2026 ASEE Annual Conference & Exposition

The Department of War (DoW) transition to the Cybersecurity Maturity Model Certification (CMMC) as a requirement for contracts has revealed a critical workforce deficit within the assessment ecosystem. With over 80,000 contractors requiring triennial Level 2 certifications, the current supply of Certified CMMC Assessors (CCAs) is insufficient to meet demand. This bottleneck is exacerbated by a fragmented professional education model and strict experience requirements that favor established professionals over new talent. This Work-in-Progress paper proposes a replicable institutional model for higher education to serve as a workforce pipeline for the Defense Industrial Base (DIB). Using the University of Oklahoma’s Polytechnic Institute (OUPI) as a pilot case study, an integrated, credit-bearing academic concentration has been designed to embed Certified CMMC Professional (CCP) and CCA curricula directly into existing cybersecurity degrees. Further, the pilot incorporates community cybersecurity service, orchestrated through a cybersecurity clinic model to help fulfill, if not satisfy, the experience requirements of the CCA certification. We suggest that by replacing short-term training with semester-long mastery and clinical practice, academic institutions can produce assessment-ready graduates, partially address the assessor shortage, and enhance the long-term resilience of the national defense supply chain.