The Department of Defense is running two major acquisition reforms simultaneously — and they pull in opposite directions.

The Cybersecurity Maturity Model Certification program, with dual rulemaking completed and requirements now embedded in actual defense contracts, adds compliance obligations to procurement. More documentation. More third-party assessments. More infrastructure investment is required before contract eligibility is established.

The Warfighting Acquisition System, announced by Defense Secretary Pete Hegseth in November 2025, moves the other way. Its purpose is to strip documentation-heavy procedures from DoD procurement and reorient around speed, competitive prototyping, and measurable operational outcomes. The stated goal: cut the timeline from requirement identification to fielded capability.

Both reforms are real, both are in motion, and they operate on the same contractor base. The practical implications fall differently depending on a company’s technical profile, program depth, and position in the supply chain. HX5, a defense and aerospace services firm supporting DoD and NASA across more than 70 locations, sits at the intersection of both pressures — a useful lens for what their convergence actually demands of contractors.

What the Warfighting Acquisition System Changes

The WAS framework reorganizes defense acquisition around Portfolio Acquisition Executives with authority to waive non-statutory technical standards, reallocate resources across programs, and replace traditional alternatives analyses — historically a months-long process — with competitive prototyping. A 180-day mandate establishes a “two-to-production” standard requiring at least two qualified sources for critical systems.

The first 31 DFARS class deviations implementing the framework took effect Feb. 1, 2026. For contractors, the operational translation is concrete: shorter proposal timelines, reduced documentation emphasis, more weight on demonstrated capability through prototyping, and performance-indexed accountability that cuts both ways. Incentives for meeting delivery timelines come alongside penalties for missing them.

Speed, Depth, and Embedded Services

Not all defense services respond to procurement speed the same way. Some contractor categories — certain IT functions, facilities services, administrative logistics — can transition between vendors with manageable disruption. HX5’s work occupies different ground.

The company delivers software and hardware engineering tied to specific weapons systems. Research and development in aeronautics and structural engineering. Test and evaluation support for specialized facilities — wind tunnels, environmental chambers, range operations. Mission operations support for programs whose continuity depends on institutional knowledge embedded in the contractor workforce.

Margarita Howard has built HX5’s operating model around program depth — understanding not just the technical requirements of a scope of work but the mission context and operational priorities of the agencies being supported.

“To best support our customers and their respective missions, it’s imperative we fully understand and comprehend the specifics of their needs and priorities,” Howard says. “Experience in their respective fields, while supporting these agencies’ respective programs and missions, is very different from experience gained from working in the commercial world.”

Faster procurement cycles produce asymmetric effects in that context. Compressed timelines can disadvantage contractors without a performance record in a domain — the runway for demonstrating capability shortens. But for incumbents with documented histories in technically embedded roles, accelerated recompetition doesn’t carry the same disruption risk. Agencies bear real transition costs when they move programs from experienced contractors to new entrants, and those costs factor into source selection even under compressed timelines.

“I knew that I didn’t want to depend on just sole-source awards,” Howard says. “We had been in the industry. We knew small businesses in our area, and many of them had never competed. Once the program was over after nine years, they were done.”

What Simultaneous Reform Pressure Reveals

CMMC and WAS together create an unusual double filter across the defense industrial base. CMMC screens for contractors who have made the security investments DoD requires — the technical architecture, documented practices, and third-party assessments demanded at each certification level. WAS screens for contractors that can demonstrate results through competitive mechanisms. Companies that genuinely meet both criteria represent a smaller subset of the contractor population than those meeting either one independently.

For a firm operating across more than 70 government sites and handling controlled unclassified information in research and development contexts, CMMC compliance is neither optional nor fast. Building toward Level 2 and Level 3 requirements demands substantial advance investment — network configurations meeting NIST 800-171 controls, trained personnel across every facility, documentation practices that will hold under third-party assessment. Howard has been making those investments ahead of the mandate.

“We try to stay ahead of changing technologies like artificial intelligence and cybersecurity,” she says.

Supplier Performance Risk System data reflects how much of the contractor base has not taken that approach. With the average score sitting 122 points below the required benchmark, a substantial share of firms will find that the cost of meeting requirements, layered on top of WAS compliance demands, exceeds the economics of staying in the market. That consolidation dynamic narrows the field competing for certain categories of federal work.

Howard’s view of where that leaves companies that have built the foundation is consistent with her longer-run reading of the market: regulatory burden has always carried a secondary function for contractors willing to bear it correctly. The cost is real. So is the differential it creates.

“We know that what we do is not easy to do, and it’s very expensive to ensure it’s done right,” she says.