Topic · assessment

Assessment

Assessment mechanics — readiness, gap analysis, scoping decisions, evidence collection, and the assessment event itself.

RSS feed ↗

trade-press
FBI speed pledge puts the exercise burden on industry
A faster FBI warning is only as useful as the recipient's ability to act on it, and that handoff is the part nobody tests.
FedScoop's Kathy Hsu argues that the FBI's new Cyber Strategy (which aims to compress the interval between threat detection and partner notification from days to hours, then minutes) forces an uncomfortable question onto critical infrastructure operators: how fast can they actually act on an incoming warning? Hsu makes the case for joint government-industry exercises built around a single essential service and a single threat scenario, with agreed criteria for what counts as a successful handoff. CISA already offers the Federal Incident Response Evaluation service for federal entities and runs the biennial Cyber Storm exercise series, but neither is designed to test one specific federal-to-operator notification cycle end to end.
TUE
trade-press
What breaks AI pilots isn't the model, it's the ATO
Teams build against the wrong environment, bolt explainability on after the fact, and treat the compliance review as a formality, then discover the pilot was a rebuild from day one.
Patrick Bryant, who runs an AI implementation firm working with small and mid-size government contractors, lays out the pattern: agencies have pilots running everywhere, but few systems make it through compliance review into an ATO package for daily use. The models work. What breaks is everything around them, the wrong cloud environment, explainability treated as documentation rather than design, human-in-the-loop reviews that collapse under volume, and vendor-risk paperwork nobody scoped time for. The fix isn't flashy: build the first version inside the actual authorization boundary and run the compliance workstream from day one.
OCT 3
trade-press
CMMC pause puts point-in-time assessments on the block
The pause leaves nearly 2,000 already-certified contractors wondering what their Level 2 certification is worth as DoD rethinks the point-in-time model.
The Defense Department has frozen new CMMC third-party assessment requirements and launched a reform task force, suspending the Phase 2 ramp that was scheduled to begin November 2026. Phase 1 self-assessment requirements remain in force, but the freeze leaves nearly 2,000 contractors holding Level 2 certifications uncertain about their status. Cyber AB CEO Matt Travis, in a Federal News Network interview, outlined reform proposals that include replacing point-in-time audits with continuous monitoring and reducing assessment teams from three assessors to two for smaller firms, changes he said could be implemented without new rulemaking.
OCT 3
trade-press
CMMC workloads displacing security duties, ISC2 survey finds
The Phase II pause has layered uncertainty onto a deeper structural problem: compliance preparation that cannibalizes the security work CMMC exists to ensure.
ISC2 surveyed 219 U.S. cybersecurity professionals involved in CMMC. Seventy-six percent support the program, but views on the Phase II pause are nearly split (38% support, 42% oppose). Sixty-six percent report heavier workloads from CMMC preparation, and 32% say they've spent less time on actual cybersecurity duties over the past year. Meanwhile, Redspin reports half its consulting clients have canceled contracts, and a quarter of assessment clients canceled believing "CMMC is going away." Primes are still pushing subs to certify regardless of the DoD review.
SEP 21
independent
DoD Suspends CMMC Phase 2, Launches Reform Review
The second major pause in four years signals structural rethinking (not a tweak) with the scope of review spanning OT, cloud, MSPs, and supply chain obligations.
The Department of Defense suspended CMMC Phase 2 on July 13, 2026, four months before its scheduled November 10 start. Phase 2 would have mandated third-party C3PAO assessments and Level 2 certifications as conditions of award for contracts involving CUI. A Reform Task Force convened in early September to review more than 1,100 RFI comments on assessment scope, cloud and MSP treatment, supply-chain reach, and operational technology applicability. Its report was due to the DoD CIO on September 11 but hasn't been made public. Phase 1 self-assessment requirements and underlying NIST SP 800-171 obligations remain in effect.
SEP 21
trade-press
NIST Publishes SP 800-171A Small-Business Primer
The assessment guide addresses Rev. 3 methodology directly, determination statements and security assessment plans have tripped up small contractors since the revision landed.
