In contrast, defense leaders see themselves as offering lucrative contracts with reasonable sets of security requirements for winning the work, which can range from the acquisition of military weapons systems and basic IT tools to mowing grass at military bases.<\/p>\n\n\n\n
But after years of suppliers with weak cybersecurity tormenting the department, it\u2019s now Arrington\u2019s job to find a solution. The conventional wisdom among defense officials is that cybersecurity problems can\u2019t be solved \u2014 they can only be mitigated.<\/p>\n\n\n\n
\u201cSupply chain security is an insurmountably hard problem,\u201d said fellow panelist Bruce Schneier, the Harvard lecturer and well-known technology guru.<\/p>\n\n\n\n
So Arrington flies all over the country, speaking to room after room of defense contractors and trying to convince them, somehow, that they must impose tighter cybersecurity controls. And if they don\u2019t? The Pentagon could lose out on state-of-the-art technology to protect national security secrets.<\/p>\n\n\n\n
And if industry doesn\u2019t care about that? Then businesses will lose out on profitable DoD contracts.<\/p>\n\n\n\n
The underdog<\/b><\/p>\n\n\n\n
Arrington has spent much of the last two and a half years shuffling in and out of rooms, working to persuade audiences she can solve pressing community problems. In 2018, it was a different cause: politics.<\/p>\n\n\n\n
Her problem then was Rep. Mark Sanford. Sanford, she said, spent too much time on cable news fighting with President Donald Trump and not enough time on local issues. So Arrington challenged him in a Republican primary.<\/p>\n\n\n\n
Sanford, the former South Carolina governor of \u201chiking the Appalachian Trail\u201d fame<\/a>, had never lost an election. But Arrington, endorsed by the president<\/a>, pulled off the unexpected, knocking off the political powerhouse by about 2,500 votes and adding her name to South Carolina political folklore.<\/p>\n\n\n\n \u201cIf somebody tells her she can\u2019t do something, she ignores that,\u201d said Andrew Boucher, a consultant for Arrington\u2019s congressional campaign. \u201cShe ignores the naysayers.\u201d<\/p>\n\n\n\n Now, Arrington, 49, is leading a robust overhaul of the Pentagon\u2019s cybersecurity requirements for contractors, known as the Cybersecurity Maturity Model Certification, or CMMC. The department is pushing the reform at a breakneck pace, at least as far as Defense Department reforms go. Her team has issued several drafts and the final standards in the past year.<\/p>\n\n\n\n \u201cShe\u2019s got lightning in her veins,\u201d said retired Adm. James Stavridis, the former supreme allied commander of NATO and a member of the board of directors for PreVeil, an email encryption company. \u201cShe\u2019s smart, and she\u2019s smart enough to know she doesn\u2019t know everything.\u201d<\/p>\n\n\n\n That lightning kept CMMC on pace for its final standards rollout in January, an aggressive timeline that one trade association representative characterized as a \u201cherculean effort.\u201d This summer, CMMC is scheduled to be included in requests for information for upcoming Pentagon contracts.<\/p>\n\n\n\n If all goes according to plan, CMMC would mitigate several cybersecurity issues that plague the DoD supply chain, and the government would have a mechanism to verify contractors\u2019 cybersecurity claims. The guidance recognizes that security differs from business to business while allowing the government insight into companies\u2019 cyber posture before awarding contracts.<\/p>\n\n\n\n The problem now is a system where companies can self-assess their cyber defenses. Arrington describes it this way:<\/p>\n\n\n\n \u201cEverybody thinks when they walk out of the room in the morning, when they walk away from the mirror, they look great, [but] when you put the mirror up and you say, \u2018Yeah, nope\u2019 \u2014 you didn\u2019t draw your eyebrows on right today.\u201d<\/p>\n\n\n\n Through these changes, the department has to retain a fair and competitive acquisition process. It\u2019s a massive overhaul that needs a charismatic and competent leader to succeed, said David Berteau, president and CEO of the Professional Services Council, a trade organization that represents more than 400 government contractors.<\/p>\n\n\n\n \u201cVery little important change gets done without a vocal, capable champion present all the way through,\u201d he said.<\/p>\n\n\n\n That\u2019s Arrington.<\/p>\n\n\n\n Experts estimate that China steals hundreds of billions of dollars worth of American intellectual property annually, including military technology. The federal government\u2019s concern with Huawei<\/a> is that its presence could allow<\/a> the Chinese government to access the feds\u2019 data<\/a>. Chinese actors have continuously breached Navy contractors, as the Wall Street Journal reported in 2018<\/a>. In addition, China accounts for 90 percent of the U.S. Justice Department\u2019s economic espionage cases as well as two-thirds of its trade secrets cases, according to a 2019 Congressional Research Service report.