CMMC and the Great Power Competition

Since 2018, U.S. national security strategy has increasingly focused on the Great Power Competition (GPC) — a geopolitical and economic rivalry primarily between the United States, the Russian Federation, and the People’s Republic of China which spans military power, economic influence, technological advancement, and information dominance. The U.S. Department of Defense (DoD) has made it clear: the integrity and security of the Defense Industrial Base (DIB) is essential to maintaining our edge, making CMMC a substantial contributor to the Great Power Competition.

What Is the Great Power Competition?

Unlike conflicts defined by direct military engagement, the Great Power Competition is often invisible — unfolding in boardrooms, university labs, and cyberspace. At the forefront of these efforts is the race to control emerging technologies such as artificial intelligence, quantum computing, hypersonic weapons, and advanced communications. The ability to innovate faster — and to protect that innovation — is a strategic advantage.

At Triumvirate Cybersecurity, we believe the Cybersecurity Maturity Model Certification (CMMC) is one of the most practical ways the U.S. is reinforcing this. The CMMC program isn't just about compliance: it's a response to one of the most persistent and substantial threats to U.S. superiority: the systematic theft of American intellectual property (IP).

How China Has Compressed Its Development Timeline

Over the past two decades, Chinese state-sponsored cyber actors have dramatically shortened their research and development (R&D) timelines by stealing vast quantities of intellectual property and sensitive data from U.S. defense contractors. A 2020 U.S. Department of Justice indictment revealed Chinese nationals working with the Ministry of State Security (MSS) had targeted hundreds of global organizations, including many in the DIB, to obtain CUI, trade secrets, and defense designs.¹

In testimony before the U.S. Senate Armed Services Committee, senior defense officials confirmed that China's cyber-enabled theft has allowed it to reduce weapons system development timelines by years, eroding the U.S. technological edge in areas such as stealth aircraft, ship design, and missile technology.²

This theft enables China to bypass costly, time-consuming innovation cycles. The result is a narrowing technological gap that threatens the U.S.’s strategic advantage.

CMMC: Securing the DIB Against IP Theft

The DoD's Office of the Chief Information Officer has been clear that cybersecurity is a top priority, and CMMC is essential to minimizing adversaries’ ability to exfiltrate sensitive data from the DIB.³  CMMC was developed by the DoD as a response to these risks, aiming to raise the cybersecurity standard across all organizations handling sensitive defense information. It’s designed to enforce protection of CUI through a tiered model of cybersecurity maturity, validated by independent third-party assessments. The foundational controls align with NIST SP 800-171 (Rev. 2), which has been the benchmark for safeguarding CUI since DFARS 252.204-7012 went into effect in December 2017.⁴

While there has been consternation from many in the DIB regarding the cost of compliance, the DoD has deemed third-party certification necessary due to the prevalence of suppliers falsely self-attesting to compliance, which has begun to result in substantial fines & settlements under the False Claims Act.⁵

Compliance as Strategic Defense

At Triumvirate Cybersecurity, we help defense contractors achieve compliance with CMMC not only to meet contractual obligations, but to support a broader mission: protecting U.S. innovation and armed forces superiority, including soldiers on the frontlines. Cybersecurity is no longer just a technical function — it is a business necessity and a national security responsibility.

Every action to reduce risk adds a layer of protection to the DIB. Every compliant company helps reinforce the U.S. defense ecosystem, which is under constant targeting by adversaries seeking to exploit the weakest links.

The Path Forward for CMMC in the Great Power Competition

The U.S. faces a long-term strategic competition in which cyber-enabled espionage is a threat vector which cannot be ignored. The National Counterintelligence and Security Center (NCSC) emphasized that “Adversaries are aggressively collecting on U.S. critical and emerging technology and are making concerted efforts to acquire the sensitive technology, intellectual property, and proprietary information that underpins U.S. economic security” — noting the PRC as the country of greatest concern.⁶

CMMC represents a proactive, structured effort to shore up cyber vulnerabilities across the entire defense contracting community. Defense contractors — both large and small — are on the frontlines of the Great Power Competition. At Triumvirate Cybersecurity, we specialize in guiding organizations through every phase of CMMC readiness to help secure the critical data that keeps America safe and our industries competitive.

Do Your Part to Secure the DIB

Citations for Nerds

1. U.S. Department of Justice (DOJ). (2020, July 21). Two Chinese Hackers Working with the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information. https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion

2. U.S. House of Representatives Armed Services Committee. (2023, February 7). Full Committee Hearing: “The Pressing Threat of the Chinese Communist Party to U.S. National Defense”. https://armedservices.house.gov/calendar/eventsingle.aspx?EventID=3627

3. U.S. Department of Defense (DoD), Office of the Chief Information Officer. (2025). About CMMC. https://dodcio.defense.gov/cmmc/About/

4. Defense Acquisition Regulations System, U.S. Department of Defense. (2024). 48 CFR 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7012

5. King & Spalding LLP. (2025). DOJ Continues Cybersecurity False Claims Act Enforcement in New Administration. https://www.kslaw.com/news-and-insights/doj-continues-cybersecurity-false-claims-act-enforcement-in-new-administration

6. National Counterintelligence and Security Center (NCSC). (2024). National Counterintelligence Strategy 2024. https://www.dni.gov/files/NCSC/documents/features/NCSC_CI_Strategy-pages-20240730.pdf