|
CMMC - status
Phase II C3PAO requirements – paused; no updates provided.
Cybersecurity requirements – DFARS 252.204-7012 and NIST 800-171 rev 2 – fully active
Contracts should be modified to remove C3PAO requirements.
Solicitations should be amended to remove C3PAO L2 requirements.
Companies are charged with maintaining their SSP, fully implementing all requirements of NIST 800-171 r2; performing their self-assessment and entering their score into SPRS.
DoW’s expectations are – full compliance.
Suggestion – Do not slack off; especially now. Perform risk assessments; consider the value to include peace of mind of having a C3PAO L2 assessment.
*** New Small Business Cyber reference and training opportunity from NIST ***
Assessing Security Requirements for CUI: NIST SP 800-171Ar3 Small Business Primer
NIST has published a new Special Publication (NIST SP) – 1352 to assist small businesses understand foundational SP 800-171 assessment concepts and basic strategies for planning for an assessment. The document (paper) can be downloaded at - https://csrc.nist.gov/pubs/sp/1352/final
As noted in the paper “Even if you do not handle CUI, implementing the security requirements in SP 800-171 will help you take appropriate measures to protect the confidentiality of sensitive information.”
NIST will provide a 1 hour training program at 1:00 PM CST on Thursday, October 29, 2026
The following is the link to the training registration page:
https://nist.zoomgov.com/webinar/register/WN_1vz7LOnBS3yJLfltaCUX5Q#/registration
Microsoft issues emergency Windows 11 update to fix its record-breaking patch
Microsoft has started rolling out an emergency out-of-band update to fix problems with its record-breaking September patch Tuesday update. The software giant patched nearly 1,000 flaws in its biggest update ever this month, but it also introduced some bugs that have affected businesses, developers, and gamers.
https://www.theverge.com/news/995302/microsoft-out-of-band-windows-11-update-fix-issues
CISO Strategy
“We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today.
Security, risk, and control assessments are typically done for the sake of compliance: tools deployed, audits passed, workflows completed, boxes checked. That’s no longer enough for boards, customers, and regulators, who all want an answer to a harder question: ‘can you prove your controls are working right now?’
https://www.securityweek.com/we-think-the-security-control-is-working-is-no-longer-good-enough/
---- Compare the above statement to DoW’s CIO’s statement on September 9, 2026 at the Billington Cybersecurity Conference.
“Compliance equals compliance. Compliance doesn’t equal security,” she said. “Compliance equals a point-in-time check of, ‘Where are you right now?’ We all know that cybersecurity is a dynamic process. It needs to be contiguous and continuous, and it needs to be at the pace of the threat in and of itself.”
https://govciomedia.com/dow-cio-says-there-is-work-to-do-on-cmmc/
DOJ FCA actions continue to emphasize the importance of complying with Federal Cybersecurity requirements. Know your system, know its status, verify and reverify your SPRS score. You can’t just say you are complying, you have to be able to show and in some cases prove you are complying.
Perfect SPRS scores (110) are very difficult to achieve as are near perfect scores.
Invoicing for payment can initiate DOJ actions.
To discuss these and related issues, please contact WPI – 414-270-3600.
DOJ's $2 Million Honeywell Settlement Reinforces Cybersecurity as a False Claims Act Risk
For government contractors, cybersecurity compliance is no longer solely an information-security issue. Increasingly, it is also a question of contractual accuracy, corporate governance, and potential False Claims Act liability.
The U.S. Department of Justice (DOJ) announced on September 1, 2026, that Honeywell Aerospace Inc. agreed to pay $2,042,518 to resolve allegations that a business unit failed to comply with cybersecurity requirements applicable to a Department of Defense (DoD) contract. Honeywell Aerospace, headquartered in Phoenix, Arizona, provides aerospace products and solutions to government and commercial customers; prior to June 29, 2026, when it became a standalone public company, it operated as a business segment of Honeywell International Inc., of Charlotte, North Carolina.
https://natlawreview.com/article/dojs-2-million-honeywell-settlement-reinforces-cybersecurity-false-claims-act-risk
With AI hackers in mind, Air Forces Cyber develops defensive ‘campaign plan’
"When people say, ‘Hey, we're at an inflection point,’ we are absolutely at an inflection point,” 16th Air Force commander Lt. Gen. Thomas Hensley said of AI threats to the network.
The Air Force has some very critical systems to protect and will be taking appropriate measures as outlined in the four lines of effort addressed in this article. Interestingly, the last line of effort – “defensive architecture design”, has several characteristics that are similar to what is required by NIST 800-171 r2.
