COLUMBIA, United States – September 11, 2026 – LEXX Live will run an executive session on the Cybersecurity Maturity Model Certification in October at National Harbor, Maryland. The session is built for senior leaders inside defense-industrial-base companies, who hold the budget and the accountability for CMMC compliance and are rarely the people sitting in the technical training.
Those leaders are also the ones the regulation reaches directly.
Why the Executive Layer Is the Gap CMMC is not a technical certification a company can hand entirely to its security function. Three of the obligations it creates are management decisions before they are engineering ones. Deciding which systems fall inside the assessment scope. Signing the affirmation of continuing compliance. Committing the resources behind any plan of action for gaps still open.
Each of those is taken above the security team, and the regulation names the senior representative who signs for the second of them.
What Part 170 Requires of a Contractor The program is codified at 32 CFR Part 170. The part establishes the program itself and the requirement for contractors to implement the prescribed standards for safeguarding Federal Contract Information and Controlled Unclassified Information, and it sets out how compliance with those standards is assessed. The standards themselves sit elsewhere, in the federal acquisition regulation and in the NIST special publications the part points to.
Three levels apply. Level 1 runs on self-assessment and affirmation, Level 2 on either a self-assessment or a certification assessment depending on the contract, and Level 3 on a certification assessment.
The affirmation is the part that lands squarely on a named individual. Under the regulation an Affirming Official from each contractor, prime or subcontractor alike, must affirm continuing compliance after every assessment and annually thereafter, submitted electronically in the Supplier Performance Risk System, attesting that the organization has implemented and will maintain implementation of every applicable requirement across the assessment scope.
The requirements also flow down to subcontractors, which is how they reach companies that hold no covered contract of their own.
What LEXX Live Already Runs on CMMC LEXX Live delivers CMMC training for the defense industrial base across the practitioner and assessor tracks, including the Certified CMMC Professional and Certified CMMC Assessor programs, and maintains a standing executive resource on CMMC for leadership audiences.
LEXX states on its own site that its instructor-led training is trusted by government agencies and Fortune 500 companies, delivered by more than 400 certified expert instructors, with pass rates of 90 percent or better.
The October session at National Harbor is aimed at the executive audience described above rather than at the practitioner tracks.
About LEXX
LEXX is a cybersecurity and IT certification training provider. Its instructor-led arm, LEXX Live, formerly Phoenix TS, operates a training center in Columbia, Maryland, and delivers classroom and live online training across cybersecurity, cloud, networking, project management, and emerging technology. LEXX Online provides self-paced courses, and the LEXX Bookstore carries courseware, labs, and exam preparation materials. LEXX states that its instructor-led training is used by government agencies and Fortune 500 companies and is delivered by more than 400 certified expert instructors. More information is available at lexx.com.
Media Contact LEXX Media Relations Columbia, Maryland
For media inquiries, please contact Ned Snow at [email protected] or 888-330-9071.
Media ContactCompany Name: Learning Exchange, Inc.Contact Person: Ned SnowEmail: Send EmailPhone: 888-330-9071City: ColumbiaCountry: United StatesWebsite: https://lexx.com/
