Dallas-Fort Worth is the most concentrated aerospace manufacturing region in the country, capturing 36% of national aerospace manufacturing award volume with over 675 aerospace and defense companies and 95,000 related jobs. That concentration means CMMC isn't an abstract federal rule for local manufacturers, it's a direct condition of doing business with Lockheed Martin's F-35 production in Fort Worth, Bell Flight, L3Harris, and Raytheon's Dallas and McKinney operations. Here's exactly where things stand as of mid-2026.

Why DFW Manufacturers Face More Pressure Than the National Average

  • Lockheed Martin Aeronautics is headquartered in Fort Worth, running F-35 production through a deep Texas supplier network
  • Bell Flight's rotorcraft and tiltrotor operations flow CMMC requirements down to every tier of their supply chain
  • L3Harris (DFW operations, electronic warfare and communications) and Elbit Systems of America (Fort Worth, defense electronics) add further flow-down pressure

Major primes including Lockheed Martin, Boeing, RTX, and General Dynamics are independently assessing their own supply chains and treating certification as a condition of new awards, ahead of what the DoD itself is directly enforcing

The July 2026 Phase 2 Suspension: The National Picture

On July 13, 2026, the Department of War suspended the CMMC Phase 2 requirement that would have made third-party (C3PAO) certification mandatory starting November 10, 2026. A CMMC Reform Task Force is now conducting a 60-day review, with further guidance expected around mid-September 2026. Still fully in force: Phase 1 self-assessment requirements, DFARS 252.204-7012 safeguarding obligations, and your underlying NIST SP 800-171 implementation work.

Why That National Pause Doesn't Change Much for Lockheed and Bell Suppliers

This is the detail that matters most for DFW specifically: major primes are not waiting on the DoD's own enforcement timeline. Lockheed Martin uses its own CCRA questionnaire and requires a green rating, meaning attestation of all 31 identified NIST 800-171 requirements, to keep suppliers in good standing. RTX will not issue a purchase order or letter of subcontract to CUI-handling suppliers without confirmed CMMC certification level. Whatever the federal Phase 2 review concludes, your prime's own supplier requirements are already active and independent of it.

The Mistake DFW Manufacturers Are Most Likely to Make Right Now

Treating the Phase 2 suspension as a reason to pause your own compliance work. It isn't. Two forces make this the wrong moment to slow down: your prime's own flow-down enforcement (already active, independent of federal timing), and the reality that implementation still takes 6 to 12 months regardless of when outside verification resumes. Manufacturers who keep moving now will be ready either way. Those who stop will be restarting the clock under pressure later, competing with everyone else for limited assessor capacity when Phase 2 requirements return.

What Commonly Gets Missed in DFW Specifically

  • CUI creep in day-to-day communication: contract drawings, program schedules, and even unclassified email threads referencing part numbers can qualify as CUI once they're tied to a specific DoD program
  • Assuming Level 1 is sufficient without confirming what CUI, if any, flows down from your specific prime contract

Underestimating how quickly assessor and consultant capacity fills up in a region this concentrated once formal requirements resume

What to Do This Quarter

  • Confirm your current SPRS self-assessment score and make sure it's accurate, not aspirational
  • Ask your specific prime (Lockheed, Bell, L3Harris, Raytheon, or others) exactly what their current supplier requirements are, since they may exceed the federal minimum
  • Scope your CUI accurately rather than assuming based on your industry or company size

Keep remediation and documentation moving through the review window rather than waiting for its outcome

Why DFW Manufacturers Work With Justice IT Consulting

  • Registered Practitioner Organization (RPO) with Certified CMMC Professionals (CCPs) and Registered Practitioners (RPs) on staff
  • We hold our own CMMC Level 2 certification
  • 4-time Top 250 MSSP in the world, 3-time Top 500 MSP in the world
  • Our team includes an Amazon Best-Selling Author on CMMC compliance and hosts The CMMC Compliance Guide Podcast
  • Family-owned, based right here in DFW, 60+ five-star Google reviews

Supplying Lockheed, Bell, L3Harris, or another DFW prime? Contact Justice IT Consulting. We know this supply chain because we're part of it.