CMMC Assessor Shortage Threatens Artemis Contractor Pipeline

On April 10, Orion splashed down in the Pacific with four astronauts and a clean bill of health. The hardware worked. Artemis 2 was a success.

The collision is what nobody planned for. Seven months from now, on November 10, 2026, the same supply chain that just brought four people back from lunar orbit has to meet a cybersecurity certification deadline called CMMC, short for Cybersecurity Maturity Model Certification, that requires every defense contractor, including the machine shops and specialty manufacturers that feed NASA's lunar program, to pass a third-party audit before they can keep their contracts.

The gap between what the certification system can process and what the defense industrial base needs is not a policy dispute. It is arithmetic. Somewhere between 80,000 and 118,000 firms need Level 2 certification. There were only about 633 certified assessors worldwide as of early 2026, according to SpaceNews. C3PAO waitlists, the companies that organize and oversee certified assessors, are already over one year, Forbes reported. A Level 2 assessment takes three assessors and can run a small company more than $100,000 over three years in audit fees before they spend a dollar fixing anything, SpaceNews noted.

At the current pace, full Level 2 compliance across the defense industrial base is not projected until November 2029, according to CMMC Compliance. Each C3PAO would need to complete roughly 118 assessments per month to meet Phase 2 deadline demand, the same source calculated. A typical C3PAO does not do 118 assessments per month. November 10, 2026 is the date. The math does not work.

The credentialing bottleneck cannot be wished away. Every certified CMMC assessor must clear a Tier 3 federal background check, which takes six to eight months on average, Forbes reported. New assessors cannot be trained and deployed before the deadline. The supply is fixed.

The Government Accountability Office warned in March 2026 that the Defense Department still has not documented how it will handle that gap if private-sector capacity falls short, SpaceNews reported. That was three months ago. Nothing has changed.

For the 88% of aerospace firms that are small businesses, according to SpaceNews, the choice is stark: pay $100,000 or more for an assessment you cannot schedule, pass the cost downstream and risk losing the contract anyway, or keep working without certification and lose access to NASA and Defense Department programs when November arrives. Small manufacturers with fewer than 50 employees face an average of roughly $50,000 per employee per year in federal regulatory compliance costs, SpaceNews reported, before a CMMC assessment adds a six-figure line item.

The irony is that the one aerospace segment most likely to have CMMC documentation in order is the part that is already flying. Orion performed as designed on Artemis 2, reaching a record distance of about 252,760 miles from Earth. But the specialty manufacturers supplying components for the lunar program are the smaller vendors, the tier-two suppliers, who lack compliance infrastructure and cannot absorb six-figure audit costs on thin margins.

The Artemis program has already spent roughly $93 billion through 2025 and is projected to require $4.1 billion per SLS/Orion launch, according to the NASA inspector general. A proposed 23% cut to NASA's budget, also reported by SpaceNews, adds pressure to a program that is not cheap to run.

At stake for the lunar supply chain: NASA has already committed an initial Axiom suit task order worth $228 million for the AxEMU pressure garment, according to SpaceNews. SpaceX holds a Human Landing System award valued at $2.89 billion. Blue Origin holds a separate Blue Moon contract worth $3.4 billion. Every one of those primes depends on a subcontractor base that needs Level 2 certification to keep working. If those vendors cannot get audited before November, the primes have no supply chain.

Congress could act. Faster background checks to accelerate new assessor credentialing, federal funding to subsidize small contractor assessments, or a formal extension of the Phase 2 deadline. The first two require appropriations. The third requires DoD to admit the deadline is unachievable. None of those things has happened. The gap between 633 assessors and 80,000 firms that need them is not a compliance problem. It is a physical fact, and November 10, 2026 will arrive on schedule.