Summit 7 Urges CMMC Compliance for Contractors

Defense firms are encouraged to adopt security standards to mitigate rising threats from Iranian hacking collectives.

Updated on Oct. 26, 2026 in Cybersecurity

Isometric editorial illustration of an industrial circuit breaker cabinet, representing cybersecurity policy and the hardening of national infrastructure. — Summit 7 is pushing defense contractors to adopt CMMC cybersecurity standards to defend industrial equipment against sophisticated state-linked cyberattacks. AI Illustration. Upload story photo >

Live Poll

Should the government mandate strict cybersecurity certifications for all companies supporting military operations?

Summit 7 executive Darron Makrokanis is urging defense contractors to adopt the Cybersecurity Maturity Model Certification (CMMC) to defend against state-linked cyber threats. This push follows reports of Iranian-affiliated hackers compromising industrial equipment across the United States.

Why it matters

The effort aims to bolster security for suppliers supporting U.S. military operations, as smaller subcontractors often lack the resources to maintain robust defenses. Enhanced compliance helps protect sensitive industrial and operational technology from foreign interference.

Summit 7 analyzed 130 distinct attack methods used by five Iranian hacking groups. They found that 68 percent of these methods can be mitigated through implementation of NIST SP 800-171 safeguards.

The players

Darron Makrokanis

He is an executive at Summit 7 who advocates for enhanced cybersecurity standards among government contractors.

Summit 7

This organization specializes in cybersecurity compliance solutions for businesses within the defense industrial base.

Department of War

This federal agency oversees national defense operations and sets the regulatory requirements for contractor security programs.

The details

Contractors are advised to shift toward continuous system monitoring and baseline configuration settings to secure operational technology. This transition is critical after Iranian hackers successfully tampered with industrial equipment, forcing some utilities in 12 states to operate their systems manually.

April 2026: Federal agencies reported Iran-linked hackers were tampering with industrial equipment.
July 13, 2026: The Department of War suspended CMMC Phase 2 requirements.
July 2026: Federal agencies updated their advisory regarding Iranian hacking activity.
Mid-August 2026: Utilities in 12 states reported incidents involving Iranian-affiliated actors.

The Tech Race

The implementation of NIST SP 800-171 remains a central benchmark for evaluating the effectiveness of security protocols in this sector. The current push for CMMC certification validates these established standards as the primary framework for mitigating evolving foreign cyber threats.

The push for tighter security standards may require defense contractors to shift from periodic reviews to real-time system monitoring. For the public, these security improvements are intended to stabilize critical utility infrastructure against remote tampering and manual operation failures.

The takeaway

Maintaining strong baseline configurations is the most effective way for organizations to neutralize a majority of known state-sponsored attack vectors. Contractors should prioritize continuous monitoring over static compliance checks to ensure operational resilience.