Transforming Decision-Making in the Department of War: The Impact of Generative AI

Executive Summary

Generative AI (GenAI) is revolutionizing decision-making within the Department of War (DoW) by accelerating processes, enhancing analytical capabilities, and enabling data-driven insights at unprecedented speeds. Through initiatives like the AI Acceleration Strategy and tools such as COA-GPT, GenAI integrates into core military functions, from tactical planning to strategic wargaming. This whitepaper explores how GenAI transforms the Military Decision-Making Process (MDMP), highlights key applications and partnerships, addresses challenges like ethical risks and overreliance, and outlines a future where human-AI collaboration ensures decision dominance. Drawing on recent DoW strategies and expert analyses, it underscores the imperative for rapid adoption to maintain U.S. military superiority.

Introduction

The Department of War, formerly the Department of Defense, has undergone a significant reorientation under recent leadership to prioritize warfighting readiness and technological dominance. Generative AI—systems capable of creating text, images, simulations, and predictive models from vast datasets—stands at the forefront of this transformation. Unlike traditional AI, which focuses on pattern recognition, GenAI leverages large language models (LLMs) to generate novel content, simulate scenarios, and support complex decision-making. In the DoW context, this technology promises to compress decision cycles, reduce cognitive burdens on personnel, and provide asymmetric advantages in cognitive warfare, where information and perception are contested battlegrounds.

The DoW's commitment to GenAI is evident in its strategic pivots, including the establishment of the Chief Digital and Artificial Intelligence Office (CDAO) and partnerships with industry leaders like Google, OpenAI, and xAI. This whitepaper examines how GenAI is reshaping DoW decision-making, from operational tactics to enterprise workflows, while addressing the balance between innovation and risk.

The DoW's AI Acceleration Strategy

Launched on January 12, 2026, the DoW's AI Acceleration Strategy mandates an "AI-first" approach across warfighting, intelligence, and enterprise domains, aiming to secure U.S. military AI dominance. Mandated by President Trump, the strategy eliminates bureaucratic barriers, unleashes experimentation, and integrates frontier AI to enhance decision-making for over three million personnel.

Key initiatives include seven Pace-Setting Projects (PSPs) with aggressive timelines:

• Warfighting: Projects like Swarm Forge scale AI-enabled capabilities for iterative discovery, while Agent Network deploys AI agents for battle management and decision support from planning to execution. Ender's Foundry uses AI simulations to outpace adversaries in training and strategy development.
• Intelligence: Open Arsenal accelerates intelligence-to-capability pipelines, turning data into actionable weapons quickly, and Project Grant transforms deterrence strategies through dynamic, interpretable AI models.
• Enterprise: GenAI.mil provides secure access to models like Google's Gemini and xAI's Grok for personnel at Impact Level 5 (IL-5) and above, while Enterprise Agents enable rapid AI workflow transformations.

This strategy directly impacts decision-making by strengthening battlefield processes, rapidly converting intelligence data, and modernizing daily operations. It expands AI infrastructure, unlocks data access, and attracts talent through programs like the "Tech Force," fostering objective, mission-focused systems for decision superiority.

Integration into the Military Decision-Making Process

GenAI integrates deeply into the MDMP, automating and augmenting steps like course-of-action (COA) development, simulation, and evaluation to achieve faster, more accurate decisions. Traditional MDMP, rooted in Napoleonic staff structures, is evolving through AI to handle the complexities of modern warfare, including fog of war, friction, and uncertainty.

A prime example is COA-GPT, an experimental LLM-based system from the U.S. Army DEVCOM Army Research Laboratory. It analyzes inputs (e.g., mission variables, text, images) to generate COAs aligned with commander intent, adapts to feedback, simulates outcomes, and evaluates metrics like rate of advance and casualties. Benefits include reducing COA generation from hours to seconds, generating multiple options for assessment, and standardizing outputs based on doctrine, thereby shortening the OODA (Observe-Orient-Decide-Act) loop.

