Technology and Cybersecurity Due Diligence in Aerospace and Defense M&A

Technology and cybersecurity due diligence: frequently asked questions

What is technology and cybersecurity due diligence in aerospace and defense M&A?

Technology and cybersecurity due diligence in aerospace and defense M&A is the pre-close review of a target company's systems, security controls, and compliance posture, done so an acquirer understands what it is buying before it signs. In this sector, the review may cover the CMMC Status and assessment path required by the contract, NIST SP 800-171 Rev. 2 where CMMC Level 2 applies, ITAR and EAR export controls on controlled technical data or technology, and accounting controls subject to applicable FAR, DFARS, CAS, SF 1408, and contract criteria that DCAA may audit. Diligence tests evidence, scope, and operating practice. Lightbridge.ai provides independent readiness advisory only. It does not issue a CMMC Status or perform the official assessment.

Why is technology due diligence important in aerospace and defense M&A specifically?

It is important because the downside of missing something can be operational, legal, or contractual. A target that lacks the CMMC Status required by a contract may be ineligible for an award or subject to contractual remedies, depending on the clause, scope, and status. BIS states that an acquiring business can be held liable for EAR violations committed by an acquired company, and that successor-liability principles may apply. The result depends on transaction structure and governing law. An accounting system that is not adequate or acceptable under applicable contract criteria can affect award responsibility, billing, or audit outcomes. Lightbridge.ai recommends this review as a deal-team workstream. Market practice varies.

What is the difference between CMMC status and ITAR compliance in a due-diligence context?

They are separate regimes that diligence should test independently. Under 32 CFR § 170.14, the CMMC Model uses FAR 52.204-21 for Level 1 safeguarding of Federal Contract Information, NIST SP 800-171 Rev. 2 for Level 2 safeguarding of Controlled Unclassified Information, and selected requirements from NIST SP 800-172, February 2021 edition, for Level 3. NIST SP 800-171 Rev. 3 is the current standalone NIST publication, so the diligence file should identify the baseline required by the contract. CMMC Status is a formal result tied to the assessment path, scope, and affirmation. A self-assessment and the Affirming Official's affirmation are separate steps. A Level 1 self-assessment must be entirely MET with no POA&M. Level 2 requires an SSP, uses the CMMC scoring methodology, and can result in Conditional or Final status under the applicable path. ITAR governs exports, reexports, retransfers, and releases involving defense articles, defense services, and technical data. Its U.S.-person definition includes lawful permanent residents, protected individuals, and U.S.-organized entities, and foreign-person access can be authorized. The EAR generally regulates technology and source code. Its deemed-export analysis considers the person's most recent country of citizenship or permanent residency along with classification, destination, end user, end use, and license or exception analysis. Neither ITAR nor the EAR is a generic cloud or physical-security framework. Technical controls support the required authorization and access boundaries, and ITAR § 120.54 provides specific conditions for certain encrypted storage or transmission to be treated as not an export.

How does DCAA-related accounting review factor into aerospace and defense M&A diligence?

For a target with cost-reimbursement or other contracts that require an accounting-system review, the accounting system is part of the asset being acquired. DCAA is an audit agency, not a certification body. It performs audit work at a federal entity's request against applicable FAR, DFARS, Cost Accounting Standards, SF 1408, and contract criteria. The relevant conclusion is whether the system is adequate or acceptable for the contract. There is no DCAA-approved accounting system. Diligence should test direct and indirect cost segregation, timekeeping, allowable-cost screening under FAR Part 31, indirect-rate support, and billing reconciliation. Payment withholding under DFARS 252.242-7005 applies only where the clause applies and after the contracting officer's final determination and notice required by that clause. An incurred-cost audit is not an automatic penalty. Incurred-cost submissions and related audits arise under applicable cost-reimbursement and final indirect cost-rate requirements, including FAR 52.216-7. This review sits alongside the cybersecurity and export-control review.

What is digital engineering strategy and why does it matter to an acquirer?

Digital engineering strategy is how an organization plans, integrates, and governs the model-based tools, product data environments, and systems-security practices used to design and build aerospace and defense products. In a due-diligence context, it matters because a target's digital-engineering toolchain and security architecture are what the acquirer has to integrate after close. A toolchain built on outdated, undocumented, or poorly secured systems can carry a hidden integration bill and a security gap that never shows up in the target's financial statements, which is why a technical assessment of digital-engineering maturity belongs in the diligence scope alongside the compliance and accounting review.

Who typically runs technology and cybersecurity due diligence on an aerospace and defense deal?

The work is often split across specialists because the disciplines are different: a cybersecurity specialist assesses CMMC and NIST SP 800-171 evidence; an export-control specialist assesses ITAR and EAR classification, access, and authorization questions; a financial and accounting specialist assesses ERP and DCAA-relevant controls; and a systems specialist assesses the technology stack and integration risk. Lightbridge.ai can coordinate those inputs as an independent readiness advisor and present one deal-team view. It does not perform an official CMMC assessment, act as a C3PAO or DIBCAC, issue CMMC Status or certificates, or determine whether a government accounting system is acceptable.

When in the deal timeline should technology and cybersecurity due diligence start?

It should start early enough to inform the offer, not just confirm it. Compliance and accounting gaps discovered after a letter of intent is signed tend to become price or indemnification negotiations rather than deal-structure decisions, which limits the acquirer's options. Starting the technical and compliance review in parallel with financial and legal diligence gives the deal team time to size remediation cost, factor it into valuation, and decide whether the gap is a purchase-price adjustment, an escrow holdback, or a walk-away issue, before those choices narrow.

Does a clean cybersecurity assessment mean the deal has no technology risk?

No. A score or assessment finding measures implementation under a particular CMMC assessment method. It is not the same as a formal CMMC Status. Level 1 results are MET or NOT MET in their entirety, with no POA&M. Level 2 uses the scoring methodology in 32 CFR § 170.24 and can produce Conditional or Final status under the applicable self-assessment or certification path. Contract eligibility depends on the required status, assessment scope, and affirmation. A target can have a favorable CMMC result and still carry unmanaged ITAR or EAR exposure, an accounting system that is not adequate or acceptable for a contract, or a systems-engineering toolchain that will be expensive to integrate. Lightbridge.ai recommends reviewing all four areas as independent readiness workstreams.