<\/p>\n\n\n\n Pentagon officials see the success of CMMC as critical \u201cbecause of the ongoing and escalating threat of cybersecurity challenges,\u201d said Berteau, who also worked for six defense secretaries. \u201cIt has real consequences for America, above and beyond the consequences for a particular contract or a particular program.\u201d<\/p>\n\n\n\n But leaders in the defense industry still have questions. Company executives wonder what level of certification they will need, a centerpiece of CMMC that will affect competitiveness. Business leaders also don\u2019t know when they need to get the certifications. Others still have questions about reimbursement for \u201callowable costs\u201d for compliance, or don\u2019t understand how subcontractors can recover compliance costs, if at all.<\/p>\n\n\n\n Though some industry members have criticized the Pentagon for the rapid speed at which CMMC has proceeded, others acknowledge it is years overdue. For each day CMMC isn\u2019t part of solicitations, the Defense Department is losing out on implementing tighter cybersecurity controls until contracts expire, the argument goes. And Arrington is quick to mention the standards need to be in RFPs this fall.<\/p>\n\n\n\n \u201cOur adversaries \u2026 their whole job is to have us not exist. The easiest way to do that has been through our supply chain,\u201d she said on a January podcast. \u201cIt\u2019s the easiest way to get access to us.\u201d<\/p>\n\n\n\n \u2018Everybody has a superpower\u2019<\/b><\/p>\n\n\n\n Tensions rise on the RSA Conference panel after Arrington explains why the Defense Department must stay away from risky technology that may allow access into DoD networks through backdoors.<\/p>\n\n\n\n Why, she questions, would the federal government use hardware made by a company with close ties to the Chinese government \u2014 the same government that\u2019s plotting economic domination, trampling over human rights and looking to spread communism?<\/p>\n\n\n\n But isn\u2019t it true there are several other countries that can install backdoors and launch virtual attacks, responds Huawei\u2019s Andy Purdy, implying the United States has that capability as well?<\/p>\n\n\n\n \u201cThat\u2019s ridiculous!\u201d Arrington says, with her arms outstretched to her sides. \u201cThe bottom line is we\u2019re a democracy, we\u2019re different!\u201d<\/p>\n\n\n\n In the last 18 months, Arrington\u2019s earned a reputation for her candor with the defense-industrial base, a community of vendors accustomed to dry presentations on programs from other senior DoD officials. She responds to criticism on LinkedIn. She\u2019s direct with contractors, once telling them to chant: \u201cWe all are going to get breached.<\/a>\u201d Then there\u2019s the origin story of the acronym that became shorthand for her program.<\/p>\n\n\n\n \u201cIt was a glass of wine on a Friday night, and that\u2019s how you got \u2018C-M-M-C,\u2019 \u201d Arrington jokingly said Jan. 28 at the law firm Holland and Knight. \u201cReally, unique, huh? Yeah, I went cray-cray on the acronym.\u201d<\/p>\n\n\n\n But joking aside, Arrington knows the government contracting process can be cumbersome. She reminds audiences that she came up in industry and understands.<\/p>\n\n\n\n \u201cLadies and gentlemen, we\u2019re a \u2018we,\u2019 \u201d Arrington said in June last year, as if it were an applause line on the campaign trail.<\/p>\n\n\n\n Her approach, she said, is part of a paradigm shift that defense contractors must adopt. Accepting there\u2019s a risk of a breach will lead to stronger cyber defenses. To get this done will require a web of industry relationships. Arrington knows this. \u201cEverybody has a superpower,\u201d she said in an interview, and hers is collaboration.<\/p>\n\n\n\n Sources in industry agreed, telling C4ISRNET that Arrington and her team\u2019s success thus far is due to their engagement with small businesses, prime contractors and trade associations.<\/p>\n\n\n\n \u201cIt\u2019s collaboration! That\u2019s what the human condition is about. What we can do together is far more impactful than what we\u2019ll ever do on our own,\u201d Arrington said.<\/p>\n\n\n\n Driven to serve<\/b><\/p>\n\n\n\n Twenty-eight minutes into the RSA session, the prickly nature of the panel prompts the moderator to quip: \u201cI\u2019m glad we\u2019re at least expressing how we feel here.\u201d<\/p>\n\n\n\n Huawei\u2019s Purdy is passionately arguing that all bad technology should be removed from the supply chain, when Arrington cuts him off. He shuts his eyes momentarily and takes a deep breath.<\/p>\n\n\n\n She continues until Harvard\u2019s Schneier says that \u201c5G\u2019s lost, and our only hope now is to try to secure 6G.\u201d He then adds: \u201cI\u2019m rooting for you, but I\u2019m not optimistic.\u201d<\/p>\n\n\n\n Arrington \u2014 again finding herself on the defensive \u2014 interrupts the moderator to pointedly ask Schneier who he\u2019s really rooting for. He responds by saying he hopes Arrington can build a Huawei-free 5G network.