DoD CIO Davie Calls for Stronger Cybersecurity Across Defense Suppliers, Notes CMMC Changes Ahead

Department of Defense Chief Information Officer Kirsten Davie told attendees at the TechNet Cyber conference in Baltimore that the Pentagon’s cybersecurity posture must extend into the defense industrial base. She said a compromise at a small supplier can jeopardize a warfighter making a real-time decision and that such a possibility should make everyone in the room uncomfortable.

Davie stated that compliance does not equal security, noting the distinction held both during her time in industry and in her current role.

She called for a relentless focus on operational resilience as a byproduct of a dynamic, fit-for-purpose cybersecurity posture. The department unveiled the Cybersecurity Maturity Model Certification in 2019. CMMC is a framework that requires companies doing business with the Pentagon to achieve a base level of cybersecurity.

The program has undergone several changes since its announcement. Davie said the department is transforming its cybersecurity program into a unified, holistic, and risk-driven function with a bias for action. She announced that changes are coming to the office of the CIO in the coming months, driven by a singular focus on operationalizing programs to better serve warfighters.

Davie did not offer specifics on the planned changes. She told a small group of reporters last week that she would discuss CMMC in more detail at a later time. Davie delivered remarks at a CIO town hall at the Mark Center in Alexandria, Virginia, on Feb.

10, 2026.