🚫
Contractual stoppage
CMMC status is a condition of award, and it flows down. A key sub failing their assessment stalls your program while certified competitors target the recompete.
DFARS 252.204-7021 ↗
For DoD Primes · CMMC Flow-Down Readiness
Your next option year is decided by your weakest subcontractor.
DFARS 252.204-7021 is live in contracts today, and it flows down. If one key sub fails their CMMC assessment — or misstates their SPRS score — your program stops. Lionfish moves your entire sub-tier network into a secure enclave: 65+ controls inherited on Day 1, roughly 10 left to manage, assessment-ready in under 6 months.
000
Days
until third-party Level 2 certification becomes a condition of award — Nov 10, 2026 (32 CFR §170.3)
200,000+ DIB firms in scope (GAO)$105K–118K per L2 audit (DoW)$8.4M FCA settlement (DOJ)Certified SDVOSB
Credentialed & recognizedCertified SDVOSBCMMC Licensed Training PartnerTech Exec of the Year — IBJ honoreePatent-pending AI methodology #17941843
Threat analysis · the receipts
Your supply chain is now a legal liability. Here's the evidence.
No vendor hype — every figure links to the federal rule, GAO, or DOJ. Briefing style: three threats, scannable, sourced.
⚖️
False Claims Act exposure
DOJ's Civil Cyber-Fraud Initiative reaches the prime. Raytheon/Nightwing paid $8.4M; MORSECORP paid $4.6M. Misrepresented sub-tier SPRS scores land on your desk.
U.S. DOJ settlements ↗💸
Scope sprawl
CUI leaking onto unmanaged sub-tier laptops is the #1 driver of exploded audit scope — and audit cost. DoD projects $105K–$118K per Level 2 assessment even with clean scope.
DoW Regulatory Impact Analysis ↗
The inheritance blueprint
Don't try to secure every sub's network. Secure the data.
Your subs move their CUI work into a controlled virtual enclave. The environment carries the technical burden; they keep a manageable operational to-do list; you get verified evidence — continuously.
Without the enclave
- CUI scattered across unmanaged laptops, six tiers deep
- Every sub runs their own $100K+ compliance project — or quietly doesn't
- Self-attestations you can't verify and can't defend
- Your CISO chasing 300-page SSPs they didn't write
- One failed sub = stop-work on your program
Inside the Lionfish enclave
- CUI isolated in a controlled cloud perimeter
- Suppliers inherit the technical stack on Day 1
- Evidence captured continuously into a timestamped registry
- SSP packages generated and kept current automatically
- We sit at the table during the actual assessment
65+
Controls inherited Day 1
~10
Left for your subs to manage
<6 mo
To assessment-ready
Leadership
Led by those who defended the line.
JM
CEO · GREEN BERET (RET.)
Jeremy Miller — CEO, Lionfish Cyber Security
Disabled VeteranFormer Green BeretSDVOSBCMMC LTP
"Software doesn't pass audits; defensible evidence does. We operate on the Green Beret 'by, with, and through' model — we serve as your Virtual Compliance Vanguard, and when the assessor arrives we sit on the same side of the table as your suppliers to lead the presentation of evidence. We share your operational risk. That's the difference between buying a tool and having a vanguard."
The 30-minute operational briefing
Don't wait for a stop-work order.
Bring your flow-down list. We'll map where CUI actually lives in your supply chain, flag the quick wins, and sequence the network for verification before your next recompete window.