When I run a generic site audit against a US defense contractor, the report tells me useful things about meta descriptions and HSTS headers and image alt text. It does not tell me whether the firm's CMMC level is referenced on the Capabilities page, whether the careers page has the standard clearance-required language, whether the Capability Statement PDF is linked from the right place, or whether the sister-company schema linkage is in place for a firm that spun a product out of its services arm. Those are the checks that matter to a federal program manager. The generic SEO ones are scaffolding.
The Mega Analyzer's new Defense-Contractor Readiness section runs only when a page looks like a US defense contractor or federal-IT contractor, and surfaces the checks a contracts officer would actually want their web team to handle. Detection requires at least one strong signal (DoD / DARPA / ONR / AFRL / DIA / DLA / NASA / MDA mentions, CMMC / DFARS / ITAR / EAR / FedRAMP / SDVOSB language, CAGE code / UEI / SAM.gov mentions, .mil references, or a GovernmentService / DefenseService schema type) plus one or two supporting signals (NAICS code, security-clearance language, ISO / AS9100 mention, DCAA references, federal-contract-vehicle language like GSA / SEAPORT-NxG / GWAC / IDIQ, "controlled unclassified information" language, set-aside identity).
What it catches
CMMC level on Capabilities / About. DoD's Cybersecurity Maturity Model Certification 2.0 final rule lives in 32 CFR Part 170 and took effect December 16, 2024. Any DoD contractor handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) needs a CMMC Level 1, 2, or 3 attestation. Even a firm that is not yet certified should state the target level (e.g., "pursuing CMMC Level 2 attestation in FY26") — procurement officers and AI search both look for this signal, and silence reads as "behind on a basic compliance milestone."
DFARS 252.204-7012 + NIST SP 800-171 on Capabilities / About / Security. DFARS clause 252.204-7012 is the foundational DoD-CUI cybersecurity clause; NIST SP 800-171 Rev. 2 contains the 110 controls non-federal systems must satisfy. CMMC Level 2 is built on top of NIST SP 800-171. A defense contractor should reference compliance with both — and where applicable, the enhanced NIST SP 800-172 controls for high-value CUI.
ITAR / EAR on hardware / cryptography / defense-article context. ITAR (22 CFR Parts 120-130), administered by the State Department's Directorate of Defense Trade Controls (DDTC), governs defense-article registration and export licensing. EAR (15 CFR Parts 730-774), administered by Commerce's Bureau of Industry and Security (BIS), governs dual-use export controls. A statement of compliance (without listing license numbers) is procurement-aligned posture for any firm building hardware, encryption, or defense-article-adjacent software.
FedRAMP authorization on cloud / SaaS. FedRAMP authorization is required for cloud services used by federal agencies. The site should state the authorization level (Low / Moderate / High / DoD IL2 / IL4 / IL5 / IL6 / GovCloud) or the target — and link to the firm's FedRAMP Marketplace page if authorized.
SAM.gov registration + CAGE + UEI + NAICS disclosure on Capabilities. SAM.gov is the System for Award Management — all federal contractors must register there to receive contract awards. The 5-character CAGE (Commercial and Government Entity) code and the 12-character UEI (Unique Entity Identifier — which replaced DUNS in April 2022) are the canonical federal-contractor identifiers. NAICS codes drive small-business set-aside qualifications. Display all three publicly on the Capabilities page and mirror them in the Organization JSON-LD as identifier:[{"@type":"PropertyValue","propertyID":"CAGE","value":"..."},{"@type":"PropertyValue","propertyID":"UEI","value":"..."},{"@type":"PropertyValue","propertyID":"NAICS","value":"..."}].
Section 889 + Buy American Act + Berry Amendment. FAR 52.204-25 (implementing Section 889 of FY19 NDAA) prohibits covered Chinese-vendor telecom equipment (Huawei, ZTE, Hytera, Hikvision, Dahua) in federal contracts. Buy American Act, 41 USC 8302 and Berry Amendment, 10 USC 4862 govern domestic-content requirements for federal procurement of materiel. A representation on Capabilities / Compliance is one of the first things federal program managers check.
Set-aside identity (SDVOSB / WOSB / 8(a) / HUBZone) in the page title. Federal small-business preference programs — Service-Disabled Veteran-Owned Small Business, Woman-Owned Small Business, 8(a) Business Development, HUBZone — are Tier-1 procurement signals. Surfacing the qualification in the page <title> (not just the body) lets a procurement officer searching SAM.gov, SBA's DSBS, or Google with set-aside qualifiers find the firm before competitors that bury the certification under a generic "About" tag.
