Topic · assessment

Assessment

Assessment mechanics — readiness, gap analysis, scoping decisions, evidence collection, and the assessment event itself.

RSS feed ↗

trade-press
TIGTA finds security failures at two IRS Zero Paper sites
The paper backlog has become a contractor-security problem, and the IRS is learning that while taxpayer documents are already onsite.
FedScoop reports that the Treasury Inspector General for Tax Administration found security failures at two Zero Paper Initiative contractor sites: 48% of vulnerabilities at one site were not fixed on time, another used unauthorized scanning software, and 14 employees without IRS authorization entered taxpayer-document areas 1,375 times. Primes, subs and assessors supporting ZPI now face the audit version of a pattern: TIGTA’s February schedule warning has become an active control-failure finding before the December 2030 digitization mandate.
MON
trade-press
DoD freezes third-party CMMC assessments for 60-day review
A program built to prove contractor discipline just admitted its own cost model may be undisciplined.
DoD suspended all Cybersecurity Maturity Model Certification third-party assessment requirements while it runs a 60-day review, Federal News Network reports. The review includes a request for information and listening sessions aimed at small business cost concerns. Contractors, subcontractors, C3PAOs and assessors now have stalled certification timelines, plus the more useful problem: DoD has finally stopped treating implementation pain as a communications issue.
MON
trade-press
DoD suspends CMMC third-party assessments indefinitely
Small-business cost pressure has stopped the verification model DoD built after deciding self-attestation was failing.
Federal News Network reports that DoD has suspended Cybersecurity Maturity Model Certification (CMMC) third-party assessment requirements indefinitely and opened a 60-day program review, with recommendations expected by late September. Primes and subcontractors face frozen certification pathways, while CMMC Third-Party Assessment Organizations (C3PAOs) lose near-term assessment revenue. DoD is reopening the verification model it built because contractor self-attestation did not work.
JUL 17
trade-press
CMMC Phase II pause leaves audits likely to return
Schedule relief is real, but the verification problem that created CMMC is still sitting on DoD’s desk.
Breaking Defense reports that Katie Arrington and other industry voices expect DoD’s CMMC Phase II pause to be temporary, with cybersecurity audits likely to return. Defense contractors preparing for assessments get schedule relief, but no exit from compliance. The hard part remains verification: DoD still needs a way to know whether suppliers actually meet the requirements.
JUL 16
trade-press
DoD pauses CMMC Phase II, seeks burden-cutting input
DoD kept data-protection obligations alive while asking whether the CMMC machinery is consuming work that should harden systems.
Federal News Network sponsored commentary from Avatara CEO Rob McCormick says DoD suspended Cybersecurity Maturity Model Certification Phase II and posted a SAM.gov request for information on reducing compliance costs, administrative burden and operational complexity. Defense Industrial Base contractors still face existing covered defense information obligations. The vendor pitch is predictable, but the useful point is concrete: screenshots and evidence collection are not the same thing as resilient systems.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
vendor
AWS Security Hub adds Network Scanning for public exposure
The useful distinction is actual internet reachability versus configuration theory, assuming teams already live inside Security Hub.
AWS introduced Network Scanning in Security Hub to probe resources from the internet and identify public IP addresses, virtual machines, load balancers, reachable ports and detected services across AWS and Azure environments. Each reachable port generates a Security Hub finding with evidence. For security teams, the value is narrower than the announcement sounds: better confirmation of exposed services inside AWS’s existing findings workflow.
JUL 9
trade-press
VA OIG raises PATS-R risk after low-risk cloud review
A medical-records access path does not become low impact because most users say they do not need it.
FedScoop reports that the VA Office of Inspector General found the Patient Advocate Tracking System-Replacement was wrongly categorized as low risk after its November 2023 cloud transfer, despite access to veteran medical records. VA’s IT office raised PATS-R to moderate after March 2025 preliminary findings. Assessors and agency CISOs should notice the harder point: access controls and user reviews, not the label, are where the audit found the real exposure.