“Last is “defensive architecture design.” This is a whole-of-Air Force effort spurred on by the chief information officer to put in place concepts and architectures for better defense all around, such as zero trust, Identity, Credential, and Access Management, multi-factor authentication and microsegmentation, to name a few.
The goal of these efforts is to properly verify users and, even if an adversary gets into the network, to prevent them from getting to where they want to go or accessing the information they seek — even if it’s an AI agent.”
https://breakingdefense.com/2026/08/with-ai-hackers-in-mind-air-forces-cyber-develops-defensive-campaign-plan
FBI Releases Cyber Strategy
The FBI's new Cyber Strategy is a roadmap for defending the American people and the nation's critical infrastructure in cyberspace. The strategy focuses on four pillars: disrupting adversaries, supporting victims, strengthening partnerships, and building the capabilities this mission demands. Together, these four pillars bring the full weight of the FBI to defend the homeland in cyberspace and secure America's digital future.
https://www.fbi.gov/investigate/cyber/cyber-strategy
Tech Companies Call for Improved Cyber Defenses After AI-Enabled Attacks
More than 100 companies signed onto an open letter calling for more urgency in fixing bugs and shoring up cybersecurity.
Saying that the world has only a “limited window” to bolster its defense against widespread AI cyberattacks, OpenAI and more than 100 other companies issued a call Friday for businesses, governments and other institutions to act quickly to boost cybersecurity.
The open letter, titled “A call for collective action on cyber defense,” was signed by 128 companies, including some of the biggest players in the AI space, including Microsoft, Google, Anthropic and Oracle.
https://www.cnet.com/tech/services-and-software/tech-companies-call-for-improved-cyber-defenses-after-ai-enabled-attacks
The Average Web Application Contains Twenty Security Vulnerabilities
A recent investigation by Barracuda into web application security has revealed that the average application currently carries 20 distinct security flaws. These vulnerabilities represent significant opportunities for attackers to harvest sensitive data, compromise user accounts, or gain unauthorised entry into corporate systems.
The study, conducted over five months in 2026, analysed thousands of applications to identify the most prevalent threats. The findings suggest that many organisations are leaving their digital front doors unlocked through basic oversights rather than failing to defend against highly sophisticated, novel exploits.
https://www.cybersecurityintelligence.com/blog/the-average-web-application-contains-twenty-security-vulnerabilities-9654.html
The above article is short but packed with practical information relevant to members of the DIB. A Copilot review indicates that the article addresses the following NIST 800-171 r2 requirements.
3.1.1 Authorized Access Control; 3.1.2 Transaction and Function Control; 3.1.3 Information Flow Control; 3.1.18 Software Execution Control; 3.1.20 External Connection Control; 3.3.1 Audit Logging; 3.3.2 Audit Traceability; 3.3.6 Audit Log Review; 3.4.6 Least Functionality; 3.5.1 User Identification; 3.5.2 User Authentication; 3.5.3 Multi-Factor Authentication; 3.5.7 Password Complexity; 3.8.1 Media Protection; 3.8.4 Data Marking and Handling; 3.13.1 Communications Protection; 3.13.8 Cryptographic Protection; 3.13.11 Encryption of Data in Transit; 3.13.16 Protection of Data at Rest; 3.14.1 Flaw Remediation; 3.14.5 Vulnerability Scanning.
What may be seen as a minor issue can have sweeping implications!
Cyber attacks and cybersecurity are not limited to “Terra Firma”
Coast Guard, FBI investigating after 2 oil tankers bound for US hit with cyberattacks
The Coast Guard and FBI are investigating after two oil tankers bound for the U.S. were hit with suspected cyberattacks last month, prompting American authorities to launch investigations into both incidents, sources told ABC News.
https://oodaloop.com/briefs/cyber/coast-guard-fbi-investigating-after-2-oil-tankers-bound-for-us-hit-with-cyberattacks/
Top 10 Breaches of the Week
Each incident is interesting in its own right. Look beyond the single incident to see common themes – such as identity, trust, unpatched systems and others. These ideas are key parts of NIST 800-171 rev 2. Learn from these incidents; review and strengthen your SSP and specific security measures. Update as needed and continue to train the workforce.
Security Boulevard’s weekly after-action roundup tracks the breaches and security incidents that mattered most over the past week. This edition weighs confirmed disclosures alongside clearly labeled threat-actor claims, emphasizing scale, sensitivity, sector criticality and lessons that security teams can act on now.
https://securityboulevard.com/2026/09/top-10-breaches-of-the-week-9/
| 
