IN Brief:
- Defense Unicorns CMMC combines implementation assistance, gap remediation, evidence preparation and continuing control maintenance.
- The service is designed to work with Microsoft 365, Google Workspace and hybrid IT estates, alongside contractors’ existing support providers.
- Phase II third-party assessment implementation remains paused, while applicable Phase I self-assessments and DFARS cybersecurity duties continue.
Defense Unicorns has launched a Cybersecurity Maturity Model Certification support service that combines security control implementation, compliance documentation and ongoing maintenance for companies supplying the US defence sector. The offering, called Defense Unicorns CMMC, is aimed at independent software developers, smaller subcontractors and large defence contractors that must demonstrate compliance with applicable federal cybersecurity requirements. Its scope covers preparation and continuing support; buying the service does not itself grant a CMMC certificate or replace an assessment required under a government contract.
The company will provide assistance with configuring controls, identifying deficiencies, documenting remediation and assembling evidence for an assessment. Rather than requiring a contractor to migrate all work into a dedicated new technology environment, the service is intended to operate alongside existing infrastructure and support arrangements. Defense Unicorns identifies Microsoft 365, Google Workspace and hybrid computing estates among the systems with which its specialists can work, including environments already managed by internal teams or managed service providers.
Control implementation and evidential documentation address different parts of cybersecurity assurance. A contractor may have functioning access restrictions, logging, incident procedures and protection of sensitive information, but still lack the records needed to demonstrate how those measures apply to the systems inside an assessment boundary. Conversely, a documented policy does not establish that the stated technical control has been configured and operated correctly. Defense Unicorns proposes to address both issues through practical remediation and continuously maintained assessment material.
The documentation work includes system security plans, policies, procedures, architecture diagrams, supporting records and other evidence tailored to a contractor’s environment. A system security plan needs to identify which information systems and services are within scope, how data are handled and where specific safeguards are implemented. Changes to cloud services, subcontractor access, system boundaries and operating procedures can make an earlier assessment package inaccurate unless the supporting records are revised at the same time.
The service also envisages collaboration with certified third-party assessment organisations, known as C3PAOs, where an independent assessment is required. Defense Unicorns says it can assist companies responding to assessment findings and correcting failed controls, although responsibility for the assessment and any certification decision remains separate from the service provider. The company has not published customer certification rates, average remediation times or an independently audited measure of the time saved by the new service.
Cybersecurity Maturity Model Certification links specified security requirements to US defence procurement, with the obligations for any individual contractor depending on the information handled and the terms of its contracts. NIST Special Publication 800-171 addresses the protection of controlled unclassified information in non-federal systems, while separate requirements apply to federal contract information. The existence of a CMMC support package does not mean every defence supplier faces the same control set or assessment process.
The October launch comes during a change in the programme’s implementation schedule. The rollout of Phase II third-party assessments has been paused, but the existing DFARS 252.204-7012 obligations and applicable Phase I self-assessment requirements remain in operation. Contractors therefore still need to establish which rules govern their own work rather than assuming that a delay to one assessment phase suspends all technical protection and evidence requirements. The supplier’s service is positioned around those continuing duties as well as preparation for later changes.
Maintaining cybersecurity evidence over time depends on operational records rather than a single collection exercise before an audit. Account provisioning, changes to administrator permissions, vulnerability handling, software updates and incident responses can all affect the accuracy of an earlier control assessment. Defense Unicorns is offering continuing assistance with the underlying controls and the material used to demonstrate them, with the stated intention of avoiding repeated preparation from incomplete or outdated records.
Defence procurement often places these obligations on companies working several levels below the prime contractor. An engineering subcontractor may hold drawings or other controlled information in collaboration systems, while a software supplier can store source material and access logs across development, deployment and customer support environments. Defining those systems accurately is essential before control implementation or evidence gathering can be assessed, and the company says its vendor-agnostic approach is intended to accommodate differing estates rather than impose one standard infrastructure design.
Defense Unicorns has not disclosed pricing, the number of assessment organisations participating or contracted customer numbers for the CMMC service. The practical test will be whether individual customers can demonstrate implemented controls and complete the assessments applicable to their contracts, while maintaining their records as their IT systems and information flows change. For now, the confirmed development is a new managed implementation and compliance support offer for the US defence industrial base.
