The manufacturing sector accounted for 25.7% of all cyber incidents in 2023-2024, with ransomware involved in 71% of those attacks - and federal regulators have responded with a structured, multi-agency enforcement architecture now moving from planning to contractual obligation. Plant managers and operations directors can no longer treat operational technology (OT) security and private 5G network governance as roadmap items. Deadlines are active, audits are underway, and penalties for noncompliance are explicitly tied to contract eligibility.
This report maps the enforcement landscape, identifies which agencies are driving the push, and translates regulatory milestones into immediate actions for mid-size plants through large critical infrastructure operators.
The Multi-Agency Regulatory Architecture
No single agency owns this space. The compliance wave facing manufacturers results from coordinated action across at least four federal bodies, each with distinct jurisdiction and enforcement tools.
CISA and the CPG 2.0 Framework
On December 11, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released Cybersecurity Performance Goals 2.0 (CPG 2.0), updating its core set of recommended practices for critical infrastructure owners and operators. The goals are voluntary but carry significant weight1voluntary but carry significant weight: CPG 2.0 applies to both IT and OT environments and aligns explicitly with NIST CSF 2.0's six core functions - Identify, Protect, Detect, Respond, Recover, and the newly added Govern function. Crucially, the updated framework folds previously OT-only goals into universal goals addressing IT and OT holistically, reducing confusion for small- and medium-sized manufacturers applying one framework across their operations.
NIST and OT/5G-Specific Guidance
The National Institute of Standards and Technology (NIST) has been particularly active. NIST 800-82, the industrial security benchmark, now includes Zero Trust for OT networks and risk assessment frameworks tailored specifically for industrial control system (ICS) environments. In parallel, NIST's National Cybersecurity Center of Excellence (NCCoE) released six final publications in its "Applying 5G Cybersecurity and Privacy Capabilities" white paper series (CSWP 36A-E), providing actionable guidelines for private 5G network operators - a category that now includes manufacturers running on-premises 5G for IIoT and edge AI workloads. The series covers subscriber identity protection, hardware-enabled platform integrity, and network security design principles2network security design principles that commercial and private 5G operators are explicitly encouraged to implement.
NIST also published SP 1334, "Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments,"3"Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments," and is developing a revised CSF 2.0 Manufacturing Profile (NIST IR 8183r2) - a direct signal to factory operators that sector-specific compliance documentation is forthcoming.
DoD and CMMC 2.0: The Hardest Deadline
For manufacturers in the defense supply chain, the Cybersecurity Maturity Model Certification (CMMC) 2.0 program represents the most concrete enforcement mechanism. The CMMC acquisition rule took effect on November 10, 2025, codified under 32 CFR Part 170 and enforced through DFARS 252.204-7021, directly affecting more than 220,000 contractors and subcontractors. The program operates on a four-phase rollout:
{{component:cmmc-table}}
The average Level 2 certification timeline - from gap assessment to audit-ready - can take 12 to 24 months, meaning manufacturers targeting Phase 2 contracts must initiate remediation now. A scheduling backlog with certified third-party assessment organizations (C3PAOs) is already forming.
FCC and Network Security
The Federal Communications Commission (FCC) has been addressing network-layer threats following state-sponsored intrusions. The agency has engaged communications service providers4has engaged communications service providers to strengthen cybersecurity postures and has proposed that licensees certify the existence of cybersecurity risk management plans - a requirement that will affect manufacturers relying on carrier-managed or hybrid private 5G deployments.
What "Compliant" Actually Means for Plants
Across these frameworks, compliance is defined along several common dimensions:
- Asset visibility: Documented inventory of all OT devices, including PLCs, SCADA systems, HMIs, and IIoT nodes
- Network segmentation: Zone/conduit controls per IEC 62443 or NIST 800-82; Zero Trust Architecture (ZTA) progression tracked against CISA's Zero Trust Maturity Model v2
- Logging and monitoring: Baseline logging of configuration changes, security events, and safety events in open standard formats - a requirement now explicit in CISA's Secure by Demand procurement guidance5Secure by Demand procurement guidance for OT product selection
- Supply chain controls: Verification of CMMC status across subcontractors; FedRAMP Moderate authorization for cloud platforms handling Controlled Unclassified Information (CUI)
- Governance: Executive accountability for cyber risk, now formalized in CPG 2.0's Govern section and NIST CSF 2.0
{{component:5g-callout}}
Ripple Effects on Private 5G, Edge AI, and Procurement
Private 5G deployments on factory floors - used to enable autonomous mobile robots, machine vision, and edge AI inference - are no longer security-neutral infrastructure. NIST's CSWP 36E instructs both commercial and private 5G network operators on network security design principles6network security design principles, while the NSA's Enduring Security Framework produced a four-volume set of Security Guidance for 5G Cloud Infrastructures. CISA's Zero Trust Maturity Model7CISA's Zero Trust Maturity Model identifies four stages of ZTA maturity - Traditional, Initial, Advanced, and Optimal - and recommends operators progress through incremental stages rather than delay action in pursuit of perfect security.
