Written for CEOs and senior executives of small and mid-sized defense contractors, The CMMC Decision provides the strategic framework to ask the right questions, evaluate the answers, allocate resources appropriately, and lead an organization through the compliance process. The second edition reflects Phase 1 enforcement realities and the assessment landscape taking shape for Phase 2.
The requirements behind CMMC are not particularly complicated. The direction is clear, contractual implementation is advancing through phased adoption, and the costs are manageable for organizations that plan appropriately. The challenge is not the framework itself but the way the information reaches executives: buried in technical jargon, scattered across government websites, or filtered through vendors whose primary interest is selling a product rather than explaining a regulatory obligation.
The CMMC Decision is written for CEOs and senior executives of small and mid-sized defense contractors. These organizations form the backbone of the defense industrial base, yet they do not have the compliance departments or dedicated security teams that large prime contractors maintain. Their leadership needs to understand CMMC well enough to make informed decisions without becoming cybersecurity experts themselves.
The book provides the strategic framework to ask the right questions, evaluate the answers, allocate resources appropriately, and lead an organization through the compliance process. It addresses what an executive is actually signing when certifying an organization's security posture, and what that signature means in both legal and professional terms.
The second edition is written for the people who make or influence the compliance decisions inside defense contracting organizations, and for the attorneys who advise them on the contractual and legal dimensions of those decisions.
Executives, program managers, and operations leaders responsible for contract eligibility and the organizational commitment CMMC certification requires.
Government contracts attorneys advising clients on DFARS compliance obligations, supply chain risk, and the liability that flows from certification representations.
CISOs, IT directors, and security managers who will own the technical implementation and need to understand how each decision connects to the assessment outcome.
Questions about the book, or interested in how the topics it addresses apply to your organization's CMMC position? Start with a conversation.
Contact the Author →