CTM · Castellum, Inc.

Castellum’s CMMC Level 2 C3PAO Certification is a HIGH material event because it directly unlocks eligibility for a broad segment of U.S. Department of Defense contracts that mandate this specific cybersecurity standard for handling Controlled Unclassified Information. Unlike voluntary certifications, CMMC Level 2 is becoming a contractual prerequisite across the defense industrial base — meaning absence of certification can disqualify bidders outright. The filing confirms Castellum met all 110 controls and 320 objectives with no deficiencies, a rare outcome that signals exceptional execution of security processes and likely reduces customer due diligence friction. Management explicitly ties the certification to organic growth, stating it enables responses to RFPs 'in line with its organic growth framework' and calling it 'critical to continuing to grow and win contracts with DoD.' This is not aspirational language but an operational prerequisite. Further reinforcing materiality, the company simultaneously announced a new Investor Relations partnership with The Equity Group — a deliberate step to amplify market awareness of this capability shift. While no financial metrics or guidance are disclosed, the certification represents a structural upgrade to Castellum’s competitive moat in federal contracting, with implications for bid win rates, pricing power, and subcontractor leverage. The timing — April 2026 — aligns with anticipated DoD enforcement ramp-up of CMMC requirements, making this a timely and strategically defensive milestone with clear revenue pathway implications.