# Connecticut Defense Firms Strengthen Cybersecurity

The pause in CMMC Phase II rollout does not remove defense contractors’ cybersecurity responsibilities: DFARS and NIST SP 800-171 expectations remain relevant, and prime contractors may pass requirements on to suppliers. Connecticut manufacturers, particularly smaller defense firms, are encouraged to use the pause to improve cybersecurity controls, documentation, and assessment readiness. State funding programs may help eligible defense manufacturers cover some assessment and remediation costs.

- Suppliers should review their cybersecurity controls and supporting documentation against applicable DFARS and NIST SP 800-171 expectations, and account for requirements that prime contractors may impose.
- Connecticut defense manufacturers can assess whether state funding programs may help offset eligible assessment or remediation expenses; the signal does not specify program names or application deadlines.
- For procurement teams and primes, supplier readiness remains relevant to defense supply-chain risk even while CMMC Phase II rollout is paused.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 13, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Connecticut Office of Manufacturing

### Vendors
- Sikorsky ()
- Electric Boat ()
- Pratt & Whitney ()
- Charles IT ()

### Key Quotes
> The good news this pause gives organizations a chance to slow down and be more deliberate.
> — Foster Charles, Founder & CEO of Charles IT

### Sources
- [Want to Compete for Defense Work? Don’t Wait on CMMC.](https://hartfordbusiness.com/article/want-to-compete-for-defense-work-dont-wait-on-cmmc) - Hartford Business Journal