For procurement teams, this translates directly into vendor contract language. The CISA/NSA/FBI joint guide "Secure by Demand" specifies that OT product procurement should prioritize vendors offering configuration management, standardized logging in baseline products, and phishing-resistant multifactor authentication (MFA) as default capabilities - not optional add-ons.
Vendors are responding. Equipment manufacturers and industrial software providers are revising product roadmaps to include documentation packages and interoperability attestations aligned with CMMC and NIST requirements. Facilities assessing new capital equipment or IIoT platforms should require compliance documentation as a standard RFP deliverable.
The False Claims Act8False Claims Act adds a legal dimension often overlooked in operational planning: the Department of Justice's Civil Cyber Fraud Initiative has already announced settlements against contractors who certified CMMC compliance without actually meeting requirements. As CMMC shifts from optional to mandatory, false certifications carry federal liability exposure for both prime contractors and their sub-tier suppliers.
Immediate Actions: A Six-Step Compliance Roadmap
Cross-functional coordination - spanning IT, OT, legal, engineering, and finance - is required to navigate this environment. The following sequence reflects the current regulatory state:
{{component:steps}}
Use This Tool to Gauge Facility Readiness
The interactive self-assessment below helps plant managers and compliance teams identify specific gaps across OT security and 5G/CMMC readiness in under three minutes.
{{widget:readiness-tool}}
The Broader Compliance Context
Manufacturers pursuing parallel paths - building CMMC compliance while modernizing OT environments and piloting private 5G - should recognize that these are not separate workstreams. The common thread across CISA CPG 2.0, NIST CSF 2.0, and CMMC 2.0 is a shift from perimeter-based, reactive security to continuous, risk-based governance with documented evidence trails. Facilities that treat compliance as an audit event rather than an operational discipline will face mounting remediation costs as each enforcement phase tightens.
For context on how industrial organizations are rebalancing cybersecurity budgets in response to these pressures, see the related analysis on how manufacturers are shifting OT cybersecurity investment and the report on systemic risks from exposed ICS/OT devices.
Key Takeaways
- CMMC Phase 2, requiring mandatory third-party C3PAO assessments for Level 2 contractors, begins November 10, 2026 - with average readiness timelines of 12-24 months, action is overdue for many facilities.
- CISA CPG 2.0 and NIST CSF 2.0 now treat IT and OT security holistically; OT-only compliance strategies are no longer sufficient.
- Private 5G networks must be incorporated into OT cyber risk assessments, incident response plans, and vendor due diligence - not treated as standalone IT infrastructure.
- The False Claims Act creates legal exposure for contractors who certify CMMC compliance without meeting requirements.
- Procurement language must flow CMMC requirements down to subcontractors and require FedRAMP-compliant cloud platforms for any systems handling CUI.
- C3PAO scheduling backlogs are already developing - facilities targeting Phase 2 contract eligibility should begin vendor selection immediately.
Frequently Asked Questions
Which manufacturers must comply with CMMC 2.0? Any organization that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of a Department of Defense contract - including prime contractors, sub-tier suppliers, and service providers supporting the Defense Industrial Base - is subject to CMMC requirements. Commercially available off-the-shelf (COTS) product vendors are currently excluded.
Are CISA's Cybersecurity Performance Goals mandatory? CPG 2.0 is formally voluntary. However, the goals inform regulatory expectations across multiple agencies and serve as reference benchmarks during audits, insurance assessments, and procurement evaluations. Alignment with CPG 2.0 also maps directly to NIST CSF 2.0, which underpins CMMC Level 2 requirements.
How does private 5G factor into OT compliance? NIST's NCCoE white paper series (CSWP 36A-E) and the NIST Risk Management Framework (RMF) apply to private 5G network operators. Manufacturers deploying private 5G for IIoT or edge AI should conduct a 5G-specific security evaluation as part of their OT cyber risk assessment and document network security design decisions against NIST CSWP 36E guidelines.
What is the penalty for noncompliance with CMMC? Noncompliance results in ineligibility for DoD contract awards. Additionally, false certification of compliance exposes organizations to liability under the False Claims Act, which the Department of Justice's Civil Cyber Fraud Initiative has actively enforced.
What is the difference between CMMC Level 2 self-assessment and C3PAO certification? During Phase 1 (through November 2025-2026), Level 2 contractors handling less sensitive CUI may self-assess. From Phase 2 onward, a certified third-party assessment organization (C3PAO) must conduct the assessment. Self-assessments will be fully phased out for Level 2 by Phase 3 in November 2027.
