Stacy Bostjanick, a former DoD executive and Tara Lemieux, an Army veteran, electronic warfare signals intelligence officer, explain why CMMC needs to continue while Rob Teague shares the issue with SMBs tackling additional requirements to contract.

The Pentagon’s decision to pause phase two of the CMMC program has resulted in workforce cuts at some assessment firms and contractors delaying their assessments, as the defense industrial base awaits the results from an internal review of the initiative.

A Cybersecurity Maturity Model Certification Reform Task Force has until September 13 to report to the Department of
War’s CIO.

Third party assessment organizations are urging the Pentagon to make changes to requirements for assessors and the clearance process under the CMMC, as the Defense Department considers options to increase capacity during a review of the initiative.

The ongoing pause and review of CMMC puts the fate of the program — and the assessment organizations planning to certify contractors’ cybersecurity posture — into doubt…

Industry professionals, including our very own Ned Butler and Rob Teague weigh in on the suspension pauses third-party CMMC audits but not the underlying legal obligation to protect CUI

The Defense Department on July 13 suspended the Phase 2 requirements for its Cybersecurity Maturity Model Certification program and initiated a review of the effort, drawing both praise and criticism from experts.

The Defense Department wants to introduce PQC requirements into the CMMC program, but experts warn industry and the underlying technology is far from ready.

Redspin’s Thomas Graham breaks down why CMMC costs are catching many DoD contractors off guard, explaining that the real financial burden stems from years of delayed cybersecurity compliance, not the certification itself.

Thomas Graham discusses assessment demand, costs, readiness timelines, and the rigor of CMMC assessments.

The entire DIB must remember that CMMC compliance is a continual journey that is necessary to protect our warfighters and our nation.

Independent Third‑Party Validation Reinforces Redspin as a Trusted External Service Provider (ESP) for the Defense Industrial Base

Organizations instinctively assign complete cybersecurity ownership to information technology (IT). Multifactor authentication, phishing drills, security awareness training and virtual private networks are all visible markers of a “serious” program, and they all live within the IT function.

New Redspin Report finds lagging execution despite increased CMMC awareness.

A new survey finds two-thirds of contractors prepared for the cybersecurity certification over many years, while nearly 40% have not yet completed required self-assessments.

One week into the Pentagon’s effort to move its cybersecurity compliance program from policy to practice, adoption of the CMMC program is gaining momentum, but execution remains slow, according to a new industry survey.

New Redspin Report finds lagging execution despite increased CMMC awareness.

This capacity bottleneck may prove more disruptive to federal contracting than any single technical control.

Pentagon Formally Rolls Out Long-Awaited Cybersecurity Requirements for Vendors

Experts told DefenseScoop that readiness gaps are fueled by CMMC’s controversial history, misconceptions of what the rule change means and challenges in proving compliance.