Loading story…
The NSA published Zero Trust Implementation Guidelines Phase One and Phase Two, expanding its series beyond earlier Primer and Discovery Phase materials to provide more actionable, task-based direction aligned to the DoD target-level maturity model. Phase One outlines 36 activities intended to establish conditions for 30 zero trust capabilities, while Phase Two defines 41 activities to begin integrating core zero trust solutions and enable 34 additional capabilities, with a modular approach intended to let organizations tailor adoption based on maturity and constraints.
Separately, the General Services Administration (GSA) is tightening federal supply-chain cybersecurity expectations by issuing an IT security procedural guide (CIO-IT Security-21-112 Rev. 1) that imposes CMMC-like requirements on certain new contracts involving CUI, including implementation of NIST SP 800-171 and selected 800-172 controls. The guide identifies eight blocking requirements (including MFA, encryption of CUI in transit and at rest, vulnerability scanning/remediation, and removal of end-of-life components) and requires independent assessments via FedRAMP third-party organizations or GSA-approved assessors, though GSA has not published assessor approval criteria—creating potential uncertainty for contractors; a separate GSA acquisition discussion on AI purchasing emphasizes flexibility, cost savings, and responsible use but does not materially add to the zero trust or contractor-control policy details.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The NSA published Phase One and Phase Two of its Zero Trust Implementation Guidelines, expanding its broader zero trust guidance series with phased activities and capabilities for enterprise adoption. The guidance was described as modular and aligned with Department of Defense and federal zero trust maturity frameworks.
On 2026-01-05, GSA's Office of the Chief Information Security Officer issued an IT security procedural guide for certain federal contractors handling Controlled Unclassified Information. The guide requires implementation of NIST SP 800-171 and selected NIST SP 800-172 controls, along with independent assessments and mandatory security measures for new contracts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Policy and defense stakeholders are continuing to formalize **national-level cybersecurity strategy** as an organizing framework that coordinates responsibilities across government, regulators, law enforcement, and the private operators that run most critical infrastructure. Reported guidance highlights a shift toward *whole-of-society* models that connect cyber risk management, workforce planning, technology standards, and cross-sector coordination (e.g., health care, energy, transportation, finance, and education), with risk assessments increasingly accounting for supply chain exposure, aging systems, workforce gaps, and the impact of **AI and emerging technologies** on both defense and attacker tradecraft. In parallel, the U.S. **National Security Agency (NSA)** published **Zero Trust Implementation Guidelines (ZIG)** intended to help organizations progress toward target-level zero trust maturity in alignment with broader government cybersecurity strategy. The guidance uses a modular, phased approach—**Phase One** defining 36 activities mapped to 30 capabilities to establish a baseline, and **Phase Two** adding 41 activities tied to 34 additional capabilities—while emphasizing continuous authentication/authorization and visibility into application policy decision points to address attacks that occur *post-authentication*; the NSA also indicated additional advanced phases could be developed later.
Jun 29, 2026
The U.S. Department of Defense has suspended **Phase 2** of the Cybersecurity Maturity Model Certification (**CMMC**) program, halting the planned move to mandatory third-party assessments for defense contractors that had been scheduled to begin in November. The Pentagon said **Phase 1** self-assessments and other existing cybersecurity obligations will remain in effect while it pauses later CMMC phases and conducts a **60-day review** of the broader framework. Defense officials said the review is aimed at reducing compliance costs, administrative burden, and barriers for small, medium-sized, and nontraditional firms in the defense industrial base, while preserving core security requirements such as **NIST SP 800-171** controls. A newly formed CMMC reform task force will collect industry feedback on cost and effectiveness, and officials also cited a shortage of approved third-party assessors as a practical reason the original Phase 2 rollout was no longer feasible.
Jul 17, 2026
The US Department of Defense is implementing the Cybersecurity Maturity Model Certification 2.0 (CMMC), requiring over 300,000 military contracting companies to enhance their cybersecurity protections. Despite the critical importance of these safeguards, more than half of defense contractors are reportedly unprepared for the initial phase of CMMC, which is set to begin imminently. Whistleblowers have played a significant role in exposing non-compliance, leading to major settlements by companies such as Raytheon and Aerojet Rocketdyne under the False Claims Act. The new requirements not only impact primary contractors but also extend to subcontractors and external service providers, including cloud service providers, who may not fully understand their obligations under CMMC. Many contractors and their service providers face confusion regarding the scope of CMMC, particularly in distinguishing between subcontractors and external service providers, and in understanding which IT and information security services fall under compliance requirements. Failure to include all relevant service providers in CMMC assessments could result in non-compliance and potential loss of business. Registered Practitioner Organizations are offering guidance to help organizations navigate these complexities, emphasizing the need for comprehensive compliance programs that address both direct and indirect CMMC obligations across the defense supply chain.
Jun 30, 2026