The Case for Combining CMMC and Penetration Testing
Defense manufacturers are one of the most targeted sectors in cybersecurity — and CMMC certification, while critical, doesn’t fully close the gap. In this webinar, A-LIGN’s Michael Brooks and Joseph Cortese outline why combining penetration testing and CMMC creates the strongest defense.
Defense manufacturers are a prime target
The threat landscape for defense manufacturers has shifted dramatically in recent years, and the numbers tell a clear story. The manufacturing sector saw a 300% increase in attacks last year, making it the number one ransomware target globally — accounting for roughly 30% of all attacks.
The vulnerabilities driving this are familiar: legacy OT equipment with unpatched firmware, flat networks connecting IT to production floors, and expanding attack surfaces from IT/OT convergence. A successful attack can trigger contract termination, clearance revocation, CUI exposure, and False Claims Act liability — not just a breach.
Why CMMC alone leaves gaps
CMMC verifies that controls are documented and implemented, but it’s a point-in-time exercise. It doesn’t test whether those controls hold up against a real-world attack. Penetration testing examines how an adversary could create physical, operational, or safety impacts that a compliance audit won’t surface. It’s required at Level 3 — and a smart investment at Level 2 given the value of the information being protected.
The benefits of running CMMC and pen test together
When compliance and security run on separate tracks, the result is duplicated scoping, fragmented reporting, and remediation that never ties back to the controls that matter. Running them together changes that.
CMMC already defines where CUI lives, how systems are connected, and which controls are in place. Penetration testing built on that foundation is faster to scope, more accurately targeted, and produces findings that are immediately actionable. One evidence package serves both compliance and security programs — eliminating misaligned timelines and the back-and-forth that comes with managing two separate vendors.
What effective pen testing looks like for defense manufacturers
Effective testing for the DIB covers IT, OT, web applications, and manufacturing-specific vectors — CNC machines, connected production floors, and legacy equipment that generic providers often miss. Findings should map to MITRE ATT&CK tactics relevant to defense manufacturing, simulate real adversary behavior like lateral movement from IT to OT, and come with prioritized remediation guidance tied directly to your existing controls.
Steps you can take today
If you’re evaluating your security posture, start by confirming your pen testing provider understands your OT environment and compliance obligations. If you’re pursuing or maintaining CMMC, engage a provider who can align testing directly to your certified control environment. The goal isn’t just to pass an assessment — it’s to stay protected between them.