AI/ML also compresses planning timelines, such as generating customized operations orders (OPORDs) with real-time intelligence integration, and supports dynamic responses in contested environments, as seen in Ukraine's frontline applications. However, GenAI augments rather than replaces human judgment, emphasizing human-machine teaming (HMT) with human-in-the-loop (HITL) oversight.

Applications and Case Studies

GenAI's applications span tactical, operational, and strategic levels. In warfighting, Intelligent Decision Support Systems (IDSSs) and Aided Target Recognition (AiTR) reduce operator mental load and improve accuracy in high-risk settings. Task Force Lima, established in 2023, assesses GenAI for operations in warfighting, health, readiness, and policy, focusing on ethical implementation.

Strategically, GenAI aids scenario planning, red-teaming, and wargaming for senior officials, leveraging partnerships with companies like Anthropic and Palantir. Tools like Ask Sage, deployed in Army IL5 environments, streamline acquisition workflows by generating RFPs and strategies, saving hours. GAMECHANGER, a LLM-based search tool, enhances policy discovery and analysis, transforming administrative decision-making.

In influence activities, GenAI improves analysis, planning, and assessment, enabling efficient content production and data processing to counter adversaries like China and Russia.

Challenges and Ethical Considerations

Despite benefits, challenges include AI brittleness (e.g., overfitting to training data), opacity (black-box decisions), and exclusion of human factors like morale and ethics. Risks of overestimation lead to overconfidence, while underestimation cedes advantages to adversaries. Organizational factors—people's habits, rigid structures, processes, incentives, and leadership—hinder adoption, with three-quarters of organizations seeing no tangible benefits without adaptation.

Ethical guidelines emphasize governability, reliability, equity, and traceability. Recommendations include rigorous vetting, phased deployments, AI literacy training, and structural decentralization to foster HMT.

Future Outlook

Future developments, like COA-GPT 2.0 with probabilistic models, will incorporate uncertainty and real-time adaptation, integrating with systems like CPoF and JOCWatch. The DoW must accelerate adoption through DOTMLPF (Doctrine, Organization, Training, Materiel, Leadership, Personnel, Facilities) updates, emphasizing ethical HMT for "super-cognition." As NATO warns, failure to adapt at scale risks obsolescence.

Conclusion

Generative AI is not merely a tool but a paradigm shift for DoW decision-making, enabling faster, more informed actions across all domains. By leveraging strategies, integrations, and partnerships while mitigating risks, the DoW can achieve decision dominance and maintain global superiority. Rapid, responsible adoption is essential to outpace adversaries in an era of cognitive warfare.

From Managing Tasks to Leading Humans – Why AI Is Quietly Making Us Better Leaders

 

From Managing Tasks to Leading Humans – Why AI Is Quietly Making Us Better Leaders

For decades we’ve treated “leadership” and “management” as basically the same thing. Job descriptions mash them together. MBA programs teach them in overlapping classes. And yet… they are fundamentally different games.

Management is about things. Leadership is about people.

Management loves predictability, control, processes, KPIs, Gantt charts, and RAG status reports (red, amber, green - because traffic lights seem to run companies now). Leadership thrives on ambiguity, vision, inspiration, courage, and the messy reality of human emotions.

Peter Drucker, a well-known, Austrian American management consultant, educator, and author, whose writings contributed to the philosophical and practical foundations of modern management theory, famously said, “Management is doing things right; leadership is doing the right things.” Warren Bennis, an American scholar, organizational consultant and author, widely regarded as a pioneer of the contemporary field of Leadership Studies, put it even more bluntly: “Managers are people who do things right, and leaders are people who do the right thing.”

Up until about five years ago, most organizations needed both—but they rewarded management more. Why? Because management is measurable. You can see the budget balanced, the project delivered, the widgets shipped. Leadership, though? It’s harder to put that on a dashboard.

