. That gap now constitutes a contractual problem and potential liability.

CMMC 2.0 has three certification levels. Most Australian contractors handling Controlled Unclassified Information (‘CUI’) fall under Level 2, which requires full compliance with all 110 security practices in NIST SP 800-171. Third-party assessments for Level 2 (‘Advanced’) become mandatory in November 2026. The window of opportunity to prepare is now.

The stakes are real. In November 2025, cyber-attacks on Australian defence contractors exposed Australian Defence Force (‘ADF’) weapons programme materials on the dark web. Thousands of emails and sensitive documents were leaked. This was not a sophisticated, unavoidable attack. Instead, it resulted from inadequate cyber security governance in a supply chain that handles sensitive national security information.

This paper makes a straightforward argument: CMMC 2.0 is not an IT compliance task. It is a board-level governance responsibility. Organisations that treat it as a technical checkbox will fail their assessments and remain exposed. Those, however, that treat it as a leadership priority will protect their contracts, their data, and Australia's broader defence obligations to the Australian people, the Australian Defence Forces and to our defence partners under defence agreements, including AUKUS.

This paper gives you a practical framework for assessing your current position against CMMC 2.0, identifying what your existing frameworks do not cover, and build a phased compliance roadmap. Whether you are a CISO, a defence industry vendor, a practitioner, or a policy maker, this paper gives you what you need to act.