State office explains CMMC requirements and CyberSmart grants to keep Michigan suppliers eligible for DoD work

Lansing — Retired Colonel John Gutierrez, executive director of the Office of Defense and Aerospace Innovation, and Jeanne Shabath Lewis, stakeholder engagement officer for the Office of Defense and Aerospace Innovation (ODAI), briefed the House Communications and Technology Committee on May 20 about the cybersecurity certification requirements affecting defense and aerospace suppliers.

Jeanne Shabath Lewis told the committee that the Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense program that sets cyber standards for contractors handling controlled unclassified information (CUI) and federal contract information (FCI). "CMMC helps ensure that DOD from cyber attacks by ensuring both contractors, sub contractors have adequate safeguards for sensitive information," Lewis said.

The ODAI officials explained the state's CyberSmart grant program, administered with the University of Michigan Economic Growth Institute (EGI). The grant helps small and medium defense contractors meet NIST Special Publication 800‑171 requirements and prepare for CMMC assessments. Lewis summarized the program's two phases: a gap analysis phase with prequalified managed‑service providers at a prenegotiated price of $1,500, and a remediation phase that offers up to $30,000 in shared-cost funding (75% grant; 25% company match) to address identified gaps.

Why it matters: Lewis said the DOD rulemaking process made CMMC effectively mandatory and that suppliers who lack required certification risk being excluded from future DoD contracts. She cited a nationwide estimate that 20–40% of suppliers could drop out if they do not obtain certification, creating competitive pressure for Michigan companies.

Eligibility and timing: Lewis said phase 1 applicants must be located in Michigan and have fewer than 500 employees; phase 2 applicants must be registered in SAM (System for Award Management) and have completed the phase‑1 gap analysis. Lewis noted the Code of Federal Regulations related to CMMC (32 CFR final rule effective Dec. 16, 2024) and said parallel federal procurement rules (48 CFR) were expected to appear in mid‑2025; the CyberSmart grant program in Michigan was scheduled to expire in August 2025 unless extended.

Officials said the state is investing in outreach, supplier networks and facilities to help Michigan companies compete, including coordinating industry days with the Michigan National Guard, supporting events such as the uncrewed triple challenge at Camp Grayling, and partnering with incubators and research institutions to lower barriers to classified work.

Ending: Gutierrez and Lewis said the state will publish a strategic plan later in the year and continue federal outreach; Lewis offered to provide the committee with data points on how many Michigan suppliers still need certification and to supply other program metrics on request.