How should a seller inventory cyber clauses without inventing a level?
Shops that only touch commercial work can stop after the inventory shows no clause. Shops that touch a single spare contract cannot. Aerospace and defense files should assume the inventory takes a week, not a coffee.
Deloitte and the Manufacturing Institute estimated as many as 3.8 million manufacturing employees needed from 2024–2033 (Source: Deloitte/MI). Hiring a night-shift programmer does not create a system-security plan. Access is a cyber fact and sometimes an ITAR deemed-export fact in the same badge.
What artifacts belong in a staged room?
System-security plans, SPRS scores, plans of action and milestones, incident-response records, and assessor correspondence belong behind a tighter gate than the ordinary financial room. See NDA and staged disclosure. A competitor who wants your network diagram is not a buyer.
| Artifact | Why a buyer asks | Stage it? | Who interprets |
|---|---|---|---|
| Clause / CMMC inventory | To know the required level on live vehicles | After NDA, before diagrams | Gov-con counsel |
| SPRS score / assessment | To test whether the score is real | Staged | CMMC consultant |
| System-security plan | To see scope and gaps | Tight circle | Consultant + counsel |
| POA&M | To price the cure | Tight circle | Consultant |
| Incident log | To price history | Tight circle | Counsel |
A false score is a price and an indemnity problem. A missing plan is a calendar problem. Calendars can close. False scores poison closes.
How do novation and set-asides collide with cyber?
FAR 42.12 can recognize a successor who cannot perform the cyber clause. Set-aside loss can kill the vehicle even when the cyber program is beautiful. Stack the three analyses. A buyer who can pass an assessment and cannot wear the badge still loses the book.
Do not let a cyber consultant be the only advisor on a federal manufacturer. They will optimize the SSP while the novation dies.
What should a commercial acquirer budget if they want the DoD slice?
Budget time, a consultant, tooling, and a responsible official who will live with the program after the seller leaves. Budget the possibility that the slice is not worth the program. Some commercial strategics should buy the commercial remainder and leave the DoD work. That is a valuation choice, not a failure of patriotism.
What does a job shop with one DFARS clause look like in diligence?
A 30-person shop has 12 percent of sales on a prime's flow-down with a DFARS cyber clause. The owner thinks CMMC is "that Level 2 thing everyone needs." Counsel reads the vehicle and says the required posture is specific to that contract and the current program rule, not a podcast. The SSP is a 2019 Word file. The SPRS score was self-attested by a nephew.
The buyer can still close if they price a real program and if the 12 percent is not the profit. If the 12 percent is the profit, the file is a cyber-and-novation file, not a Main Street SDE story. HedgeStone will not let the CIM blur those.
Jason Taken is a business broker. He does not assess CMMC levels or file SPRS scores. Verify the current required level on each vehicle with a qualified consultant and counsel. Educational information only. Data current as of September 2026.
A cyber diligence week that does not leak the network map
Monday. Inventory clauses. No diagrams yet. If the inventory is empty, write a one-line memo and stop spending. If it is not empty, hire the consultant before the plant tour.
Tuesday. Interview the person who actually patches the ERP and the shop-floor PCs. If that person is a contractor who leaves at close, the program leaves too.
Wednesday. Review SPRS and POA&M in a tight room. Compare the POA&M dates to reality. Expired plans of action are findings, not décor.
Thursday. Map foreign remote access and any shared passwords on the CNC controls. That sentence is both cyber and export. Split the memos but share the facts.
Friday. Price the cure as a dollar number and a months number. Put both in the LOI. A hope to get certified later is not a working-capital peg.
The next Monday. Decide whether the DoD slice is in the deal. If yes, the transition plan includes the empowered cyber official. If no, carve the slice before you argue about inventory counts.
How should lenders and QoE teams treat a cyber gap?
Lenders who already ask for three years of financials, a machine list, and a Phase I will also ask, on DoD files, whether the buyer can perform the clause after close. They will not accept a verbal "we are working on CMMC." See how lenders underwrite manufacturers. A QoE that treats cyber spend as a one-time non-recurring cost while the POA&M shows years of open items is a recast fight. Ongoing program cost is operating expense. Catch-up cost can be a purchase-price adjustment. Mix them and both sides lose trust.
Search-fund buyers who have never run a controlled network will under-estimate the responsible official's time. Stanford's 2026 median search-fund purchase is a 25 percent margin, roughly $2.5 million EBITDA company (Source: Stanford GSB). That median company may have an IT person. A 22-person shop with a nephew-admin does not. Do not borrow the Stanford staffing model.
If representation-and-warranty insurance is in play, cyber and government-contracts exclusions are the first pages to read. See escrow, indemnity, and R&W. A policy that excludes the exact clause that scares you is decoration.
Sellers preparing to market a DoD-touched plant should commission a gap assessment before teasers, not after the first bidder asks. A priced gap is a negotiation. An unpriced gap is a walk. The assessment stays in the staged room. It does not go in the teaser.
Incident history deserves the same honesty as environmental RECs. A 2024 ransomware event that hit the ERP is not "IT drama." It is a customer-notice and a clause-notice event if covered defense information was involved. Put the timeline in the room. Buyers price known incidents. They punish surprise.
What does "flow-down" mean when the seller is a sub, not a prime?
Most manufacturers who touch DoD work are subcontractors. The prime's flow-down can be stricter, sloppier, or simply older than the current program rule. Counsel reads the subcontract, not a CMMC marketing one-pager. If the prime requires an assessment the current regulation would not require on a different vehicle, the subcontract still governs that relationship. You cannot novate your way out of a prime who will cut you for non-performance.
Ask whether the seller has been through a prime's cyber audit. Ask for the last finding list. Prime findings are often harsher and more current than a self-attestation. They are also how a customer already knows the plant is in play if you are careless with who you ask.
A buyer who plans to keep the prime should budget a joint call after exclusivity, not a cold email from a broker. HedgeStone will not introduce a prime to a rumor. We will introduce counsel to counsel when the process says the time is right.
Which misconceptions waste the third week of exclusivity?
The first misconception is that a CMMC certificate is a sticker you peel off the seller and press onto the buyer. Assessments attach to organizations, scopes, and dates. A new entity, a new data-center, or a new ERP can reopen the scope. The second misconception is that commercial cyber insurance equals clause performance. Insurance pays some losses. It does not make a contracting officer treat you as compliant. The third misconception is that air-gapping the CNC controllers solves the SSP. Controllers that never touch CUI may still sit on a network that does. Scope is a diagram, not a slogan.
The fourth misconception is that a small percentage of DoD sales makes the clause optional. Flow-downs do not contain a de minimis fairy. Either the clause applies to the covered information you handle or it does not. Volume is not the test. The fifth misconception is that the seller's nephew can remain the virtual CISO on a handshake. If that person is the program, write a contract, a retention bonus, and a successor. Transition and owner training should include the cyber official when the book depends on the clause.
Census CBP's 284,452 establishments (Source: Census CBP) include thousands of shops that will never see a DFARS cyber clause. The ones that will cannot borrow a process written for a cabinet plant. Write the inventory. Then spend money. Not the other way around.
A last practical rule: if the buyer wants to move the ERP to their platform in month one, reopen the scope conversation before you celebrate integration. New systems are new assessments. The transition plan and the cyber plan are the same calendar. Write that sentence into the integration plan the sponsor brought to the first call, or admit the DoD slice will pause while the new ERP is in scope. Pausing DoD work is a customer conversation. It is not a footnote in a synergy model. Put the pause, or the decision not to pause, in the LOI so no one pretends surprise in month two.