Timothy Walsh

#NCDMM supports its #AlliancePartners in achieving CMMC compliance! With the Department of Defense (DoD) finalizing and implementing the cybersecurity maturity model certification (CMMC), NCDMM is becoming an essential resource for manufacturers, suppliers, and organizations. NCDMM helps its partners achieve CMMC compliance by assessing cybersecurity posture, defining a clear path forward, and providing tailored guidance. Our approach aligns with DoD expectations to protect CUI, streamline documentation, and implement secure communications. With expertise in operational technologies (e.g., 3D printers, CNC machines, PLCs), NCDMM delivers targeted assessments, technical guidance, gap remediation, and secure practices for organizations of any size. Read our success story, https://bit.ly/4sx5WBW #Cybersecurity #CMMC #Compliance #SecureCommunications #AdvancedManufacturing #AlliancePartners

25

You’ve seen cybersecurity requirements in solicitations before. CMMC isn’t new language. What’s new is that it now matters before award. In the past, most contractors self-attested that they followed cybersecurity rules (easy peasy). You may now be seeing DFARS 252.204-7025 show up in solicitations. When included, the solicitation indicates CMMC level is required. At that point, saying “we comply” isn’t enough. If you’re selected, the government will check SPRS to confirm your CMMC status is already documented and current. So what does that actually mean? CMMC (Cybersecurity Maturity Model Certification) is how DoW/DoD measures whether a contractor can protect government data. Level 1 applies when you handle basic Federal Contract Information (FCI) and is self-assessed. Level 2 applies when Controlled Unclassified Information (CUI) is involved and requires alignment with NIST 800-171, sometimes verified by a third party. Level 3 applies to a limited set of high-risk programs and requires a DoW/DoD-led assessment. CMMC is now a proposal eligibility gate, driven by the clauses in the solicitation. #GovCon #CMMC #DoWContracts #DoDContracts #ProposalTips #CybersecurityCompliance

6

1 Comment

NCyTE is excited to share our Cybersecurity Maturity Model Certification (CMMC)_2A Workshop! Join our team on November 13-14, 2025 to take your CMMC training to the next level. The DoD Cybersecurity Maturity Model Certification (CMMC) program represents a fundamental shift in how defense contractors must approach cybersecurity compliance. With this final rule, DoD establishes the program in order to verify contractors have implemented required security measures necessary to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). This hands-on workshop provides participants with essential knowledge about CMMC requirements while demonstrating how artificial intelligence can revolutionize the documentation and compliance tracking process. Participants will gain practical insights into the CMMC framework while learning how AI-powered tools can dramatically reduce the time and complexity involved in generating required documentation and maintaining ongoing compliance. Register to attend: https://lnkd.in/guHspf2m Foundational knowledge of the DoD Cybersecurity Maturity Model Certification (CMMC) requirements is required. #CybersecurityTraining #CMMCWorkshop #DefenseContractors #CMMC2A #ComplianceTraining

6

On today’s episode of #IntelAtTheEdge… William Usher sits down with Cynthia Kaiser, Senior Vice President at Halcyon and former Deputy Assistant Director for Cyber at the Federal Bureau of Investigation (FBI), to discuss the escalating threat of ransomware, a sophisticated cybercrime that encrypts networks and steals data for ransom, impacting nearly every sector from small medical offices to large corporations. 🎧 You can check out the full episode wherever you get your podcasts! YouTube: https://lnkd.in/eBpqET2R Apple: https://lnkd.in/eXMWrji5 Spotify: https://lnkd.in/eGE_S3Vf

3

The GSA has implemented mandatory cybersecurity requirements similar to the Department of Defense's CMMC, requiring civilian-agency contractors who handle Controlled Unclassified Information (CUI) to evaluate their IT system security. Released on January 5, 2026, this framework adds new requirements beyond NIST SP 800-171, and contractors should begin reviewing these requirements immediately as GSA is expected to include them in solicitations and contracts. Read more: https://lnkd.in/dUnPVhWD By: Evan Wolff, Natasha Kohne, Angela Barbee Styles, Marta Thompson, Edward Block, Rita Heimes, Maida Oringher Lerner, David Mahoney, Alexis Ward #Cybersecurity #DataProtection #GSA #CMMC

