The clock is ticking for contractors to comply with the Department of Defense’s (DoD) long-anticipated cybersecurity compliance policy.

Engage a CMMC certified professional or assessor, or at least assess your contracts and clarify CUI expectations with your contracting officer.

The Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) program officially went into effect on December 16, 2024, and it kicked off with a bang.

CMMC compliance is now critical for defense contractors, with hidden cloud costs, unclear provider roles and tenant ownership risks threatening budgets and certification. Without due diligence, the cheapest CMMC cloud option can quickly become the most costly.

Dr. Thomas Graham, vice president and chief information security officer at Redspin, lays out key principles for contractors to follow in the preparation and execution of their compliance with the Cybersecurity Maturity Model Certification.

To fully appreciate the importance of Controlled Unclassified Information (CUI), it’s essential to understand its origins and significance.

To fully appreciate the importance of Controlled Unclassified Information (CUI), it’s essential to understand its origins and significance.

Fifty-eight percent of defense contractors are unprepared to meet the requirements for the Pentagon’s Cybersecurity Maturity Model Certification program, according to a survey conducted by the Defense Department initiative’s first authorized third-party assessment organization.

A survey conducted by Redspin found that over half of respondents did not feel prepared for CMMC’s requirements, which will go into effect by mid-2025.

The Defense Department’s Cybersecurity Maturity Model Certification final rule may be in effect, but there is still a significant readiness gap in the defense industrial base, according to a new report released by cybersecurity company Redspin.

CMMC is now in effect, leaving no room for delay. Organizations must act now to implement requirements or risk falling behind in securing future Defense Department contracts.

Redspin’s VP & CISO, Thomas Graham, emphasizes the need for further guidance on FedRAMP equivalency, a critical area impacting contractors under the final CMMC rule.