Hartford Business Journal

HARTFORDBUSINESS.COM | OCTOBER 19, 2026 19 FOCUS | MANUFACTURING High Stakes CT manufacturing suppliers face costly cybersecurity rules to keep defense business Richard Havighorst, chief operating officer of Windsor-based NE-XT Technologies, said the company spent about $200,000 preparing for an independent cybersecurity audit to earn Pentagon certification. HBJ Photo | Steve Laschever By Harriet Jones hjones@hartfordbusiness.com A Windsor manufacturer spent 18 months and about $200,000 upgrading its cybersecurity to protect sensitive military informa- tion — an investment the company expected would help it remain eligible for defense work. NE-XT Technologies, a 60-employee precision machining shop that gener- ates most of its revenue from aero- space contracts, upgraded its hardware and software, overhauled internal procedures and trained employees to handle sensitive documents. The effort was part of a Pentagon program called Cybersecurity Maturity Model Certification, or CMMC. The program assesses whether defense suppliers can protect information such as military blueprints and engineering specifications from hackers and unauthorized access. Earning certification required NE-XT to pass an independent audit verifying that its security practices met the Penta- gon's standards. The Pentagon had planned to make those audits mandatory for defense suppliers beginning Nov. 10. For businesses, the stakes extend beyond preventing a data breach. Meeting the requirements can deter- mine whether they qualify for military contracts, including work they receive through larger defense companies. But preparing for certification can require significant spending and changes throughout a company. "We had to educate our entire work- force," said NE-XT Chief Operating Officer Richard Havighorst. NE-XT passed its independent audit on July 13, but the program's strict require- ments made for an anxious wait. "We were biting our nails up to the last minute," Havighorst said. The good news arrived at 1 p.m. "One o'clock, we were cheering in the aisles, super excited," Havighorst said. "And at 3 o'clock we were like — oh." Just hours after the company cele- brated, the Pentagon announced it was putting that planned audit requirement on hold. Federal officials cited concerns that compliance costs were driving busi- nesses out of the defense supply chain. The rarity of NE-XT's achievement may help explain the pause. Of more than 100,000 companies in the mili- tary's supply chain nationwide, only about 2,300 have successfully passed independent cybersecurity audits, according to Secureframe, an online platform that's tracking the certification program's progress. For companies still preparing for an audit, the pause offers breathing room, but it does not lift their responsibility to protect sensitive information, experts said. Connecticut companies are still working to strengthen their cybersecu- rity, even as the future of the certifica- tion program remains uncertain. Security obligations remain The Pentagon has required suppliers to safeguard sensitive information for years. The certification program was intended to provide greater assur- ance that companies were following those rules. Its first phase began in November 2025, requiring companies covered by applicable contracts to self-certify that they met the standards. The planned second phase would have taken verification a step further, requiring suppliers to have independent auditors confirm that their security practices met those standards. The requirements reach beyond large contractors such as Sikorsky, Pratt & Whitney and Electric Boat to smaller businesses that supply them. To earn certification, NE-XT had to demonstrate that it met 110 cybersecu- rity requirements, known as controls. Of those, 65 are considered critical by the Pentagon — missing even one can mean failing the audit and having to fix the problem before trying again. The Pentagon's requirements include restricting access to sensitive infor- mation to authorized users, requiring multiple forms of identity verification for certain computer logins and monitoring systems and network traffic for signs of cyberattacks. It even means teaching employees how to secure paper documents, not just computer files. "If you print this out, well, you can't just leave it on your desk — it needs to get secured," Havighorst said. "Or, if you have the drawing at the machine, it can't just be sitting at the machine if nobody's there. It needs to be secured." Anna Mumford is a cybersecurity consultant at CONNSTEP, a nonprofit that helps Connecticut manufacturers improve their operations and meet industry requirements. Funded by the federal and state governments, it is part of a national network of manufacturing Continued on next page

• Cover