Then something interesting started happening. AI showed up and got ridiculously good at… management. :)

Today, AI can:

• Forecast demand better than most supply-chain veterans
• Optimize schedules, routes, and inventory in real time
• Write status reports, chase late tasks, and even send the politely passive-aggressive follow-up emails
• Detect anomalies in financials faster than any auditor
• Run A/B tests, personalize pricing, and handle 80% of customer support tickets

In other words, AI is eating the management layer for lunch. And that’s not a threat - it’s one of the greatest gifts ever handed to human leaders. Because when the repeatable, predictable, analytical work gets automated, what’s left? The deeply human work - Building trust, meaning, creativity, moral courage, empathy, inspiration. The ability to look someone in the eye (or on Zoom) and say, “I know this is hard, but here’s why it matters, and I’ve got your back.”

That stuff has always been the domain of leadership. But most of us have been too buried for too long in spreadsheets and status meetings to do it well. AI is clearing the deck.

I was talking to a manufacturing VP last month. He told me that since implementing AI-driven production scheduling and predictive maintenance, his plant managers went from spending 70% of their time firefighting parts shortages and machine downtime to 70% of their time coaching frontline teams, walking the floor, and solving problems together. He said, and I quote, “For the first time in 25 years, my managers are actually leading.” That’s the shift.

AI isn’t going to replace leaders with the time, mental bandwidth, and data clarity to focus on the things machines will never do:

• Paint a vision that makes people leap out of bed in the morning
• Navigate ethical gray zones
• Turn a group of talented individuals into a team that trusts each other in the dark
• Admit when they’re wrong and change course
• Care – genuinely. Visibly care about the people they serve

So, if you’re in any kind of leadership role today, here’s the good news and the wake-up call wrapped together - Like it or not, the job description is changing beneath your feet. The leaders who win in the next decade won’t be the ones who can manage complexity better than AI. They’ll be the ones who can connect human-to-human in a world where machines handle most of the complexity.

They’ll be the ones who get really, uncomfortably good at:

1. Radical clarity—because AI gives you perfect data, but only humans can turn data into meaning.
2. Authentic vulnerability - because people follow leaders they trust, not avatars they fear.
3. Relentless curiosity – asking, “What don’t we know?” instead of “Who’s to blame?”
4. And perhaps hardest of all - doing deep work in shallow time. Because, notifications never sleep, but relationships do if you ignore them.

So, here’s my invitation to you - Take the hours that AI is about to hand back to you and invest them in becoming a better human. Read the room, not just the dashboard. Listen to the story behind the data point. Have the hard conversation you’ve been putting off. Write the handwritten note. Ask your team, “What do you need from me to do your best work?” And, then actually do it!

The organizations that will thrive in the future won’t be the ones with the best algorithms. They’ll be the ones with the best humans - led by leaders who finally have the space to be human. AI isn’t coming for your leadership. It’s removing every excuse you ever had not to lead.

Addressing the Cost Associated with CMMC Compliance

On May 30th, I posted an article focused on Cybersecurity Maturity Model Certification (CMMC) compliance and how it can support your business goals in 2025 and beyond. I was subsequently asked a couple of questions, on and off-line, related to the cost of these initiatives. There are a few ways your organization can minimize the financial impact of CMMC compliance – Leveraging Artificial Intelligence (AI) is one of the best ways to do so.

AI can be leveraged in several strategic ways to effectively support your organization’s CMMC compliance and enhance cybersecurity practices by streamlining processes and ensuring adherence to the Department of Defense (DoD) requirements for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), ultimately providing a cost savings to your organization. Below, I’ve outlined key areas where AI can provide significant value, tailored to the CMMC framework’s three levels (Foundational, Advanced, and Expert) and aligned with NIST SP 800-171 and NIST SP 800-172 standards.

1. Automated Compliance Monitoring and Assessment

·        How AI Helps: AI-powered tools can continuously monitor your organization’s IT systems to ensure compliance with CMMC requirements, such as the 15 controls for Level 1 (aligned with FAR 52.204-21) or the 110 controls for Level 2 (aligned with NIST SP 800-171). These tools use machine learning to analyze configurations, detect deviations from required security controls, and flag non-compliance in real time.

