Dive Brief:
- Associated Builders and Contractors has launched a free tool to help Department of Defense contractors handling federal contract information achieve Cybersecurity Maturity Model Certification, the group announced Tuesday.
- The CMMC framework, developed by the DOD, is meant to ensure contractors handling sensitive information have enhanced protection against cyberthreats through compliance with specific practices.
- The ABC’s new roadmap aims to help new contractors to understand the first steps toward certification responding to a new customer or bid requirement. More experienced contractors can use the roadmap for information on how to validate readiness before a customer review or formal assessment.
Dive Insight:
The roadmap from ABC offers a toolkit with checklists, videos and webinars to help contractors with Level 1 requirements, or self-assessment.
CMMC Level 2 requirements, or third-party assessment and certifications, were suspended in July by the DOD ahead of their planned effective date in November, a move which ABC applauded. At least one major contractor, Granite Construction, had already met that level of certification.
Still, builders should know that those Level 1 self-assessment requirements remain in place, said Josef Burkart, ABC construction technology and innovation manager.
“At the end of 2025, ABC identified that contractors need practical guidance that connects cybersecurity requirements with how construction businesses operate,” Burkart told Construction Dive via email. “We created the CMMC roadmap to help members and the industry understand their responsibilities, identify gaps and take concrete steps to protect sensitive information and compete for defense work.”
Going forward, ABC plans to continue to track federal requirements and collaborate with cybersecurity specialists, Burkart said. That will include monitoring the CMMC Level 2 pause and review period as well as any changes that may be implemented as a result.
“Through comment letters and other advocacy, ABC has consistently advocated for cybersecurity requirements that strengthen national security without creating unnecessary barriers for qualified contractors, especially small businesses that lack the cybersecurity resources of larger firms,” Burkart said.
For contractors, the world of cybersecurity is evolving. Major firms such as Turner Construction, Kiewit and AECOM reportedly faced unauthorized access into their systems this summer. Attacks on firms of all sizes have been exacerbated by the growth of artificial intelligence, which cybercriminals can use to accelerate and even automate hacks.
At the same time, Burkart said contractors can attempt to fight fire with fire by using AI in defense capabilities, but it’s also vital to maintain appropriate oversight.
“AI has increased the speed, scale and credibility of cyberattacks,” Burkart said. “For construction firms, which are often targeted in cyber supply chain attacks, companies need reliable ways to verify sensitive requests supported by employee upskilling, strong access controls and recovery planning.”
The DOD estimates the cost of Level 1 requirements for small entities to be $5,977.
