New cybersecurity rules for the US defense sector are creating hurdles for small suppliers, with compliance costs pushing some to reconsider military contracts. The Defense Department's delayed Cybersecurity Maturity Model Certification (CMMC) program, now active, requires companies to undergo self-assessments and audits. Small suppliers, many of which also serve commercial markets, face financial strain from the added expenses, with some estimating hundreds of thousands in costs.

Industry leaders warn this could reduce competition and weaken the defense supply chain, as 88% of aerospace firms are small businesses. International suppliers also struggle to meet conflicting US and European data privacy standards, adding complexity. Executives report uncertainty about supplier compliance, with some firms delaying decisions on whether to meet the requirements.

The Defense Department has not commented on the issue.