 

·        Examples:

o   Configuration Management: AI can audit system configurations (e.g., firewalls, access controls) to ensure they meet CMMC requirements, such as access control (AC.L1-3.1.1) or system and communications protection (SC.L2-3.13.1). (https://www.wiz.io/academy/cybersecurity-maturity-model-certification-cmmc)

o   Log Analysis: AI-driven Security Information and Event Management (SIEM) systems can analyze logs to identify anomalies, ensuring compliance with incident response requirements (IR.L2-3.6.1).

 

·        Benefit: Reduces manual effort for annual self-assessments (Level 1) or triennial C3PAO assessments (Level 2), saving time and minimizing human error. For Level 3, AI can help prepare for Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) audits by identifying gaps in NIST SP 800-172 controls.

2. Threat Detection and Response

·        How AI Helps: AI excels at identifying and responding to cyber threats, which is critical for CMMC’s focus on protecting FCI and CUI from advanced persistent threats (APTs), especially at Level 3. Machine learning models can detect unusual patterns in network traffic, user behavior, or system activity that may indicate a breach or unauthorized access.

·        Examples:

o   Proactive Threat Hunting: AI can analyze historical and real-time data to identify potential APTs, supporting Level 3 requirements for enhanced security against sophisticated threats (NIST SP 800-172). (https://www.wiz.io/academy/cybersecurity-maturity-model-certification-cmmc)

o   Incident Response Automation: AI can automate initial responses to incidents, such as isolating compromised systems, aligning with CMMC’s incident reporting requirements (IR.L2-3.6.2).

 

·        Benefit: Enhances cybersecurity resilience, reduces response times, and ensures compliance with CMMC’s incident response and reporting controls, critical for maintaining certification.

3. Documentation and Policy Management

·        How AI Helps: CMMC Level 2 and above require detailed documentation, such as a System Security Plan (SSP) and Plan of Action and Milestones (POA&M). AI-powered natural language processing (NLP) tools can automate the creation, organization, and updating of these documents by extracting relevant information from system scans and compliance reports.

 

·        Examples:

o   Automated SSP Generation: AI can map system configurations to NIST SP 800-171 controls and generate draft SSPs, ensuring all required elements (e.g., system boundaries, practice implementation) are included. (https://www.boozallen.com/expertise/cybersecurity/cmmc.html)

o   POA&M Tracking: AI can prioritize remediation tasks based on risk severity and track progress, ensuring compliance with CMMC’s requirement to address control deficiencies. (https://www.crowell.com/en/insights/client-alerts/cybersecurity-matured-dod-finalizes-cybersecurity-maturity-model-certification-cmmc-program)

 

·        Benefit: Simplifies the documentation burden, ensures accuracy, and prepares organizations for C3PAO or DIBCAC assessments.

4. Training and Awareness

·        How AI Helps: To begin with, AI can help facilitate one’s general understanding of CMMC requirements and what is needed at each level of certification. In addition, CMMC requires workforce training on cybersecurity practices (AT.L2-3.2.1). AI-driven platforms can deliver personalized training modules, assess employee understanding, and identify knowledge gaps using adaptive learning algorithms.

 

·        Examples:

o   Tailored Training: AI can customize training content based on an employee’s role, ensuring compliance with awareness and training requirements.

o   Phishing Simulation: AI can simulate phishing attacks to test employee readiness and provide real-time feedback, supporting CMMC’s focus on human-centric security.

 

·        Benefit: Enhances workforce cybersecurity awareness, reducing the risk of human error, which is critical for maintaining CMMC compliance.

5. Supply Chain Risk Management

·        How AI Helps: CMMC requires prime contractors to ensure subcontractors meet appropriate cybersecurity standards (e.g., Level 2 for CUI handling). AI can analyze subcontractor systems, certifications, and compliance status to ensure alignment with CMMC requirements.

 

·        Examples:

o   Subcontractor Vetting: AI tools can scan subcontractor environments for compliance with NIST SP 800-171 controls and flag non-compliant systems. (https://www.morganlewis.com/pubs/2024/11/dod-finalizes-cybersecurity-maturity-model-certification-program-requirements)

o   Continuous Monitoring: AI can track changes in subcontractor security postures, ensuring ongoing compliance with flowdown requirements.