NIST released a small-business primer for SP 800-171A Revision 3, the companion assessment guide to the CUI security standard. The resource walks small contractors through assessment procedures, determination statements, and how to build a security assessment plan, areas where under-resourced firms have struggled since Rev. 3 was published. The primer also clarifies what roles different parties play in the CUI ecosystem and explicitly notes that CMMC remains pegged to SP 800-171 Revision 2, urging contractors to check their contracts for which version applies. NIST will host an Oct. 29 webinar on the primer.
SEP 17
trade-press
NYDFS ties AI risk to cyber assessment obligation
The guidance doesn't impose new rules, but it tells examiners exactly where to look, and NYDFS has already found the gaps it's flagging.
NYDFS issued Sept. 10 guidance clarifying that annual cyber risk assessments under its 2017/2023 cybersecurity regulation must consider whether AI adoption, quantum computing advances, supply-chain attacks, ransomware evolution, and geopolitical conflict materially alter a firm's risk profile. The guidance does not create new obligations but identifies common gaps NYDFS has already observed during examinations, including failure to account for emerging technologies and concentration risk from third-party dependencies. Covered entities range from banks and insurers to their service providers.
SEP 14
trade-press
Normal workflows push CUI past CMMC enclave boundaries
When CUI flows through collaboration platforms and subcontractor correspondence, the compliance surface expands beyond the enclave boundary that most preparation efforts are built around.
A Federal News Network commentary argues CMMC compliance programs share a blind spot: the assumption that CUI stays where you put it. In practice, controlled technical information propagates through Teams, email, cloud storage, and subcontractor correspondence as a byproduct of ordinary business. An organization can achieve certification and fall out of scope within days, not through policy failure, but through the normal velocity of project work.
SEP 1
trade-press
DOD to shift CMMC to NIST 800-171 Rev. 3 with expanded assessment scope
The control count drops from 110 to 97, but assessment objectives jump past 420 and new supply-chain risk management requirements push compliance beyond IT's walls.
DOD is planning an interim final rule to transition CMMC Level 2 compliance from NIST SP 800-171 Revision 2 to Revision 3, reducing controls from 110 to 97 while expanding assessment objectives from 320 to roughly 420 and adding supply-chain risk management requirements. Presenters at an Aug. 25 NDIA webinar warned that supply-chain risk management isn't an IT function and that contractors treating 800-171 compliance as a security-team problem will find Rev. 3 especially punishing. No effective date has been set; the CMMC Reform Task Force delivers recommendations in mid-September, and DOD must still issue guidance on organization-defined parameters before contractors can fully align.
AUG 27
trade-press
ADI Urges DoD-Funded Enclaves to Ease CMMC Cost Burden
The trade group's filing proposes shifting assessment and infrastructure costs from thousands of individual small contractors to a single government-sponsored platform rather than leaving each firm to fund its own compliant environment.
The Alliance for Digital Innovation filed recommendations August 14 urging the Defense Department to sponsor a centrally funded, government-accredited enclave that small and nontraditional defense contractors could onboard into and inherit CMMC controls from. The filing, responding to DoD's July 13 RFI, also proposes a $500,000 contract-value threshold below which Level 2 third-party assessment costs would be recoverable. The recommendations arrive as the CMMC Reform Task Force prepares mid-September guidance that will shape the paused phase two rollout.
AUG 26
trade-press
ITI pushes DOD to accept FedRAMP controls under CMMC
Reciprocity would end the wasteful re-auditing of controls FedRAMP already validated; the AI fast-track is a separate ask entirely.
ITI urged DOD to establish formal FedRAMP-CMMC reciprocity in comments filed during the Phase Two pause, arguing that re-auditing controls already validated under FedRAMP produces "duplicative cost without a proportionate increase in security." The filing proposes a "commercial solutions equivalency" pathway where contractors inherit platform-level FedRAMP assurances rather than re-certifying per project. DOD already recognized FedRAMP Moderate equivalency for cloud providers handling CUI in a January 2024 memo, ITI wants that extended to commercial software platforms broadly and codified in a common control matrix.
