Loading story…
The US Department of Defense is implementing the Cybersecurity Maturity Model Certification 2.0 (CMMC), requiring over 300,000 military contracting companies to enhance their cybersecurity protections. Despite the critical importance of these safeguards, more than half of defense contractors are reportedly unprepared for the initial phase of CMMC, which is set to begin imminently. Whistleblowers have played a significant role in exposing non-compliance, leading to major settlements by companies such as Raytheon and Aerojet Rocketdyne under the False Claims Act. The new requirements not only impact primary contractors but also extend to subcontractors and external service providers, including cloud service providers, who may not fully understand their obligations under CMMC.
Many contractors and their service providers face confusion regarding the scope of CMMC, particularly in distinguishing between subcontractors and external service providers, and in understanding which IT and information security services fall under compliance requirements. Failure to include all relevant service providers in CMMC assessments could result in non-compliance and potential loss of business. Registered Practitioner Organizations are offering guidance to help organizations navigate these complexities, emphasizing the need for comprehensive compliance programs that address both direct and indirect CMMC obligations across the defense supply chain.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Help Net Security reported findings from the 2026 Secureframe National Cybersecurity Summit showing CMMC adoption spreading across the defense industrial base while many contractors still center security programs on compliance rather than resilience. The survey highlighted high readiness costs, assessor inconsistency, CUI scoping challenges, third-party risk, reported supply-chain compromises, and widespread concern about AI-driven attacks.
Follow-on coverage noted that CMMC enforcement had commenced, reinforcing that the program had moved from planning into active implementation. The reporting underscored the operational impact on defense-sector organizations seeking or maintaining DoD contracts.
News coverage across several security and government publications described the start of CMMC enforcement as a major compliance shift for the defense supply chain. The reports emphasized that prime contractors and lower-tier suppliers would now face formal cybersecurity certification requirements.
The Department of Defense began enforcement of the Cybersecurity Maturity Model Certification program, ending years of warnings and preparation for the defense industrial base. The new rules started applying to contractors and subcontractors handling covered defense information.
A report published after CMMC enforcement began alleged that some defense contractors were silencing or sidelining cybersecurity watchdogs instead of addressing compliance and security concerns. The reporting framed this as a governance problem affecting the credibility of contractor cybersecurity practices.
As enforcement started, security and compliance experts published guidance explaining how CMMC obligations extend to subcontractors, managed service providers, and other third parties in the defense supply chain. The guidance focused on scoping, responsibility boundaries, and certification implications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcenextgov.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcedatabreaches.net
Open sourcetrustedsec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Defense has suspended **Phase 2** of the Cybersecurity Maturity Model Certification (**CMMC**) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said **Phase 1** self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a **60-day review** of the broader framework. Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as **NIST SP 800-171** controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.
Jul 17, 2026
The **NSA** published *Zero Trust Implementation Guidelines* **Phase One** and **Phase Two**, expanding its series beyond earlier *Primer* and *Discovery Phase* materials to provide more actionable, task-based direction aligned to the DoD target-level maturity model. Phase One outlines **36 activities** intended to establish conditions for **30 zero trust capabilities**, while Phase Two defines **41 activities** to begin integrating core zero trust solutions and enable **34 additional capabilities**, with a modular approach intended to let organizations tailor adoption based on maturity and constraints. Separately, the **General Services Administration (GSA)** is tightening federal supply-chain cybersecurity expectations by issuing an IT security procedural guide (CIO-IT Security-21-112 Rev. 1) that imposes **CMMC-like** requirements on certain **new contracts involving CUI**, including implementation of **NIST SP 800-171** and selected **800-172** controls. The guide identifies **eight blocking requirements** (including **MFA**, **encryption of CUI in transit and at rest**, **vulnerability scanning/remediation**, and removal of **end-of-life components**) and requires **independent assessments** via FedRAMP third-party organizations or GSA-approved assessors, though GSA has not published assessor approval criteria—creating potential uncertainty for contractors; a separate GSA acquisition discussion on AI purchasing emphasizes flexibility, cost savings, and responsible use but does not materially add to the zero trust or contractor-control policy details.
Jun 29, 2026
President Donald Trump signed an executive order directing the Department of War to impose stricter supply-chain security requirements on defense contractors, including end-to-end mapping of software, services, technology, raw materials, and components used in national security systems. The order prioritizes domestic and allied sourcing of critical materials, sharply limits waivers under `10 U.S.C. 4872` starting Jan. 1, 2027, and requires contractors seeking exceptions to submit mitigation plans. It also calls for supplier vetting for foreign ownership, control, or influence (FOCI), supply concentration, and manufacturing risk, while requiring significant supply-chain risks to be reported to the government; fraudulent or noncompliant contractors could face contractual remedies and possible referral to the Attorney General. The new mandate lands alongside a proposed DFARS rule that could expand FOCI-related compliance across unclassified Department of Defense contracts and subcontracts above $5 million by making National Industrial Security System (NISS) eligibility a condition for awards, modifications, and option exercises. Contractors and subcontractors may need to submit `SF 328`, maintain eligible NISS status, and strengthen supplier oversight to avoid delays or blocked performance, especially where sensitive data or systems are involved. Reporting indicates the government also plans to use AI to analyze contractor-submitted supply-chain data for vulnerabilities, bottlenecks, and single points of failure, raising the stakes for both compliance programs and protection of the resulting supply-chain maps as high-value cyber targets.
Jul 23, 2026