Capability Statement PDF on the Capabilities page. Federal program managers expect a one-page PDF containing CAGE, UEI, primary + secondary NAICS, past performance summary, set-aside status, certifications (CMMC, ISO, AS9100, FedRAMP), and contact info. The PDF is the standard hand-off artifact during procurement. Not surfacing it costs RFI / RFQ inclusion.
Person + hasCredential schema on leadership. Defense procurement officers and AI search use Person entities to verify experience claims. Each named leader should have a Person block with jobTitle, worksFor, alumniOf, and hasCredential for relevant certifications (INCOSE-CSEP / ESEP, PMP, CISSP, CISM). Avoid publishing individual security clearance levels — use generalized language like "active clearance" or "TS-eligible." Clearance reciprocity and DCSA rules govern who can be told what; published web language is not the right surface for individual clearance data.
Service / GovernmentService schema on Capabilities verticals. Without it, AI search has no machine-readable hook into the firm's capability taxonomy. Emit one Service block per vertical with serviceType: "<NAICS code>" and areaServed: "United States".
parentOrganization / subOrganization linkage when related entities exist. When a defense contractor has a sister entity, subsidiary, or spin-out — a hardware-services arm that spun out a software product, a federal-IT-services arm and a separate enterprise-AI product — expressing the relationship in schema lets AI search and federal-procurement researchers correlate the entities. Add parentOrganization:{"@id":"<parent-site>#org"} to the subsidiary's Organization block, or subOrganization:[{"@id":"<sub-site>#org"}] to the parent. Two sites with shared HQ + shared CEO without this linkage create a due-diligence gap an AI engine cannot bridge.
Security-clearance language on Careers. For defense contractors, clearance language is a positioning signal AND an ITAR-related US-Persons check. State per-role clearance levels (Public Trust / Secret / TS / TS/SCI) and the "US Citizenship required" baseline for any role touching ITAR-controlled work.
What the check ships with
When the section finds issues, the user gets three pills and one inline button:
- 📖 Learn (blog) points to this post.
- 🔍 Audit on E-E-A-T tool opens
/tools/eeat-analyzer/?url=…&autorun=1so the user can drill into the broader authority profile. - ⚙ Fix on Schema Bundle opens
/tools/schema-fix-bundle/?url=…&autorun=1which emits the missingOrganization,Service,Person,GovernmentService, andparentOrganizationblocks ready to paste. - ⚖ Copy defense-readiness fix prompt is the inline
ai-prompt-ready-btnthat copies a structured prompt with the actual findings, ready to paste into Claude or ChatGPT for one-shot remediation.
The prompt is structured the way the rest of the analyzer's fix prompts are: page context (firm-level vs Capabilities vs Leadership vs Careers vs Contact), the specific findings, a numbered list of remediation tasks with example schema blocks inline, and constraints. The constraints matter for defense contractors more than for other verticals — there are explicit rules about not publishing individual clearance levels, not inventing CMMC levels, and getting Facility Security Officer / General Counsel sign-off on regulatory language before publication.
Accessibility overlay detection rides alongside
The same sitewide accessibility-overlay sub-check that ships with the Legal and CPA-firm Readiness sections also runs against defense contractors: any installed widget (accessiBe, UserWay, AudioEye, EqualWeb, Recite Me) gets a hard-fail card with the FTC v. accessiBe consent order (April 2025, $1M), UsableNet 2024 ADA Title III tracker (1,023 of ~4,000 lawsuits cited overlays as barriers), DOJ March 2022 web-accessibility guidance, and Robles v. Domino's Pizza, 913 F.3d 898 (9th Cir. 2019) references. For defense contractors specifically, the legal exposure is layered: ADA Title III plus Section 508 of the Rehabilitation Act (Revised 508 Standards, Final Rule January 18, 2017, effective January 18, 2018) applies to ICT supplied to federal agencies. An overlay does not satisfy either.
Where it draws the line
The check does not try to be the firm's Facility Security Officer or counsel. It does not encode DCSA's National Industrial Security Program Operating Manual (NISPOM) requirements, individual clearance reciprocity rules, the full text of the DFARS clauses, the FedRAMP boundary documentation requirements, or the Berry Amendment's textile-and-materiel sourcing list. The firm's FSO, General Counsel, and Designated Approving Authority should be the final reviewers on visible regulatory language; the analyzer surfaces the gap and provides the lookup so they can ship correctly.
The check also does not validate actual certifications. It detects whether the page mentions CMMC, FedRAMP, ISO, AS9100, etc. — it does not verify that the certification is currently held. If a firm publishes "CMMC Level 2" but is not actually certified, that is a representation issue with serious procurement consequences; the analyzer does not catch it. (No web crawler can.)
And the check is vertical-gated. A government-affairs lobby firm, a defense-industry trade publication, and a Department of Defense agency website all share vocabulary with defense contractors but have different schema and disclosure expectations. The detector requires multiple signals before the section appears at all.