5

March was a lot. Here's everything that happened in GovCon cybersecurity — and what it means for your program going into Q2. 1️⃣ 𝗧𝗵𝗲 𝗚𝗔𝗢 𝗰𝗮𝗹𝗹𝗲𝗱 𝗼𝘂𝘁 𝗗𝗼𝗗'𝘀 𝗖𝗠𝗠𝗖 𝗽𝗹𝗮𝗻𝗻𝗶𝗻𝗴 𝗴𝗮𝗽. GAO-26-107955 confirmed DoD agreed to assess external risks to the CMMC ecosystem — including what happens if the assessment infrastructure can't keep up with demand. As of December 2025, there are 92 authorized C3PAOs. DoD hasn't documented a plan for what they'll do if the ecosystem gets overwhelmed. That's not a small thing. 2️⃣ 𝗔𝗜 𝗶𝘀 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹𝗹𝘆 𝗽𝗮𝗿𝘁 𝗼𝗳 𝗖𝗠𝗠𝗖. FY2026 NDAA Section 1513: DoD directed to build an AI/ML security framework and integrate it into CMMC. If you're developing, deploying, storing, or hosting AI for DoD — pay attention. Congressional status update due June 16, 2026. 3️⃣ 𝗚𝗦𝗔 𝗲𝘅𝗽𝗮𝗻𝗱𝗲𝗱 𝗖𝗨𝗜 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀 𝘁𝗼 𝗰𝗶𝘃𝗶𝗹𝗶𝗮𝗻 𝗰𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝗼𝗿𝘀. This is the one people are sleeping on. Independent 3PAO assessments every 3 years. 1-hour incident reporting. Showstopper controls fully implemented before system authorization. This is the first major expansion of these requirements beyond DoD — and it caught a lot of civilian contractors off guard. 4️⃣ 𝗙𝗲𝗱𝗥𝗔𝗠𝗣 𝟮𝟬𝘅 𝗣𝗵𝗮𝘀𝗲 𝟮 𝘄𝗿𝗮𝗽𝘀 𝗠𝗮𝗿𝗰𝗵 𝟯𝟭. Phase 3 is now targeting Q3–Q4 2026. If you're in the FedRAMP pipeline, your timeline just shifted. Plan accordingly. 5️⃣ 𝗧𝗵𝗲 𝗰𝘆𝗯𝗲𝗿𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗵𝗶𝘁 𝗰𝗹𝗼𝘀𝗲 𝘁𝗼 𝗵𝗼𝗺𝗲. Stryker — March 11, 80,000 devices wiped. NYC Health + Hospitals — 11 weeks of unauthorized access, disclosed March 24. And DFARS 252.204-7019 was formally retired February 1, collapsing everything into CMMC under 252.204-7021. 𝗥𝗲𝗮𝗹 𝘁𝗮𝗹𝗸: We keep telling clients that the gap between "overwhelmed" and "on track" is usually 90 days of focused, guided work. Not 18 months. Not a full program overhaul. Ninety days — if you know what to prioritize. March showed us the stakes. Q2 is where you decide what to do about it. 𝗪𝗵𝗶𝗰𝗵 𝗼𝗳 𝘁𝗵𝗲𝘀𝗲 𝗠𝗮𝗿𝗰𝗵 𝗱𝗲𝘃𝗲𝗹𝗼𝗽𝗺𝗲𝗻𝘁𝘀 𝗰𝗼𝗻𝗰𝗲𝗿𝗻𝘀 𝘆𝗼𝘂 𝗺𝗼𝘀𝘁? 1️⃣ GAO assessor planning gap 2️⃣ CMMC for AI 3️⃣ GSA CUI requirements 4️⃣ FedRAMP 20x delays 5️⃣ The cyberattacks (Stryker / NYC Health+) Drop your number below — we read every response. 𝗦𝗮𝘃𝗲 𝘁𝗵𝗶𝘀 𝗼𝗻𝗲. 𝗕𝗼𝗼𝗸𝗺𝗮𝗿𝗸 𝗶𝘁 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗻𝗲𝘅𝘁 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝘁𝗲𝗮𝗺 𝗺𝗲𝗲𝘁𝗶𝗻𝗴. #CMMCCompliance #FedRAMP #GovCon #CybersecurityLeadership #DefenseContractors #GSA #NDAA #ComplianceLeadership #WomenInTech #Cadra

SBOMs are no longer mandatory for federal agencies. New guidance rescinds prior software supply chain mandates and shifts to agency-defined risk assessment. Details → https://lnkd.in/eJUQdKf2 #Cybersecurity #GovTech

12

DoD Finalizes DFARS Rule with CMMC Requirement for Contractors On September 10, 2025, the DoD issued its final rule amending DFARS to make CMMC (DFARS clause 252.204-7021) a contractual requirement. Effective November 10, 2025: CMMC clauses begin appearing in solicitations. Flow-down applies: Subcontractors and cloud providers must also comply. 👉 What this means: If you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must: - Identify your required CMMC level (Level 1 for FCI, Level 2 for most CUI, Level 3 for sensitive programs). - Maintain accurate SPRS entries and affirm compliance annually. - Be audit-ready under NIST SP 800-171 Rev.3 and the associated assessment guide (800-171A). Ensure that any cloud service providers (CSPs) you use are FedRAMP authorized: • FedRAMP Moderate for Level 2 CMMC environments. • FedRAMP High for Level 3 environments. Where StratoKey helps: StratoKey CDP applies encryption, tokenization, access controls, and monitoring to the SaaS platforms you rely on, NetSuite, Salesforce, Pipedrive, Jira, Confluence, and more. This ensures your #CUI #FCI stays secure and compliant (or in a FedRAMP-authorized environment) without disrupting workflows. 🔒 Stay eligible for DoD contracts. Book a StratoKey CMMC discovery call today and get your organization CMMC-ready. DoD Finalizes DFARS Rule with CMMC Requirement for Contractors: https://lnkd.in/ezajKdqV #CMMC #DFARS #DoD #NIST #Cybersecurity #Compliance #cmmcFinalRule

15

CMMC enforcement is no longer on the horizon. It's in contracts now. If you're in the defense supply chain and haven't started mapping where your CUI actually lives, that gap will show up fast when a solicitation hits your desk with a Level 2 requirement attached. Cyberhaven Senior Solutions Architect Tim Kerns put together a plain-English breakdown of how CMMC 2.0 works, what the three levels actually require, and how to approach certification without turning it into a fire drill. https://lnkd.in/gynCqrpg

10