Albany International Achieves U.S. Department of War CMMC Level 2 Certification for its Albany Engineered Composites Business Segment

Albany International (NYSE: AIN) announced that its Albany Engineered Composites (AEC) business segment achieved U.S. Department of War Cybersecurity Maturity Model Certification (CMMC) Level 2 through an accredited C3PAO on December 22, 2025.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

PORTSMOUTH, N.H.--(BUSINESS WIRE)-- Albany International Corp. (NYSE: AIN), today announced it has achieved the U.S. Department of War (DoW) Cybersecurity Maturity Model Certification (CMMC) Level 2 certification through an accredited CMMC Third-Party Assessment Organization (C3PAO) in support of its Albany Engineered Composites (AEC) business segment.

The stringent certification process ensures defense contractors can safeguard sensitive data from cyber threats, which is critical to national security. Of the estimated 80,000 DoW suppliers required to achieve CMMC Level 2 certification, AEC is among the first one percent to achieve certification. Early certification positions AEC as an approved, strategic supplier for critical next generation military fixed-wing, hypersonic, missile and rotorcraft programs.

“This certification reflects our unwavering commitment to safeguarding our DoW customers’ sensitive information,” said Brian Tullis, chief information officer at Albany International. “Achieving CMMC Level 2 ensures we remain a trusted partner to the U.S. Department of War and strengthens our position in the national security supply chain.”

The certification verifies Albany International and AEC meet the enhanced cybersecurity requirements necessary to protect Controlled Unclassified Information (CUI) across their operations. To conduct business with DoW, the CMMC Level 2 is a prerequisite for companies working on a wide range of defense programs and requires adherence to 110 security practices aligned with the National Institute of Standards and Technology (NIST) Special Publication 800-171.

Additional information about AEC, its products and services is available at Albany Engineered Composites.

About Albany International Corp.
Albany International is a leading developer and manufacturer of engineered components, leveraging advanced materials processing and automation capabilities in two core businesses:

• Machine Clothing: The world’s leading producer of custom-designed, consumable belts essential for the manufacture of paper, paperboard, tissue and towel, pulp, non-wovens and other industrial applications.
• Engineered Composites: A growing designer and manufacturer of advanced materials-based engineered components for demanding aerospace applications, supporting both commercial and military platforms.

Albany International operates 30 facilities in 13 countries, employs approximately 5,600 people worldwide, and is listed on the New York Stock Exchange (Symbol: AIN). For more information, visit Albany International.

About Albany Engineered Composites
Albany Engineered Composites (AEC) designs and manufactures advanced engineered composite components for engine and airframe applications in commercial and military aircraft, missiles and unmanned vehicles. AEC’s specialty composite solutions enable current and next-generation aircraft to perform better while being more fuel efficient, cost effective and environmentally friendly.

View source version on businesswire.com: https://www.businesswire.com/news/home/20251222447263/en/

Media Contact
Bryan Warren
Senior Marketing & Communications Manager
817-682-6786

Source: Albany International Corp.

Key Terms

cybersecurity maturity model certification (cmmc) level 2 regulatory

A Cybersecurity Maturity Model Certification (CMMC) Level 2 is a government-backed standard that verifies an organization has implemented intermediate cybersecurity practices to protect controlled unclassified information, especially in defense-related supply chains. It matters to investors because achieving Level 2 reduces the risk of losing contracts, regulatory penalties, or reputational damage from data breaches, much like upgrading from basic locks to a monitored alarm system lowers the chance and cost of a break-in.

c3pao technical

A C3PAO is an independent, accredited assessor authorized to evaluate a company’s cybersecurity practices against government standards for handling sensitive information. Think of it as a certified building inspector for digital security: its stamp of approval can be required to win certain government or military contracts, reduce legal and breach risk, and therefore directly affect a company’s ability to compete and its investment appeal.

controlled unclassified information (cui) regulatory

Controlled Unclassified Information (CUI) is sensitive government-related material that is not classified as secret but is still restricted and must be handled according to specific rules—think of it as a locked folder you can open only under certain conditions. For investors, CUI matters because companies that access, store or process it face compliance requirements, security controls and potential penalties for mishandling, all of which can affect contract eligibility, costs and risk profiles.

national institute of standards and technology (nist) regulatory

A U.S. federal agency that creates and maintains measurement, testing and cybersecurity standards used across industry, from how devices are measured to how data systems are secured. Investors care because NIST guidance acts like a common ruler or referee: following its standards can reduce regulatory risk, lower product certification costs, increase customer trust, and influence which technologies and companies gain market acceptance.

special publication 800-171 technical

NIST Special Publication 800-171 is a government-issued cybersecurity guide that tells organizations how to protect sensitive but unclassified information when they handle it outside federal systems. Think of it as a detailed home-security checklist for digital data; companies that must follow it show investors they meet specific controls for encryption, access rules and monitoring, which can reduce regulatory risk, contract loss and costly breaches.