Topic · assessment

Assessment

RSS feed ↗

standards
NIST releases SP 800-172r3, tightening enhanced CUI controls
The third major revision in five years expands access control, network segmentation, asset management, and supply chain requirements, and no transition timeline for r2 contractors exists yet.
NIST published SP 800-172r3 and its companion assessment guide SP 800-172Ar3 on May 13, 2026, adding enhanced requirements across access control, network segmentation, asset management, and supply chain security for contractors handling controlled unclassified information (CUI) in nonfederal systems. Assessors must update evaluation procedures to match r3 or their assessments will be considered non-compliant. NIST has not announced a compliance deadline for contractors currently operating under r2, nor whether existing r2 assessments remain valid during any transition period.
YESTERDAY
regulator
GovRAMP adds five 3PAOs to assessment discount program
The roster now covers ten accredited firms, but the 30% discount only reaches providers who have already completed GovRAMP's preparatory pathway.
GovRAMP added 360 Advanced, Data Lock Consulting Group, Lunarline, Schellman, and Securisea to its 3PAO Discount Program, bringing total participating firms to ten. The program offers up to 30% off independent security assessments, but only for providers that have completed the GovRAMP Progressing Security Snapshot or achieved GovRAMP Core verification. Founding participants A-LIGN, Prescient Security, Coalfire, Fortreum, and RISCPoint remain in the program. The discount is explicitly scoped to smaller and midsize technology vendors pursuing SLED and federal government work through GovRAMP verification.
FRI
trade-press
GAO finds uneven search methods hide China-linked equipment on agency networks
Four agencies reporting zero findings while DOD and DOE found covered devices is a methodology gap, not a clean bill of health.
A May 19 GAO report on six federal agencies' compliance with the Section 899 NDAA prohibition on China-linked telecom and video surveillance equipment found that only DOD conducted physical searches, and only DOD and DOE found covered devices. DHS, DOJ, State, and Treasury all reported zero findings, but none ran physical searches. GAO identified procurement record gaps, supply-chain opacity, and rebranding as structural limits on every agency's search approach. The divergence in methods makes the zero-finding results hard to read as actual risk clearance.
THU

Assessment

NIST releases SP 800-172r3, tightening enhanced CUI controls

GovRAMP adds five 3PAOs to assessment discount program

GAO finds uneven search methods hide China-linked equipment on agency networks