JUL 7
trade-press
FedRAMP 2026 shifts providers to continuous evidence model
The old FedRAMP habit, pass the assessment and manage the paperwork, is becoming a liability for teams without live operational telemetry.
FedScoop’s commentary says FedRAMP 2026 moves the Federal Risk and Authorization Management Program away from point-in-time assessment toward continuous evidence, real-time vulnerability data and coordinated security operations. Primes, contractors and managed service providers selling into federal cloud environments will need evidence automation, risk triage and cross-functional ownership. The missing piece is operationally important: FedScoop does not state the implementation timeline, enforcement dates or treatment of legacy authorization holders.
JUL 6
trade-press
NIST opens OT asset management project for comments
The useful part is the premise: zero trust, incident response and vulnerability work all fail when operators cannot inventory the plant.
NIST’s National Cybersecurity Center of Excellence released a draft project description for operational technology asset management and visibility, with comments due July 31. The project would work with asset owners, operators and solution providers on commercially available approaches for discovery, inventory, configuration management and change management. OT teams are the audience, and NIST is starting where many programs still break: asset visibility.
JUN 26
trade-press
CMMC forces defense contractors to produce assessment evidence
The hard part was never writing the policy; it was proving the controls existed when award pressure arrived.
Federal News Network’s interview with CyberSheath CEO Emil Sayegh says Cybersecurity Maturity Model Certification pressure is now showing up through contracting officers, primes and Supplier Performance Risk System scores. Defense contractors and subcontractors handling controlled unclassified information are being pushed to move from plans to evidence. The useful warning is narrow: an assessor, or even a self-assessment, will not credit an Excel roadmap as implementation.
JUN 5
standards
NIST releases SP 800-172r3, tightening enhanced CUI controls
The third major revision in five years expands access control, network segmentation, asset management, and supply chain requirements, and no transition timeline for r2 contractors exists yet.
NIST published SP 800-172r3 and its companion assessment guide SP 800-172Ar3 on May 13, 2026, adding enhanced requirements across access control, network segmentation, asset management, and supply chain security for contractors handling controlled unclassified information (CUI) in nonfederal systems. Assessors must update evaluation procedures to match r3 or their assessments will be considered non-compliant. NIST has not announced a compliance deadline for contractors currently operating under r2, nor whether existing r2 assessments remain valid during any transition period.
MAY 23
regulator
GovRAMP adds five 3PAOs to assessment discount program
The roster now covers ten accredited firms, but the 30% discount only reaches providers who have already completed GovRAMP's preparatory pathway.
GovRAMP added 360 Advanced, Data Lock Consulting Group, Lunarline, Schellman, and Securisea to its 3PAO Discount Program, bringing total participating firms to ten. The program offers up to 30% off independent security assessments, but only for providers that have completed the GovRAMP Progressing Security Snapshot or achieved GovRAMP Core verification. Founding participants A-LIGN, Prescient Security, Coalfire, Fortreum, and RISCPoint remain in the program. The discount is explicitly scoped to smaller and midsize technology vendors pursuing SLED and federal government work through GovRAMP verification.
MAY 22
trade-press
GAO finds uneven search methods hide China-linked equipment on agency networks
Four agencies reporting zero findings while DOD and DOE found covered devices is a methodology gap, not a clean bill of health.
A May 19 GAO report on six federal agencies' compliance with the Section 899 NDAA prohibition on China-linked telecom and video surveillance equipment found that only DOD conducted physical searches, and only DOD and DOE found covered devices. DHS, DOJ, State, and Treasury all reported zero findings, but none ran physical searches. GAO identified procurement record gaps, supply-chain opacity, and rebranding as structural limits on every agency's search approach. The divergence in methods makes the zero-finding results hard to read as actual risk clearance.
MAY 21