AUG 25
trade-press
VA fails FISMA audit, non-concurs on 19 recommendations
VA argues the FISMA audit captured a snapshot that missed its continuous monitoring controls, but GAO data shows some vulnerabilities at the department persisted across multiple assessment cycles.
The VA Office of Inspector General reported Monday that an independent FISMA audit for fiscal 2025 found the department deficient in seven areas: vulnerability management, incident response, configuration management, identity and access controls, contingency planning, background investigations, and agency-wide security management. VA formally non-concurred with all 19 recommendations, arguing the audit captured a "snapshot in time" while the department "manages cybersecurity continuously through ongoing monitoring, automated tools, and risk-based decision making." The non-concurrence is unusual, agencies typically accept or negotiate OIG findings. VA's position is complicated by a December 2025 GAO report showing high-risk vulnerabilities at the department persisted 17 to 21 months, well past VA's own 60-day remediation policy.
AUG 25
trade-press
Contractor SPRS Confidence Falls from 89% to 65% in One Year
More defense contractors are reporting SPRS scores than ever, but confidence in their accuracy has collapsed, undercutting the self-attestation model while CMMC phase two remains paused.
Per Inside Cybersecurity, CyberSheath's annual survey of 302 defense contractors found 88% now report a positive SPRS score, but only 65% are confident in their accuracy, down from 89% last year and 94% in 2024. Average annual cybersecurity spend hit $155,204, yet median self-assessed CMMC readiness sits at 70%. Just 1% of respondents say they're completely ready. CyberSheath, a managed security provider that sells CMMC compliance services, commissioned the survey conducted by Merrill Research.
AUG 25
trade-press
CMMC program operational despite phase-two pause, Cyber AB says
The pause is tactical, not strategic, but the task force's mandate to "drastically reduce costs" could reshape level two for small and non-traditional shops before anything becomes contractually mandatory.
CMMC's phase-two implementation timeline is on hold after DoD's July 13 pause and 60-day task-force review, but Cyber AB CEO Matthew Travis told a July 28 town hall that the program itself remains operational: C3PAOs are conducting level two certifications, DFARS 252.204-7012 compliance is still in force, and both CMMC portals remain open. Travis framed certification as "the best insurance policy against False Claims Act risk" and urged contractors to respond to DoD's RFI by the Aug. 14 deadline. The task force's authority to alter the rule's cost, scope, or timing remains undefined, and the Cyber AB hasn't been contacted for tier-four participation yet.
AUG 25
trade-press
BlueVoyant exec: use CMMC pause to build enterprise monitoring
Lonny Anderson, a former CMMC skeptic, argues the Phase 2 suspension is the right moment to replace self-attestation with continuous external monitoring, and that reverting to the honor system while DOD deliberates is the real risk.
Former NSA chief technology officer Lonny Anderson, now president of BlueVoyant Government Solutions, published an open argument Wednesday urging the Defense Department to use the CMMC Phase 2 suspension to adopt an enterprise accountability model (independent assessment plus continuous external monitoring and shared remediation funding) rather than letting the pause lapse into pure self-attestation. The piece marks a public shift from CMMC skeptic to conditional supporter. Anderson's central claim: many NIST SP 800-171 failures, like expired TLS certificates and exposed misconfigured services, are visible from the outside right now, regardless of whether formal C3PAO assessments are running.
AUG 20
trade-press
CMMC architect wants AI to sharpen CUI targeting
Katie Arrington says the standard shouldn't budge, but inconsistent CUI determinations across the defense industrial base are wasting money and leaving real exposure, and AI-assisted triage could fix the mismatch without touching the security bar.
Katie Arrington, who built the CMMC program, argues in a NextGov op-ed that the framework's requirements shouldn't loosen, but its targeting needs sharpening. CUI determinations remain inconsistent across the defense industrial base: some small businesses get assessed for data that isn't really CUI, while others handling sensitive material slide through with lighter requirements. Her fix: use AI to do first-pass sorting of contract language and CUI flow-down, with a human contracting officer making the final call. She also calls for a dedicated SBA loan program to fund cybersecurity investment at small businesses outside the defense supply chain.
