When new cybersecurity certification rules took effect for defense contractors on Nov. 10, 2025, most of the industry was still catching up. HX5 was not. Margarita Howard’s company already held Cybersecurity Maturity Model Certification Level 2, one of the more demanding assessments in a program the Department of Defense estimates will eventually touch more than 337,000 prime contractors and subcontractors.

As of August 2025, only 270 organizations nationwide had reached final CMMC Level 2 certification. That early gap between contractors who were ready and those still working through the process gave HX5 a head start heading into a rule that carries real consequences for eligibility.

Building Ahead of the Requirement

“There are heightened cybersecurity requirements,” Howard said, “and contractors will not have a choice but to implement them if they want to be a government contractor.” Her comment points to a pattern that predates CMMC. HX5’s attention to financial controls and documentation from its early years, Howard has said, was about building to a requirement before it becomes a competitive threshold rather than scrambling once it does.

Margarita Howard expects the compliance bar to keep rising alongside broader use of artificial intelligence in government contracting. “Compliance protocols will be automated,” she said. “Contractors will be required to integrate systems that provide continuous reporting and real time audit capabilities.” She describes HX5 as already building toward that kind of infrastructure.

A Workforce Built to Match It

HX5 now employs roughly 1,000 people across more than 20 states, supporting Department of Defense and NASA programs that require security clearances. More than 30 percent of those employees are veterans, a figure tied to the company’s participation in the SkillBridge program, which moves transitioning military personnel directly into technical roles. The Department of Labor recognized the approach with a 2025 HIRE Vets Gold Medallion Award.

The certification timeline is phasing in over three years, giving contractors a window to catch up. For a company that built its compliance posture before the deadline arrived, that window looks less like a scramble and more like confirmation of a strategy already in motion.