Podcast Summary: "CMMC Requirements for DLA Suppliers"

Podcast: Sum IT Up: CMMC News Roundup
Host: Summit 7
Episode Date: December 25, 2025

Episode Overview

In this special holiday episode, the hosts break down the newly released estimated CMMC (Cybersecurity Maturity Model Certification) requirements for Defense Logistics Agency (DLA) suppliers. They discuss what these requirements mean by supply class, highlight the transparency and organization of DLA’s communications, and tease implications for suppliers as the CMMC landscape evolves in 2026.

Key Discussion Points & Insights

1. DLA’s Role and Impact

• DLA (Defense Logistics Agency) manages an enormous share of military logistics, buying everything from raw materials to spare parts and fuel for all U.S. military branches and partners. This means DLA’s policies on cybersecurity impact a huge number of suppliers.
  • “They manage 86% of the military spare parts. They manage a hundred percent of fuel and troop supported consumables. ...We're talking hundreds of billions of dollars, tons and tons of stuff all managed by DLA.” (01:01, Speaker A)

2. DLA’s Approach to CMMC Transparency

• DLA has published an unprecedented breakdown (by supply class) of estimated CMMC requirements, setting a standard for clarity and supplier support that other DoD components lack.
• The supply classes cover everything from food (Class 1), to clothing (Class 2), to jet fuel and chemicals (Class 3), with each class facing different CMMC expectations.
  • “They're, they're the model for how I wish the other components would put out this information.” (01:01, Speaker A)
  • “Props to DLA. This is the way that the information should be put out from everybody in the DoD.” (05:40, Speaker A)

3. CMMC Requirements by Supply Class

• DLA released estimates of CMMC levels required per supply class. The requirements are not monolithic—they’re determined by the nature of the supply and risk associated with the data.
  • “Depending on what type of work you do for DLA, this might be a good gift. Might be coal in your stocking.” (01:01, Speaker A)

Supply Class Breakdown (09:45)

• Class 1 (Food & Water):

  • 95% require Level 2 self-assessment
  • 5% require Level 2 C3PAO certification
  • 0% require Level 1
  • “If you're a class one vendor... everyone's going to need level two, you might be able to self assess, but ain't nobody getting level one, which I find very interesting.” (09:45, Speaker A)

• Class 2 (Clothing, Tools):

  • 70% require Level 2 self-assessment
  • 30% require Level 2 C3PAO certification
  • 0% require Level 1
  • Noted that certain textiles (e.g., special forces uniforms) can be controlled.
  • “Some of the high-speed clothing... like the type of Velcro they have can be classified.” (12:08, Speaker A)

• Class 3 (Fuels, Chemicals):

  • 95% Level 1
  • 4% Level 2 (self-assessment/certification)
  • 1% Level 3
  • “Your experience even within a specific class is going to be wildly different... might as well be on different planets of cybersecurity and compliance obligations.” (13:13, Speaker A)

• Service Contracts (Medical/Transport/Logistics):

  • 1% Level 1
  • 12% Level 2 self-assessment
  • 73% Level 2 C3PAO
  • 10% Level 3 (a notably high portion for advanced security needs)
  • “To me, more than anything else, more than the lack of level one, was the amount of service contracts expected to require Level 3 CMMC status.” (17:46, Speaker A)

Memorable Quote:
"Chicken nuggets in the chow hall are definitely going to be controlled for sure. If you know, you know."
– Speaker A, (16:43)

4. Understanding CMMC Application

• CMMC compliance is deeply context-dependent. Not every supplier is subject to the same risk or requirements.

  • “CMMC is not monolithic. It is not the same across every agency, every program, every contractor. It is impossible to predict individual situations from overall CMMC policy." (19:01, Speaker A)

• Only 2 of 7 classes mention Level 1 is required—Level 2 (especially self-assessment) is much more commonly required, which surprised the hosts.

  • “My takeaway was that's not a lot of level one requirement, which is what I thought a majority of DLA procurements were going to be.” (15:11, Speaker A)

5. Importance of Supplier-Specific Preparation

• Advice for suppliers: Go to your customer (e.g., DLA) and check the specific requirements for your supply class, as this will directly affect your certification needs.
  • “Depending on the type of work you do, you could be experiencing CMMC in a very different way than your colleagues who work in other types of supply classes.” (18:23, Speaker A)
  • “Preparation is the best prevention, right? Like, you need to be prepared. There's no other excuse for it.” (19:41, Speaker B)

6. Predicting CMMC Level 3 Adoption (Teaser)

• The hosts anticipate that Level 3 requirements will appear earlier and more often than currently advertised in the phased rollout, especially within service contracts.
  • "We think that CMMC Level 3 is going to show up a lot earlier than the phased rollout says that it might. So be sure to tune in for that." (18:23, Speaker A)

Notable Quotes & Memorable Moments

• DLA’s transparency praised:
  “DLA is over here, like boom, boom, boom. Details, training breakdown, details. Here's what we think, here's our expectation, here's timelines, bang, bang, bang, bang, bang, all in one spot.” (07:49, Speaker A)

• On unexpected Level 2 dominance:
  "If you think you don't have to deal with level two, you're probably wrong..." (11:22, Speaker A)

• On context of “controlled” items:
  “Chicken nuggets in the chow hall are definitely going to be controlled for sure.” (16:43, Speaker A)

• On why CMMC policies are not one-size-fits-all:
  "It is not the same across every agency, every program, every contractor. It is impossible to predict individual situations from overall CMMC policy." (19:01, Speaker A)

Timestamps for Key Segments

• [01:01] – Introduction to DLA and its critical role
• [05:16] – How supply classes affect CMMC risk and requirements
• [07:21] – Praise for DLA’s supplier info page
• [09:45] – Supply class breakdown (starting with Class 1)
• [11:22] – Debrief on level requirements for Class 1 & 2
• [13:13] – Insights on Class 3 and diversity of requirements
• [16:43] – Service contracts and the surprising Level 3 estimate
• [19:01] – Main takeaway: CMMC is not monolithic
• [19:41] – The best advice: supplier-specific preparation

Summary Takeaways

• DLA’s supply class-based breakdown is a holiday “gift” for suppliers: Clear, practical, and detailed.
• Requirements are far from uniform: Suppliers in the same agency face very different obligations, even within the same broad category.
• Level 2 self-assessment is the most common requirement, not Level 1 as many expected.
• Early action is key: Understanding your own class and contract obligations ensures you’re prepared as CMMC matures and enforcement tightens.
• Resource tip: The hosts strongly recommend that DLA suppliers visit the DLA’s cybersecurity resource page for accurate guidance.