AUG 17
trade-press
CISA Threat-Hunting Lead Offers BOD 26-02 Workarounds
Segmentation and monitoring aren't decommissioning, and CISA knows it, the agency is quietly building an on-ramp for resource-strapped federal shops that can't meet the 18-month deadline.
CISA Deputy Associate Director for Threat Hunting Robert Thompson laid out interim mitigations for federal agencies that can't immediately decommission end-of-support edge devices under February's Binding Operational Directive 26-02. The alternatives (network segmentation, IP whitelisting, MFA, and aggressive logging) are meant to buy time for agencies short on funding and staffing. But Thompson stopped short of saying these measures satisfy the directive's 18-month decommissioning requirement, leaving agencies that stall on replacement exposed if those devices are breached.
AUG 14
trade-press
$1.1B VA benefits platform overhaul lacks schedule, cost estimate, OIG finds
The Booz Allen contract was supposed to close this month. The new target is Q2 2034, and VA never built a GAO-compliant schedule or lifecycle cost estimate.
A VA OIG audit found the $1.1 billion Benefits Enterprise Platform modernization, a Booz Allen Hamilton contract meant to close this month, has been pushed to Q2 2034 with no GAO-compliant program schedule and no reliable lifecycle cost estimate. The watchdog also found OIT hosted applications without required security assessments, leaving vulnerabilities unaddressed since 2021. VA concurred with the recommendations. The platform supports pension, vocational rehabilitation, and employment benefits systems, so the eight-year slip doesn't stop at BEP; it cascades across every business line that depends on it.
AUG 11
trade-press
Early CMMC adopters paid up. Now Phase 2 is frozen.
The Pentagon suspension doesn't void the certification, but it does void the first-mover advantage many small contractors bet on.
Contractors who earned CMMC Level 2 certification ahead of the Phase 2 mandate are now navigating a suspended program. IntelliGenesis, a small business, spent four months and a seven-day-a-week sprint to certify, driven partly by primes threatening to drop non-certified subs from teams. The July 13 DoD suspension froze Phase 2's third-party assessment ramp while keeping Phase 1 self-assessments in force. Early adopters say they'd do it again, but the competitive edge they bought is on hold alongside the requirement that created it.
AUG 7
trade-press
BOD 26-04 mandates risk-based patching by Dec. 7
Gold Eagle's arrival will expose which agencies built remediation infrastructure and which only built discovery.
Executive Order 14409 establishes Gold Eagle, a national vulnerability-sharing clearinghouse run by Treasury, CISA, NSA, and the National Cyber Director. CISA Binding Operational Directive 26-04 replaces one-size-fits-all patching deadlines with severity-based timelines: critical flaws must be fixed within three days, with agencies operating on the new standard by December 7. It's the first time federal remediation deadlines are pegged to vulnerability severity rather than a blanket clock, and Gold Eagle's arrival will make the gap between agencies that built remediation pipelines and those that only built discovery impossible to ignore.
AUG 4
regulator
Three More 3PAOs Join GovRAMP Discount Program
The second expansion since the April launch means providers who've completed Progressing or Core verification now have more assessors competing for their business at up to 30% off.
GovRAMP added SecureIT, AARC-360, and RSM US LLP to its voluntary 3PAO discount program on July 22, the second expansion since the April 2026 launch. Participating assessors offer up to 30% off independent security assessments for service providers that have completed the Progressing Security Snapshot program or achieved Core verification. The cumulative pool of discount-offering 3PAOs continues to grow, which matters most for small and mid-market cloud providers for whom assessment cost has been a real barrier to verification.
JUL 26
regulator
GovRAMP Publishes Authorization Playbook Without Sponsorship SLA
A documented playbook replaces opaque criteria, but the government sponsorship requirement, the gate that decides listing, still has no published timeline.