 

·        Benefit: Strengthens supply chain security, reducing risks of non-compliance penalties or contract ineligibility.

6. Cost-Effective Compliance Support

·        How AI Helps: Achieving CMMC compliance, especially for small and medium-sized businesses, can be costly (e.g., DoD estimates ~$104,670 for Level 2 assessment and affirmation). AI can reduce costs by automating repetitive tasks, prioritizing high-impact controls, and minimizing the need for extensive manual assessments. (https://www.summit7.us/cmmc)

 

·        Examples:

o   Gap Analysis: AI can perform automated gap assessments to identify missing controls, reducing the need for expensive external consultants. (https://securestrux.com/cybersecurity-maturity-model-certification-cmmc-services/)

o   Resource Optimization: AI can recommend cost-effective solutions, such as cloud platforms with FedRAMP Moderate authorization (required for CMMC Level 2 cloud-based solutions). (https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-cmmc)

 

·        Benefit: Lowers the financial burden of compliance, making it more accessible for smaller organizations in the Defense Industrial Base (DIB).

7. Integration with Existing Tools

·        How AI Helps: AI can integrate with existing cybersecurity tools (e.g., Microsoft Azure, Cisco Secure, or SIEM platforms) to enhance CMMC compliance. For example, Azure’s AI-driven security features can support FedRAMP High compliance, which aligns with CMMC requirements for cloud-based solutions. (https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-cmmc)

 

·        Examples:

o   Microsoft 365 and Azure: AI-driven encryption and access control features in Azure Government can support CMMC Level 2 and 3 requirements. (https://www.microsoft.com/en-us/federal/cmmc)

o   Zero Trust Implementation: AI can enforce zero-trust policies, such as continuous authentication and least privilege access, aligning with CMMC’s access control domains. (https://www.carahsoft.com/cmmc)

 

·        Benefit: Leverages existing investments in technology, reducing the need for new infrastructure while ensuring compliance.

Recommendations for Implementation

·        Start with a Gap Analysis: Use AI tools to assess your current cybersecurity posture against CMMC requirements for your target level (e.g., Level 1 for FCI, Level 2 for CUI, or Level 3 for critical programs). (https://securestrux.com/cybersecurity-maturity-model-certification-cmmc-services/)

·        Engage a C3PAO Early: For Level 2 or 3, work with a Certified Third-Party Assessor Organization (C3PAO) to validate AI-driven compliance measures. AI can help prepare for these assessments by generating required documentation and evidence. (https://www.nsf.org/management-systems/information-security/cybersecurity-maturity-model-certification)

·        Leverage Managed Security Service Providers (MSSPs): Partner with MSSPs that use AI-driven solutions to maintain continuous compliance and monitoring, especially for small businesses with limited in-house expertise. (https://www.carahsoft.com/cmmc)

·        Prepare for Phased Implementation: The DoD’s CMMC 2.0 rollout begins in 2025, with requirements appearing in contracts after the finalization of 48 CFR Part 204 (expected mid-to-late 2025). Use AI to stay ahead of deadlines by automating compliance tasks now. (https://securestrux.com/cybersecurity-maturity-model-certification-cmmc-services/)

Considerations

·        Data Sensitivity: Ensure AI tools comply with CMMC requirements themselves, especially if they process, store, or transmit FCI or CUI. Cloud-based AI solutions must meet FedRAMP Moderate standards. (https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-cmmc)

·        Cost vs. Benefit: While AI can reduce costs, initial setup may require investment in tools or expertise. Prioritize AI solutions that align with your organization’s size and CMMC level.

·        Continuous Compliance: CMMC requires annual affirmations and triennial assessments. AI’s real-time monitoring capabilities are critical for maintaining compliance over time. (https://www.nsf.org/management-systems/information-security/cybersecurity-maturity-model-certification)

Navigating CMMC in 2025: Strategies for DoD Contractors

 Navigating CMMC in 2025: Strategies for DoD Contractors

By Leslie Hubbard-Darr, Federal Contracting Growth Leader

As the Department of Defense (DoD) fully implements the Cybersecurity Maturity Model Certification (CMMC) in 2025, contractors face a pivotal moment to align their cybersecurity practices with stringent new requirements. With over $14 billion allocated to cybersecurity in the DoD’s FY25 budget, CMMC compliance is not just a regulatory hurdle—it’s a strategic opportunity to secure and grow contracts in a competitive federal landscape. Drawing on my 25+ years of experience driving over $1B in revenue for national security programs, I offer actionable strategies for DoD contractors to navigate CMMC and position themselves for growth. Now is the time to take action while the market is still figuring things out.

