The Department of War suspended CMMC Phase 2 on July 13, 2026. But your obligation to protect sensitive data wasn’t suspended with it. If you wait for a mandate to force your hand, it’s going to cost you a lot more than fixing the gaps you already know
NIST 800-171 compliance hasn’t gone anywhere despite the September 3 class deviation memo that pulled CMMC requirements out of active defense contracts. While you might not be bound by an assessment, right now, you still owe the Department of War data protection. In this article, I’ll quickly cover the changes we’ve seen over the past couple of months and how managed IT services from an experienced provider can help you move forward. Key Takeaways A
The purpose of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 is to protect Controlled Unclassified Information (CUI) in nonfederal systems and organizations. Businesses who want to fill Department of Defense (DoD) contracts must have their security controls in compliance with NIST 800-171 to meet the regulations. This is accomplished with the Supplier Performance Risk System (SPRS). So, what do government contractors, or organizations who want to start contracting, need to
CMMC Level 1 is the foundational tier of the Cybersecurity Maturity Model Certification program. It covers 15 basic security requirements derived from FAR Clause 52.204-21. If your contract specifies a CMMC Level 1 assessment and you only handle FCI across all contracts, then you fall under Level 1. Here’s what you need to know. Key Takeaways CMMC Level 1 requires annual self-assessment and SPRS affirmation against 15 security controls from FAR 52.204-21. It applies to
Managed IT services help government contractors manage complex technology and security requirements without overloading their teams. As compliance frameworks like Cybersecurity Maturity Model Certification (CMMC) and NIST 800‑171 expand in scope, contractors must balance cybersecurity, operations, and budget constraints. This article explains how MSPs reduce that burden while supporting secure, compliant growth. Key Takeaways MSPs reduce compliance risk by operationalizing CMMC and NIST 800‑171. MSPs can manage contractors’ day‑to‑day IT so they can focus on
When CMMC is presented as a list of security controls that need funding, it is easy to see it as “yet another IT expense.” That’s
Explore the most important new and upcoming regulations you need to know about. Upcoming cybersecurity regulations for 2026 include a proposed FAR rule for Controlled
The pause changed certain assessment requirements in federal contracts, but it did not remove the process by which cybersecurity requirements reach subcontractors. Prime contractors are
Expert checklists, guides, and research built for defense contractors.