GovRAMP has published a formal 8-step process for achieving Authorized or Provisionally Authorized status. The pathway requires a 3PAO-conducted Security Assessment Report, full documentation, and either government sponsorship or approval through the GovRAMP Approvals Committee. The codification replaces previously opaque criteria with a documented playbook, but the sponsorship requirement, the step that determines whether a product appears on the Authorized Product List, carries no published SLA. Vendors gain a documented path but no timeline for the gatekeeping step.
JUL 26
trade-press
TIGTA finds security failures at two IRS Zero Paper sites
The paper backlog has become a contractor-security problem, and the IRS is learning that while taxpayer documents are already onsite.
FedScoop reports that the Treasury Inspector General for Tax Administration found security failures at two Zero Paper Initiative contractor sites: 48% of vulnerabilities at one site were not fixed on time, another used unauthorized scanning software, and 14 employees without IRS authorization entered taxpayer-document areas 1,375 times. Primes, subs and assessors supporting ZPI now face the audit version of a pattern: TIGTA’s February schedule warning has become an active control-failure finding before the December 2030 digitization mandate.
JUL 20
trade-press
DoD freezes third-party CMMC assessments for 60-day review
A program built to prove contractor discipline just admitted its own cost model may be undisciplined.
DoD suspended all Cybersecurity Maturity Model Certification third-party assessment requirements while it runs a 60-day review, Federal News Network reports. The review includes a request for information and listening sessions aimed at small business cost concerns. Contractors, subcontractors, C3PAOs and assessors now have stalled certification timelines, plus the more useful problem: DoD has finally stopped treating implementation pain as a communications issue.
JUL 20
trade-press
DoD suspends CMMC third-party assessments indefinitely
Small-business cost pressure has stopped the verification model DoD built after deciding self-attestation was failing.
Federal News Network reports that DoD has suspended Cybersecurity Maturity Model Certification (CMMC) third-party assessment requirements indefinitely and opened a 60-day program review, with recommendations expected by late September. Primes and subcontractors face frozen certification pathways, while CMMC Third-Party Assessment Organizations (C3PAOs) lose near-term assessment revenue. DoD is reopening the verification model it built because contractor self-attestation did not work.
JUL 17
trade-press
CMMC Phase II pause leaves audits likely to return
Schedule relief is real, but the verification problem that created CMMC is still sitting on DoD’s desk.
Breaking Defense reports that Katie Arrington and other industry voices expect DoD’s CMMC Phase II pause to be temporary, with cybersecurity audits likely to return. Defense contractors preparing for assessments get schedule relief, but no exit from compliance. The hard part remains verification: DoD still needs a way to know whether suppliers actually meet the requirements.
JUL 16
trade-press
DoD pauses CMMC Phase II, seeks burden-cutting input
DoD kept data-protection obligations alive while asking whether the CMMC machinery is consuming work that should harden systems.
Federal News Network sponsored commentary from Avatara CEO Rob McCormick says DoD suspended Cybersecurity Maturity Model Certification Phase II and posted a SAM.gov request for information on reducing compliance costs, administrative burden and operational complexity. Defense Industrial Base contractors still face existing covered defense information obligations. The vendor pitch is predictable, but the useful point is concrete: screenshots and evidence collection are not the same thing as resilient systems.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
vendor
AWS Security Hub adds Network Scanning for public exposure
The useful distinction is actual internet reachability versus configuration theory, assuming teams already live inside Security Hub.
AWS introduced Network Scanning in Security Hub to probe resources from the internet and identify public IP addresses, virtual machines, load balancers, reachable ports and detected services across AWS and Azure environments. Each reachable port generates a Security Hub finding with evidence. For security teams, the value is narrower than the announcement sounds: better confirmation of exposed services inside AWS’s existing findings workflow.
JUL 9
trade-press
VA OIG raises PATS-R risk after low-risk cloud review
A medical-records access path does not become low impact because most users say they do not need it.