Understanding CMMC in 2025

CMMC 2.0, rolled out in late 2024, mandates that all DoD contractors handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) achieve certification at one of three levels: Foundational (Level 1), Advanced (Level 2), or Expert (Level 3). By 2025, CMMC compliance is a prerequisite for new DoD contract awards, with third-party assessments required for Levels 2 and 3. The stakes are high: non-compliance risks exclusion from DoD opportunities, while robust cybersecurity can differentiate contractors in a crowded market.

For small and mid-tier firms, such as those I’ve scaled in my career, CMMC presents both challenges and opportunities. Limited resources and complex requirements can strain operations, but proactive compliance can unlock access to lucrative contracts, particularly for 8(a), SDVOSB, or HUBZone-certified businesses.

Key Strategies for CMMC Success

1. Assess and Align with CMMC Requirements Early

Begin by conducting a gap analysis to evaluate your current cybersecurity posture against CMMC requirements. Level 2, which applies to most contractors handling CUI, requires alignment with NIST SP 800-171’s 110 controls. My experience leading IT modernization at T-Rex Solutions underscores the importance of early assessment. Engage a Registered Provider Organization (RPO) to map your systems, identify vulnerabilities, and prioritize remediation. Firms with a focus on cybersecurity, can leverage existing frameworks to streamline this process.

• Action: Develop a System Security Plan (SSP) and Plan of Action and Milestones (POA&M) to document compliance efforts. Allocate budget for third-party assessments, as costs can range from $20,000 to $100,000 depending on level and complexity.

2. Invest in Cybersecurity Talent and Training

CMMC compliance hinges on a skilled workforce. As a leader who has built high-performing teams for DHS and DoD programs, I’ve seen firsthand how investing in talent drives success. Train employees on CMMC practices, such as access control and incident response, and hire or partner with Certified CMMC Professionals (CCPs). Mid-tier firms, which emphasize AI and cybersecurity, can gain a competitive edge by upskilling staff to meet Level 2 or 3 requirements.

• Action: Partner with training providers like Cyber AB to certify staff. Consider outsourcing to Managed Security Service Providers (MSSPs) to augment in-house capabilities, especially for small businesses.

3. Leverage Strategic Partnerships

Collaboration is key in the federal market. My success forging partnerships at T-Rex Solutions highlights the value of teaming with CMMC-compliant primes or subcontractors. Large and mid-tier firms often collaborate with smaller firms to deliver analytics and cybersecurity solutions. Teaming with a CMMC-ready partner can accelerate compliance and enhance proposal competitiveness, particularly for 8(a) firms seeking set-aside contracts.

• Action: Identify CMMC-compliant partners through industry events like the 2025 Advance Planning Briefing to Industry (APBI) at Aberdeen Proving Ground. Use platforms like GovTribe  to research potential teaming opportunities.

4. Integrate CMMC into Business Development

CMMC compliance is a differentiator in proposals. As Executive Vice President of Business Development, I’ve led captures that won over $1B in contracts by aligning solutions with agency priorities. Incorporate your CMMC readiness into your go-to-market strategy, showcasing it in capability statements and RFPs. For firms which serve both DoD and civilian agencies, highlighting CMMC compliance signals reliability and readiness for complex contracts.

• Action: Train capture teams to articulate CMMC compliance in proposals. Emphasize measurable outcomes, such as reduced vulnerabilities or successful audits, to build client trust.

