Get the practical insights, framework roadmaps, and audit-prep guides you need to turn complex cybersecurity regulations into your company's biggest competitive advantage.
Filter by category
No posts in this category yet.
When clients come to me about cloud compliance, the first question they ask is “which framework applies?” That is the wrong first question. It jumps straight to the paperwork and skips the question that determines whether the paperwork even matters: what data does this workload handle, and where does it actually live?
A building’s control systems do not become irrelevant to cybersecurity because they sit outside the IT department. If a building automation network, access-control system, or industrial controller can reach, or affect, the systems that handle controlled information, it deserves a deliberate place in your boundary analysis.
The public reporting about the Defense Manpower Data Center incident has focused on the number of people affected. That is understandable. Approximately 3.05 million people were included in the affected population: 2.76 million living individuals and 294,000 deceased individuals.
The General Services Administration’s new clause for large language model procurements is already generating the wrong first question.
Imagine two headlines arriving in the same week. First, the Department of Justice announces that Honeywell Aerospace will pay $2,042,518 to resolve allegations that one business unit failed to comply with NIST SP 800-171 requirements on a Department of Defense contract.
For years, cybersecurity compliance in the defense industrial base has been framed primarily as a data-protection problem.
Defense contractors have spent years tracking CMMC. For many organizations outside the defense industrial base, the larger structural development is now taking shape in the Federal Acquisition Regulation.
A SOC 2 report is supposed to be a trust document. Since June 1, 2026, the AICPA has been running a structured peer-review monitoring process focused on high-volume, templated SOC 2 practices.
A contractor tells leadership they need to budget for the assessment. That sentence sounds reasonable. It is also the beginning of one of the most expensive misunderstandings in compliance.
The Department of War’s Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, gives contractors a clearer answer to an important question: What happens to CMMC while the Department reviews the program?
The CMMC Reform Task Force has completed its 60-day review. Its recommendations have been delivered to Department of War CIO Kirsten Davies. The report is not public.
Microsoft 365 is where many federal contractors store email, documents, project records, and Controlled Unclassified Information (CUI). That makes identity and access configuration a central part of your security boundary.
If you handle Controlled Unclassified Information, the System Security Plan is usually the first artifact someone asks to see.
If you handle Controlled Unclassified Information (CUI), one decision affects almost every other part of your cybersecurity program: Which systems, services, devices, facilities, and people are inside your CMMC assessment boundary?
If you work for a federal contractor, this is the question that determines almost everything downstream: Do we handle Federal Contract Information, Controlled Unclassified Information, or both?
If you are a federal contractor trying to submit or verify a NIST SP 800-171 or CMMC self-assessment, SPRS access is often the first obstacle.
If you are responsible for IT at a federal contractor and need to get CMMC Level 1 handled, the process can feel confusing at first. There are unfamiliar systems, an assessment scope to define, evidence to collect, and an executive affirmation that carries real responsibility.
If you are collecting the same evidence more than once, you do not have only a compliance problem. You have an architecture problem.
The pause is not a pass. It is a buying window for readiness. Federal contractors should use this period to audit their environment, validate their representations, close control gaps, and establish continuous evidence practices.
Do not pause your cybersecurity program, and do not blindly rebuild it around Rev. 3 identifiers. Audit first. Build a plan. Then select the tools that support that plan.
A deadline disappeared. The obligation did not.
A compliance platform can map controls, collect evidence, and display a reassuring green dashboard. It can also leave your organization unprepared. That is the uncomfortable truth many leaders discover too late: owning a compliance tool is not the same as operating a compliance program.
A higher SPRS score should be good news. But what if the number rises while fewer contractors believe the number is accurate? That is the uncomfortable signal emerging from the latest defense industrial base data.
The Department of Defense suspended CMMC Phase 2 on July 13, 2026. The decision halted the planned expansion of third-party C3PAO assessments and government-led DIBCAC assessments that were scheduled to become a contract requirement beginning November 10.
If you are still treating regulatory compliance as an annual audit ritual: a binder of policy documents pulled off the shelf once every twelve months to satisfy an auditor: I have some uncomfortable news for you.
As I review defense industrial base (DIB) readiness assessments across our client portfolios, I notice a persistent, dangerous illusion. Most defense contractors, facility operators, and federal supply chain partners believe that achieving compliance with NIST SP 800-171 Revision 2 means they have crossed the finish line.
As I review the regulatory landscape heading into the latter half of 2026, a peculiar and dangerous delusion has taken hold across the Defense Industrial Base (DIB). When the Department of Defense announced its mid-July suspension of CMMC Phase II - halting the mandatory rollout of third-party C3PAO audits - a collective sigh of relief echoed across executive suites from Huntsville to San Diego.
Federal contractors just lost two safety nets at once. On July 13, 2026, the Department of Defense suspended CMMC Phase 2 third-party certification. Eight days later, the FAR Council closed public comment on a proposed rule to extend NIST SP 800-171 Rev. 3 across every federal contractor - not just defense.
On July 13, 2026, the Department of War (DoW) dropped a memo that sent a ripple of both relief and confusion through the Defense Industrial Base (DIB). CIO Kirsten Davies formally announced the immediate suspension of CMMC Phase II. For many, this felt like the finish line of a marathon had just been moved back ten miles, or perhaps disappeared entirely.
