Titled ‘Committed to the Mission: The State of the DIB with CMMC in Flux,’ the RedSpin report found that 75% of respondents continued to see value in achieving CMMC Level 2 certification beyond contract eligibility.

The government’s implementation timeline may be under review, but the underlying cybersecurity obligations, contractual requirements and business pressures facing the defense industry have not disappeared.

Redspin’s third annual DIB cyber survey finds most respondents are continuing toward Level 2 certification or have already achieved it, while cybersecurity spending largely remains unchanged.

Late adopters are most inclined to slow certification progress.

Stacy Bostjanick, a former DoD executive and Tara Lemieux, an Army veteran, electronic warfare signals intelligence officer, explain why CMMC needs to continue while Rob Teague shares the issue with SMBs tackling additional requirements to contract.

The Pentagon’s decision to pause phase two of the CMMC program has resulted in workforce cuts at some assessment firms and contractors delaying their assessments, as the defense industrial base awaits the results from an internal review of the initiative.

A Cybersecurity Maturity Model Certification Reform Task Force has until September 13 to report to the Department of
War’s CIO.

Third party assessment organizations are urging the Pentagon to make changes to requirements for assessors and the clearance process under the CMMC, as the Defense Department considers options to increase capacity during a review of the initiative.

The ongoing pause and review of CMMC puts the fate of the program — and the assessment organizations planning to certify contractors’ cybersecurity posture — into doubt…

Industry professionals, including our very own Ned Butler and Rob Teague weigh in on the suspension pauses third-party CMMC audits but not the underlying legal obligation to protect CUI

The Defense Department on July 13 suspended the Phase 2 requirements for its Cybersecurity Maturity Model Certification program and initiated a review of the effort, drawing both praise and criticism from experts.

The Defense Department wants to introduce PQC requirements into the CMMC program, but experts warn industry and the underlying technology is far from ready.

Redspin’s Thomas Graham breaks down why CMMC costs are catching many DoD contractors off guard, explaining that the real financial burden stems from years of delayed cybersecurity compliance, not the certification itself.

Thomas Graham discusses assessment demand, costs, readiness timelines, and the rigor of CMMC assessments.

The entire DIB must remember that CMMC compliance is a continual journey that is necessary to protect our warfighters and our nation.

Independent Third‑Party Validation Reinforces Redspin as a Trusted External Service Provider (ESP) for the Defense Industrial Base

Organizations instinctively assign complete cybersecurity ownership to information technology (IT). Multifactor authentication, phishing drills, security awareness training and virtual private networks are all visible markers of a “serious” program, and they all live within the IT function.

New Redspin Report finds lagging execution despite increased CMMC awareness.

A new survey finds two-thirds of contractors prepared for the cybersecurity certification over many years, while nearly 40% have not yet completed required self-assessments.

One week into the Pentagon’s effort to move its cybersecurity compliance program from policy to practice, adoption of the CMMC program is gaining momentum, but execution remains slow, according to a new industry survey.