Category: Insight Date: March 11, 2026 Author: Tammy Anthony Baker, CISSP
March 2026, the Trump Administration released "President Trump's Cyber Strategy for America" — a six-pillar national cybersecurity strategy. Here's an honest look at what it gets right, where it falls short, and how it compares to the CMMC compliance requirements that businesses handling government data must meet.
What the Strategy Gets Right
It acknowledges that small businesses can't fight nation-states alone. The strategy explicitly states that American citizens and companies "should not have to fend off sophisticated military, intelligence, and criminal adversaries in cyberspace alone." For years, SMBs have been expected to defend against the same threat actors that target Fortune 500 companies — with a fraction of the budget. The promise of government offensive and defensive cyber operations to address threats before they reach business networks is welcome.
Offensive cyber operations send a real message. The strategy points to real operations — disrupting scammer networks, seizing $15 billion in stolen funds, and supporting military cyber operations. When adversaries face actual consequences, it changes the risk calculus.
Critical infrastructure gets top priority. Healthcare, banking, water treatment, food supply — the strategy names the sectors Americans rely on daily. For businesses in these verticals this signals continued federal investment.
Workforce development is a priority. The cybersecurity talent shortage is real. Focusing on apprenticeships, academic partnerships, and talent retention addresses a foundational problem.
Where It Falls Short
Deregulation could undermine CMMC progress. The strategy promises to "remove burdensome, ineffective regulations." But CMMC exists because the old honor system wasn't working. Before CMMC, compliance was self-attested, and most contractors claiming compliance weren't actually meeting requirements. If "removing regulations" means weakening CMMC enforcement, we go backward.
Offense isn't a substitute for defense. The strategy leans heavily on offensive operations and deterrence. That's important, but it doesn't patch your firewall, train your employees to avoid phishing, or encrypt your CUI. CMMC's 110+ security controls exist because defense-in-depth works.
"Streamlining" compliance could create confusion. Businesses have invested years and significant money preparing for CMMC 2.0 — gap assessments, remediation, documentation. If the regulatory landscape shifts again, it creates uncertainty that slows security adoption.
It's light on specifics for SMBs. The strategy mentions small businesses, but the six pillars are heavy on government action and light on practical guidance. CMMC at least gives businesses a concrete checklist.
No mention of existing frameworks. The strategy doesn't reference CMMC, NIST CSF 2.0, or any existing compliance framework. These represent years of work and practical implementation.
CMMC 2.0: Where Things Stand
For businesses handling Controlled Unclassified Information (CUI), CMMC 2.0 remains the compliance standard that matters most:
• Level 1 (Foundational): 15 basic practices, self-assessment. For Federal Contract Information.
• Level 2 (Advanced): 110 practices aligned to NIST SP 800-171. Third-party assessment required for critical CUI.
• Level 3 (Expert): 134 practices, government-led assessment.
CMMC is being phased into DoD contracts now. If you're in the defense supply chain, compliance isn't optional.
The Bottom Line
The Trump Cyber Strategy and CMMC aren't inherently at odds. At their best, they're complementary — the national strategy addresses the threat landscape while CMMC addresses the defense baseline.
The risk is in the gap between them. If "removing regulations" translates to weakening CMMC enforcement, businesses lose the clearest cybersecurity standard they've ever had.
What smart business owners should do right now:
1. Don't slow down your CMMC preparation. Strong security practices protect your business regardless of policy shifts.
2. Watch for implementation details. The strategy is a vision document — the real impact comes in follow-on policies.
3. Invest in the basics. MFA, endpoint protection, employee training, incident response, encrypted backups.
4. Work with an MSP that understands both compliance and real-world threats.
Your business doesn't need an enterprise budget to get enterprise security. But it does need a plan built on proven frameworks, not political promises.
.png)
.png)