Why these checks exist
Three audits of small-to-mid-cap US defense contractors surfaced this section. One had the densest compliance-attestation surface I've seen on any defense-services site — ten named ISO / CMMC / CMMI / AS9100 certifications, CAGE code, UEI, thirteen federal contract vehicles — and then installed acsbapp.com/apps/app/dist/js/app.js (accessiBe) sitewide, which is the exact widget the FTC penalized $1M in April 2025. One had the cleanest Yoast graph of the set but zero og:image across nine pages, no skip-link anywhere, no Person schema for seven named leaders, and no formal certifications statement despite customers including the Missile Defense Agency and the DoD HPC Modernization Program. One had zero JSON-LD on eleven pages despite selling security-and-compliance as a product feature, and no public schema linkage to its sister entity at the same Vienna VA address.
Each gap was specific and fixable. A generic SEO scan would not surface any of them as critical. The CMMC + DFARS + ITAR + FedRAMP language and the CAGE / UEI / NAICS disclosure are not "SEO" in the consumer sense — they are the federal-procurement equivalent of the AICPA / Peer Review / Circular 230 signals for a CPA firm, or the attorney-advertising / Person+Attorney + bar-license credential signals for a law firm. AI search engines (ChatGPT, Claude, Perplexity, Google AI Mode) cite federal contractors using the language those contractors publish on their own websites. The Defense-Contractor Readiness section is the audit that converts a generic-SEO B-grade page into a federal-procurement-ready entity.
Related reading
- The Mega Analyzer — one URL, every audit in one pass — the umbrella post.
- Legal-Site Readiness in the Mega Analyzer — the first vertical in this pattern.
- CPA-Firm Readiness in the Mega Analyzer — the second vertical; introduces the AICPA / Peer Review / Circular 230 / FTC Safeguards pattern.
- WCAG 2.1 / 2.2 AA Accessibility Audit — the dedicated underlying-code WCAG audit tool. For defense contractors, Section 508 conformance is mandatory for ICT supplied to federal agencies.
- Schema Validator + Schema Fix Bundle — emits the JSON-LD blocks ready to paste.
- AI Bot Allowlist Validator — verifies the 30 AI / search bots can actually read the firm's pages.
Fact-check notes and sources
Regulatory + standards
- 32 CFR Part 170 — CMMC Program final rule (effective Dec 16 2024)
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems
- NIST SP 800-172 — Enhanced Security Requirements for Protecting Controlled Unclassified Information
- ITAR — 22 CFR Parts 120-130
- State Department Directorate of Defense Trade Controls (DDTC)
- EAR — 15 CFR Parts 730-774
- Commerce Bureau of Industry and Security (BIS)
- FedRAMP · FedRAMP Marketplace
- SAM.gov — System for Award Management
- SBA — set-aside programs
- VA OSDBU — SDVOSB verification
- DCSA — Defense Counterintelligence and Security Agency
- FAR 52.204-25 — Section 889 implementation
- Buy American Act — 41 USC 8302
- Berry Amendment — 10 USC 4862
- Section 508 — Revised ICT Standards (effective Jan 18 2018)
Schema standards
- schema.org/Organization · schema.org/GovernmentService · schema.org/Service · schema.org/ProfessionalService · schema.org/Person
- schema.org/parentOrganization · schema.org/subOrganization
- schema.org/EducationalOccupationalCredential · schema.org/identifier (PropertyValue)
- Google: Structured data — Organization
Web accessibility law (relevant to Section 508)
- DOJ March 2022 web accessibility guidance
- Robles v. Domino's Pizza, 913 F.3d 898 (9th Cir. 2019)
- FTC v. accessiBe — consent order ($1M, finalized April 2025)
- UsableNet 2024 ADA Title III tracker
- Section 508 of the Rehabilitation Act — 29 USC 794d
This post documents an analyzer check, not legal, security, or procurement advice. CMMC / DFARS / ITAR / EAR / FedRAMP / SAM.gov citations are pointers to authoritative texts. The firm's Facility Security Officer, General Counsel, Designated Approving Authority, and contracts officer should sign off on visible regulatory and clearance language before production deploy. Do not publish individual security-clearance levels of named personnel — use generalized language. Schema.org recommendations follow Google's structured-data guidance; validate every emitted JSON-LD block against Google's Rich Results Test and the Schema.org validator before deploy.
If you build sites for the defense-contracting industry, The $20 Dollar Agency ($9.99 on Kindle) is the playbook I wrote for the boutique that ships pages a contracts officer can actually approve — AEO + GEO + SEO for a federal-budget audience, without an outside agency retainer.
