Hartford Business Journal

20 HARTFORDBUSINESS.COM | OCTOBER 19, 2026 NMLS ID: 510148 Businesses bank on us to build on their success. nwcommunitybank.com Jeff Borghesi Borghesi Building & Engineering Torrington, CT artnett Twenty2 Wallpaper Textiles Naugatuck, CT FOCUS | MANUFACTURING assistance centers. Mumford said she has spent the last seven years helping small and medium-sized Connecticut companies meet the Pentagon's cybersecurity requirements. "There's a lot to it," Mumford said. "It will involve every aspect, every depart- ment of the organization." CONNSTEP President and CEO Beatriz Gutierrez said Connecticut's concentration of defense manufac- turers makes cybersecurity assistance a priority. Large contractors often press their suppliers to demonstrate that they can meet the standards. Mumford said companies' readiness varies widely. Some are still asking basic questions about the program, while others are nearly ready for an outside audit. On the whole, many companies lack the expertise to prepare on their own, she said. Even companies with an internal IT department may need help because their employees do not have specialized cybersecurity training. CONNSTEP helps companies develop a "gap assessment" to identify weak- nesses in their computer systems, security procedures and documenta- tion. The organization can also help companies find vendors to address those shortcomings. Preparing to meet the standards can take months — or in some cases two to three years. The cost also varies widely, depending on a company's existing systems. Mumford cautioned companies against hiring service providers with little cybersecurity expertise. "Unfortunately, there's a lot of new IT companies that are jumping on this opportunity and trying to speed run them through the requirements," she said. "You cannot really speed-run creating policies and procedures and implementations." Mumford said she was not surprised by the Pentagon's decision to pause the expansion of outside audits. Her understanding is that officials are concerned about fewer small businesses bidding for defense contracts and are looking for ways to keep them involved. But companies still need to meet the underlying cybersecurity standards, she emphasized. Weighing the expense One of the companies that CONN- STEP has been working with is Farming- ton-based New England Airfoil Products, known as NEAP, which makes precision components for turbine engines used in aerospace, defense, marine and industrial applications. Founded in 1955, the company is owned by Italy-based aerospace manufacturer Pietro Rosa TBM, which acquired it in 2016. After CONNSTEP helped identify the company's security gaps and develop an action plan, NEAP hired Saji Nair, a former business information security officer with GE Vernova, to carry out the work. "When I started, there was a lot of work that was already done," Nair said. "Both our corporate organization as well as our internal leadership, they knew this is critical and they had budgeted some amount to get us to compliance." He said he expects NEAP to be ready for its audit by the second quarter of 2027. Nair said the cybersecurity work remains necessary despite the pause in the audit requirement. The company is addressing its remaining security gaps and reviewing proposals from firms that could conduct the audit. Nair said the expense of specialized software can add to the burden for small businesses. He pointed to Micro- soft's GCC High, a version of its Micro- soft 365 platform designed to support government security requirements. It can cost as much as 70% more than the commercial version. Like Mumford, Nair said he has seen businesses — including sizable organi- zations — drop military contracts rather than take on the additional expense of meeting the cybersecurity requirements. Nair said the federal government missed an opportunity to work with vetted providers to offer affordable, ready-to-use cybersecurity tools and services for smaller defense contrac- tors. Without that support, many companies have had to piece together compliance on their own or sort through a patchwork of auditors and vendors. "They just said, 'you need to follow this regulatory guidebook and meet these 110 controls,'" he said. At NE-XT, Havighorst agreed. "There's no guidance that is, 'here is your cookbook to compliance,'" he said. Still, Havighorst said he has no regrets about completing the company's audit, despite the pause in the program. "I think it's an important state- ment for our customers that we can protect their data, and I can't imagine that CMMC is going to be deferred forever," Havighorst said. "We're a fairly young company in the aero- space market, and we looked at it as a way to have a distinction. How do we start to set ourselves apart?" High Stakes Continued from page 19 DEFENSE SUPPLIER CYBERSECURITY CERTIFICATIONS Cumulative certifications under the Pentagon's Cybersecurity Maturity Model Certification program. Source: Secureframe TOTAL CERTIFICATIONS 2.5K 2K 1.5K 1K 500 0 JUL. '25 NOV. '25 MAR. '26 JUL. '26 SEP. '25 JAN. '26 MAY '26 SEP. '26 AUG. '25 DEC. '25 APR. '26 AUG. '26 OCT. '25 FEB. '26 JUN. '26

• Cover