5. Navigate Budget Dynamics Proactively

The 2025 political environment, with potential budget shifts under the Trump administration, may impact DoD funding. My experience managing P&L for national security programs has taught me the importance of aligning with stable funding streams. CMMC compliance positions contractors to compete for cybersecurity-focused contracts, which remain a DoD priority. Firms with R&D expertise, can leverage CMMC to secure innovation-driven contracts.

• Action: Monitor DoD budget updates via FedBiz Access and align offerings with high-priority areas like secure communications and AI integration ($1.8B+ in FY25).

Positioning for Growth

CMMC is more than a compliance mandate—it’s a catalyst for transformation. By embedding cybersecurity into your corporate strategy, you can unlock new opportunities in the $400B+ DoD market. My career scaling small, mid-tier, and large firms demonstrates that proactive compliance, paired with strategic vision, drives sustainable growth. Whether you’re a small business or a mid-tier player, the following principles are universal:

• Lead with Expertise: Position your firm as a trusted partner by showcasing cybersecurity maturity.
• Build Resilience: Invest in scalable solutions to adapt to evolving CMMC requirements.
• Engage Stakeholders: Foster relationships with DoD decision-makers to stay ahead of policy shifts.

Conclusion

Navigating CMMC in 2025 requires a strategic blend of compliance, talent investment, and market positioning. As a leader with a proven track record in federal contracting, I’ve seen how aligning with agency priorities like cybersecurity can transform challenges into opportunities. By assessing gaps, upskilling teams, forging partnerships, and integrating CMMC into business development, DoD contractors can not only meet compliance but also drive growth in a dynamic federal landscape.

Let’s connect to discuss how your organization can leverage CMMC for competitive advantage in 2025.

About the Author: Leslie Hubbard-Darr is a federal contracting growth leader with over 25 years of experience driving over $1B in growth for DHS, DoD, and Intelligence Community programs. As Executive Vice President of Business Development at T-Rex Solutions and President/CEO of DARR International, she specializes in IT modernization, cybersecurity, and strategic growth.

A Few Thoughts as The Dust Begins to Settle

It's been a tough couple of months for us as a Nation, as a community, and for many of us, personally.  We're divided and economically challenged as a people, and in the midst of all of the chaos in the world today, we continue to have our own personal challenges - Challenges that for some seem much bigger when the world around us seems so unstable.

I for one, have experienced a great deal of loss this year - a complete upheaval, really, in both my personal and professional lives. There's been the loss of loved ones to both death and dessertion, loss of income and other resources, loss of long-time, valued alliances, and an overall loss of the "life" I had worked so hard for so many years to build for my family.  Though it has been tough... unbelievably tough at times... I'm still here.  I'm not going away, and I'm definitely not defeated.  More importantly, I'm truly happy - It could just be, actually, that I'm even happier than I've been for a very long time.

I've found that everything in life improves when I just get back to the basics - the stuff that really matters.  Jesus said, "I am the way, the truth, and the life." So, when confronted with adversity it is important to ask yourself, "What would Jesus do?"  Then, be still and listen for the answer [that's really the hardest part - we are always in such a hurry to move on]. The most important part of that question, though, is "do."  "Do" is, by the way, an action word - many people believe that they should just sit and wait for some divine intervention.  Nope.  That's definitely NOT going to happen.... without you putting one foot in front of the other, that is... taking one step at a time... always moving forward... until something is revealed.  One thing is for sure true - NOTHING good will happen for you unless you put yourself out there and engage with other humans.  That's what I had to do - that's what always works for me.  We need one another.  We were created to work together, as a unit, to care for and create a better life for one another, other living things, and the earth itself.

Regardless of your belief system, or to whom or what you place above yourself, LOVE is absolutely the answer - always trying to "do the right thing."  Of course, the "right thing" is sometimes difficult to discern, and yes "trying" is another important action word [though, my Great Grand Master would say, "there is no try, just do"]. But, most of us feel more comfortable with a less assertive "try."  Don't get too caught up on what is "right," though, that you end up "doing" nothing. Whatever you end up "doing," if your intentions are good and pure, the "right thing" just seems to sort itself out.  Love has a way of knowing your intentions, even when the actions don't illustrate them clearly.