FedScoop reports that the VA Office of Inspector General found the Patient Advocate Tracking System-Replacement was wrongly categorized as low risk after its November 2023 cloud transfer, despite access to veteran medical records. VA’s IT office raised PATS-R to moderate after March 2025 preliminary findings. Assessors and agency CISOs should notice the harder point: access controls and user reviews, not the label, are where the audit found the real exposure.
JUL 7
trade-press
FedRAMP 2026 shifts providers to continuous evidence model
The old FedRAMP habit, pass the assessment and manage the paperwork, is becoming a liability for teams without live operational telemetry.
FedScoop’s commentary says FedRAMP 2026 moves the Federal Risk and Authorization Management Program away from point-in-time assessment toward continuous evidence, real-time vulnerability data and coordinated security operations. Primes, contractors and managed service providers selling into federal cloud environments will need evidence automation, risk triage and cross-functional ownership. The missing piece is operationally important: FedScoop does not state the implementation timeline, enforcement dates or treatment of legacy authorization holders.
JUL 6
trade-press
NIST opens OT asset management project for comments
The useful part is the premise: zero trust, incident response and vulnerability work all fail when operators cannot inventory the plant.
NIST’s National Cybersecurity Center of Excellence released a draft project description for operational technology asset management and visibility, with comments due July 31. The project would work with asset owners, operators and solution providers on commercially available approaches for discovery, inventory, configuration management and change management. OT teams are the audience, and NIST is starting where many programs still break: asset visibility.
JUN 26
trade-press
CMMC forces defense contractors to produce assessment evidence
The hard part was never writing the policy; it was proving the controls existed when award pressure arrived.
Federal News Network’s interview with CyberSheath CEO Emil Sayegh says Cybersecurity Maturity Model Certification pressure is now showing up through contracting officers, primes and Supplier Performance Risk System scores. Defense contractors and subcontractors handling controlled unclassified information are being pushed to move from plans to evidence. The useful warning is narrow: an assessor, or even a self-assessment, will not credit an Excel roadmap as implementation.
JUN 5
standards
NIST releases SP 800-172r3, tightening enhanced CUI controls
The third major revision in five years expands access control, network segmentation, asset management, and supply chain requirements, and no transition timeline for r2 contractors exists yet.
NIST published SP 800-172r3 and its companion assessment guide SP 800-172Ar3 on May 13, 2026, adding enhanced requirements across access control, network segmentation, asset management, and supply chain security for contractors handling controlled unclassified information (CUI) in nonfederal systems. Assessors must update evaluation procedures to match r3 or their assessments will be considered non-compliant. NIST has not announced a compliance deadline for contractors currently operating under r2, nor whether existing r2 assessments remain valid during any transition period.
MAY 23
regulator
GovRAMP adds five 3PAOs to assessment discount program
The roster now covers ten accredited firms, but the 30% discount only reaches providers who have already completed GovRAMP's preparatory pathway.
GovRAMP added 360 Advanced, Data Lock Consulting Group, Lunarline, Schellman, and Securisea to its 3PAO Discount Program, bringing total participating firms to ten. The program offers up to 30% off independent security assessments, but only for providers that have completed the GovRAMP Progressing Security Snapshot or achieved GovRAMP Core verification. Founding participants A-LIGN, Prescient Security, Coalfire, Fortreum, and RISCPoint remain in the program. The discount is explicitly scoped to smaller and midsize technology vendors pursuing SLED and federal government work through GovRAMP verification.
MAY 22
trade-press
GAO finds uneven search methods hide China-linked equipment on agency networks
Four agencies reporting zero findings while DOD and DOE found covered devices is a methodology gap, not a clean bill of health.
A May 19 GAO report on six federal agencies' compliance with the Section 899 NDAA prohibition on China-linked telecom and video surveillance equipment found that only DOD conducted physical searches, and only DOD and DOE found covered devices. DHS, DOJ, State, and Treasury all reported zero findings, but none ran physical searches. GAO identified procurement record gaps, supply-chain opacity, and rebranding as structural limits on every agency's search approach. The divergence in methods makes the zero-finding results hard to read as actual risk clearance.
MAY 21