<\/p>\n\n\n\n \u201cWhy would I have to build a 5G network? When did the Department of Defense ever build a network?\u201d Arrington asks, snapping her head back to look at the packed audience, her eyebrow furrowed on a face of sarcastic confusion.<\/p>\n\n\n\n The quip earns laughter from the crowd, a sign her humor and wit are working to her advantage.<\/p>\n\n\n\n Arrington \u201cfell in love\u201d with cybersecurity when she worked at the defense giant Booz Allen Hamilton. She\u2019s fascinated by the power and interconnectedness of technology. Cyber, she said, is like fire: It can provide benefits such as warmth or help with cooking. But handled improperly, it will burn you.<\/p>\n\n\n\n Similarly, poor cyber hygiene can destroy everything a victim is connected to, including national security secrets. Or, as she said on a January podcast, \u201cWhen Al Gore created the internet, he did not realize what he was doing.\u201d<\/p>\n\n\n\n She\u2019s also long been attracted to solving problems in public life; even President Jimmy Carter encouraged her<\/a> at five years old to find solutions to problems. And there are plenty of problems to solve in local politics. So in 2016 she turned politician, winning a seat in the South Carolina House of Representatives. That was a \u201cgreat training ground\u201d that prepared her to wrestle with contractors\u2019 concerns.<\/p>\n\n\n\n \u201cYour job is to listen to all the disparate pieces and work on the best solution set for all,\u201d she said.<\/p>\n\n\n\n Her foray into the South Carolina political scene was brief \u2014 just two years \u2014 before she launched her bid for Congress. Ten days after she beat Sanford in the Republican primary, however, Arrington and a friend were hit head on by a drunk driver. They were taken to the hospital with life-threatening injuries. She was bleeding to death. Her back was fractured. Several ribs were broken. A main artery in her legs partially collapsed. Doctors had to remove part of her colon and small intestine.<\/p>\n\n\n\n She spent two weeks in the hospital. When Boucher visited, she wrote a note \u2014 unable to speak due to the tubes down her throat \u2014 telling him: \u201cTwo weeks and I will be right back at it.\u201d He joked to her that finally he could tell her what to do without her talking back.<\/p>\n\n\n\n With the hand that wasn\u2019t strapped down, she flipped him off.<\/p>\n\n\n\n After a few weeks of recovery, she was in \u201ctremendous\u201d pain that limited how much time she could spend campaigning, Boucher said. Arrington spent weeks in a wheelchair, then used a cane. But toward the end of that summer, she helped pack and deliver sandbags as the area prepared for a hurricane.<\/p>\n\n\n\n For Arrington, the wreck gave her a new perspective.<\/p>\n\n\n\n \u201cEven when you think you are at your worst, the sun will rise and you can make it better the following day,\u201d Arrington said in an interview. \u201cI mean, you don\u2019t go through what I went through with my car accident and getting that awareness of \u2018tomorrow will be OK, like, I\u2019m alive.\u2019 \u201d<\/p>\n\n\n\n She went on to lose the election. But the week after the congressional race concluded, both candidates left for Washington, D.C., on the same day, with Arrington cryptically telling the Post and Courier<\/a> she was \u201cgoing to see some groups of people.\u201d Later, she joined the Defense Department.<\/p>\n\n\n\n \u201cI teared up walking into the Pentagon the first day like, \u2018OK, I\u2019m really going to make a change now. I\u2019m really going to be part of the solution,\u2019 \u201d she said.<\/p>\n\n\n\n Unfinished business <\/b><\/p>\n\n\n\n On stage at RSA, Chinese IP theft is a primary point of discussion. Arrington\u2019s CMMC effort is designed to defend against that, but the panelists continue to poke at the government\u2019s decision to ban Huawei.<\/p>\n\n\n\n At one point the moderator asks Arrington: What if Huawei were to go through the CMMC process and earn certification? Then could its hardware be used in DoD networks?<\/p>\n\n\n\n \u201cIt\u2019s against the law. Why are you asking a silly question?\u201d Arrington quips, staring unflinchingly back at the laughing moderator, the crowd cheering in the background. \u201cThis is a moot point. The law is done.\u201d<\/p>\n\n\n\n But now Schneier wants to deal in hypotheticals: If it was legal, would it be reasonable to allow Huawei into the process?<\/p>\n\n\n\n Before answering no, she says: \u201cEven Huawei can admit [that] their programmers are where Microsoft was 25 years ago, right?\u201d<\/p>\n\n\n\n Purdy looks forward, tongue literally in cheek, tugging awkwardly at his black dress shirt.<\/p>\n\n\n\n![\"\"](\"\/wp-content\/uploads\/2026\/08\/KatieArrington-campaign-rally.jpg.jpg\")
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Katielord2.jpg.jpg\")
![\"\"](\"\/wp-content\/uploads\/2026\/08\/arrington-haley.jpg.jpg\")
![\"\"](\"\/wp-content\/uploads\/2026\/08\/KatieArringtonWheelchair.jpg.jpg\")