To truly love one another, though, we have to first recognize we always have our own work to do. Lord KNOWS I do.  But, keep in mind, we will never NOT be flawed - we are humans.  But, if we were all to focus more on working on ourselves, it would go along way toward creating a perfect world.  Second, when it comes to others [over whom, by the way, we have no control] we need to fully embrace the concept, "let go and let live."  Then, we can just leave it up to God to sort out the rest.

**Do you have a related experience or thought you'd like to share?  Any thoughts as we move forward together?  Leave your comments in the space below.**

A Little Rant to Close Out a Long Week...

Ok, Guys... Let's GET REAL...
Little boys and girls have sneaked a peek through bathroom stall doors since the beginning of time... It used to be met with a stern tugging of the ear by a teacher and maybe a talk with the principal.  Over time, punishments for this childhood "crime" have gotten increasingly more harsh.

So... Now, while some children are having their parents called, meeting with school administration, and serving detention, others are strolling into the restroom of their choice, as though they belong.  How do you enforce the rules in such an environment?

If it isn't uncomfortable enough for young people to use a public restroom, we now have to [expressly]  allow children, who have not even reached adolescence (don't even get me started on that), yet have decided they "identify" with the opposite gender, make a choice which bathroom they wish to use.  What happens when they change their minds next week?

I believe we should accommodate the needs of ALL people.  My biggest concern in all of this is who is looking out for those children who are not transgender?  Does anyone care how it makes THEM "feel" when someone, who is of the opposite birth gender, is sharing the restroom with them?  Why is it always the masses that have to conform to the few, rather than the reverse?

More importantly, why is this so hard?  Why do we have to have federal mandate requiring bathroom sharing?  If there must be a mandate at all, why can it not be that one unisex and/or single stall restroom is available in each school and/or between the boy/girls for ANYONE who is uncomfortable using a public restroom and call it a day?  I'm pretty sure we already have those in most schools...

So... Why is it so hard?  Well, because it serves someone's purpose to invoke strong emotional parental protection instincts, that's why.  Clearly, this is just another play on our emotions to serve someone's grand agenda.

Something About Nothing

Since a very early age, I've been quite busy doing a whole lot of something.  Friends and family have often expressed their amazement and/or concern over my non-stop schedule.  I've reached many milestones, accomplished many goals, and have volumes of other somethings that populate the pages of my personal autobiography.  Yet, I've never felt overly tired or overwhelmed.  Recently, though, I am doing much fewer somethings than ever, yet seem almost paralyzed by them.

Actually, I've been doing a whole lot of nothing lately, and yet I seem to have absolutely no time for something.  Ok, I do eek out a something here and there.  But, the overwhelming weight of the accumulated somethings in my life is taking up space in my nothingness.  By the end of each day, I am mentally and physically exhausted by all of the nothing that has filled my day... Or, is it, that there really is something about nothing?

Previously, I just could not comprehend why people were depressed, or suffered exhaustion, or had unmanageable pain.  I always believed that "keeping busy" was the solution to all of these.  Mind you, I was always open to the fact that all of our individual experiences are relative - I mean, we are used to what we are used to, right?  I get that.  But, maybe... Just maybe, there is more.  Maybe all of these physical ailments are actually manifestations of how "nothingness" allows somethings in, and those somethings fill that nothing space with something much heavier, much more weighty, much more immobilizing than nothing.  Maybe there is something about these somethings that is different than the somethings we were so busy with before.  And, maybe, being "consumed by nothing," is really those somethings taking over the nothingness, replacing all of the lighter, happier somethings that people may refer to as frivolous, with the more overwhelming somethings that we can usually overlook.

Regardless of whether or not that theory is even worth pursuing, I am truly beginning to understand when others in my life have said they were "so busy," but have accomplished almost nothing.  Perhaps, they have so much nothing that they are so pre-occupied with somethings from the past or somethings in their imagination, and a few current somethings that they are truly not able to fit in any more somethings.  Maybe that realization is the purpose, the true something that comes out of all of my recent nothing.  Or, maybe...just, maybe my definition of "something" has changed.