State promotes CMMC compliance and CyberSmart grants; small manufacturer warns certification costs remain high

Representatives of Michigan’s Office of Defense and Aerospace Innovation (ODAI) told the House Communications and Technology Committee (date not specified) that Department of Defense cybersecurity standards will soon be enforced across the defense supply chain and that Michigan is offering CyberSmart grants to help small and medium‑sized suppliers comply.

Colonel John Gutierrez, executive director of ODAI, described the office’s mission to grow and protect Michigan’s defense and aerospace industry. Jeanne Shabath Lewis (identified in testimony as a stakeholder engagement officer) explained the Cybersecurity Maturity Model Certification (CMMC) and the state’s CyberSmart grant program, which the office has administered since 2021 in partnership with the University of Michigan Economic Growth Institute (EGI).

Shabath Lewis said the CMMC program formalizes Department of Defense cyber requirements for contractors handling controlled unclassified information (CUI) and federal contract information (FCI). “If you don’t have it, you actually cannot be playing in the Department of Defense space anymore,” she said, noting that CMMC replaces prior ad hoc practices with certified assessments and provides a competitive threshold for suppliers.

Program details presented to the committee: - Phase 1 (gap analysis): eligible Michigan businesses may contract with a prequalified managed service provider (MSP) through the EGI CyberSmart application for a pre‑negotiated gap analysis fee of $1,500. - Phase 2 (remediation cost share): grants cover up to 75% of remedial costs for an approved remediation plan, with a typical award structure described as a $30,000 cost‑share (75% grant / 25% business). Phase 2 applicants must have been a Department of Defense contractor or subcontractor within the prior year and be registered in SAM in good standing.

Shabath Lewis warned of attrition: “Because of how costly it can be, there’s an expected 20 to 40% dropout of the defense industrial base countrywide,” and the state grant program seeks to reduce that loss by helping suppliers meet NIST SP 800‑171 controls and CMMC requirements.

Regulatory timeline cited: ODAI told the committee that a final rule in the Code of Federal Regulations (32 CFR referenced in testimony) became effective Dec. 16, 2024; the implementing rule in the Federal Acquisition Regulation (48 CFR) was described as proposed and expected to appear in the third quarter of 2025. ODAI officials said the current CyberSmart grant program expires in August 2025.

A small manufacturer, Karen Arondowski, owner of IF Metal Works in Roseville, described a March cyber intrusion that affected her Comcast account and bank access and exposed her Social Security number. “They had my full Social Security number. So that became very scary to me,” she said. Arondowski told the committee she estimates about $190,000 would be needed to install required cameras and other physical and technical controls for certification at her current and potential larger facility; she said the cost could more than double her managed‑service provider costs for ongoing cybersecurity services.

Why it matters: ODAI and Michigan’s CyberSmart grants aim to keep defense suppliers in the state competitive for DOD contracts by lowering financial barriers to certification. Committee members asked for data on how many Michigan companies still need certification; ODAI said it would follow up with additional figures.

Ending: ODAI representatives said they will continue outreach—workshops, town halls and supplier support—and provide requested data to the committee about expected local impacts and potential dropout rates among Michigan suppliers.