|
CMMC - status
Phase II C3PAO requirements – paused; no updates provided.
Cybersecurity requirements – DFARS 252.204-7012 and NIST 800-171 rev 2 – fully active
Contracts should be modified to remove C3PAO requirements.
Solicitations should be amended to remove C3PAO L2 requirements.
Companies are charged with maintaining their SSP, fully implementing all requirements of NIST 800-171 r2; performing their self-assessment and entering their score into SPRS.
DoW’s expectations are – full compliance.
Suggestion – Do not slack off; especially now. Perform risk assessments; consider the value to include peace of mind of having a C3PAO L2 assessment.
Members of the DIB should also be aware of the following information posted on the Chief Information Officer U.S. Department of War webpage - https://dowcio.war.gov/BrilliantBasics/
Brilliant at the Basics - Welcome to the "Brilliant at the Basics" campaign.
Welcome to the "Brilliant at the Basics" campaign — the Department of War (DoW) Chief Information Officer (CIO) initiative dedicated to empowering our Defense Industrial Base (DIB) partners. Our mission is to help small, mid-sized, and non-traditional companies confidently secure their networks, protect sensitive DoW information, and deliver peace through technical strength!
The Brilliant at the Basics Campaign addresses both – Information Technology (IT) and Operational Technology (OT). The above page provides best practices for both IT and OT and links to resources.
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts. To help mitigate against this activity, organizations should prioritize disabling unused services and ports, sanitizing web application inputs to prevent injection attacks, implementing multifactor authentication for all services, and applying timely patches to reduce risks of compromise.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
“We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today.
Security, risk, and control assessments are typically done for the sake of compliance: tools deployed, audits passed, workflows completed, boxes checked. That’s no longer enough for boards, customers, and regulators, who all want an answer to a harder question: ‘can you prove your controls are working right now?’
Why point-in-time proof keeps failing
A control is not a monument. It is a living thing that drifts. A firewall port opened for a two-week integration may still be open eight months later. A vendor that passed review last year changes a configuration this year. A new system goes live between audit windows. Something can drift out of place the day after an audit closes and stay that way for months, and the only honest thing a CISO can say about it is that the last review looked fine.
And …
“When NIST updated its Cybersecurity Framework in 2024, it added a new Govern function built on a simple premise: cybersecurity is enterprise risk that senior leaders must weigh alongside finance and reputation, and it should be managed against continuous, measurable outcomes rather than a checklist.”
https://www.securityweek.com/we-think-the-security-control-is-working-is-no-longer-good-enough/
Singapore Reports First Major Data Breach Linked Directly to Corporate Artificial Intelligence Usage
Singapore’s data protection authorities have formally reported the country’s first confirmed data breach stemming directly from corporate artificial intelligence utilization. The incident occurred when employees fed sensitive corporate and customer information into an external, unsecured large language model tool. Regulators noted that the inadvertent exposure leaked proprietary records and personal identifiable information into public training sets. Cybersecurity experts emphasized that the breach highlights the growing security risks associated with shadow AI usage within enterprise environments. In response, authorities have urged companies to establish strict guidelines and deploy secure internal tools to govern employee AI interaction.
Full report : https://www.bloomberg.com/news/articles/2026-09-30/singapore-reports-first-data-breach-linked-to-ai-use-st
The MFA you have isn’t the MFA you think you have
What if 'MFA enabled' tells security leaders far less than they think about how well their accounts are actually protected?
For nearly a decade, multi-factor authentication has been the control every security leader points to when asked how they’ve reduced account takeover risk. It sits on almost every compliance checklist and nearly every cyber insurance questionnaire, and for good reason — adding a second factor to a password login closed off an enormous share of credential-based attacks, and organizations that adopted it early saw the payoff in fewer compromised accounts.
That confidence is now outdated in a way many security teams haven’t fully registered.
https://www.csoonline.com/article/4228386/the-mfa-you-have-isnt-the-mfa-you-think-you-have.html
When Commercial AI Meets Defense Data: Privacy, Security, And Data Rights Considerations
The Pentagon wants commercial AI, and AI companies want the Pentagon’s business. But the terms that make or break these deals are often about data, security, and rights, not algorithms. That demand runs deep across U.S. defense customers and the defense industrial base, and AI companies are increasingly eager to supply it, directly or through primes, subcontractors, vendors, or technology partners. These transactions raise consequential legal issues that extend well beyond model performance, bias, or weapons-system integration. For privacy, security, product, IP, and government contracting teams, the early questions are practical but high-stakes: where the solution will run, what government or contractor data it will touch, whether Controlled Unclassified Information (CUI) will enter the company’s environment, whether prompts and outputs will be retained or reused, and what rights a government or defense customer may seek in AI-related deliverables.
https://www.mondaq.com/unitedstates/government-contracts-procurement-ppp/1851208/when-commercial-ai-meets-defense-data-privacy-security-and-data-rights-considerations
Cyber is now the risk most likely to trigger everything else: Hiscox
Cyber threats are the most connected risk facing large businesses, more likely than any other to trigger or amplify problems elsewhere, according to new research from Hiscox London Market.
The insurer's Risk in motion report, based on a survey of 800 risk managers at multination companies, found that cyber has the strongest links to other threats in the corporate risk system. Its tightest connection is with AI-enabled fraud -- 55% of respondents named cyber threats and AI-enabled fraud as
the strongest risk combination they face.
Hiscox said cyber attacks can spill over into economic damage, workforce disruption, strained international relations and falling trust in institutions. Natural catastrophes, by contrast, despite dominating headlines, had weaker links to other risks and were less likely to drive knock-on effects.
https://www.insurancebusinessmag.com/us/news/cyber/cyber-is-now-the-risk-most-likely-to-trigger-everything-else-hiscox-592580.aspx
Map Antivirus to Essential 8 Maturity Model: 13 Steps [2026]
Australian small businesses keep getting told to “do the Essential Eight,” but almost nobody explains how an everyday antivirus product actually fits into that framework. The Australian Signals Directorate’s Essential Eight Maturity Model is not a single checklist you tick off by installing software once. It is a set of escalating requirements across eight mitigation strategies, and two of those strategies, application control and patching applications, sit directly inside what most antivirus and endpoint protection tools now handle. If you run IT for a business with 5 to 200 staff in Sydney, Melbourne, Brisbane, or anywhere else in Australia, this guide walks through exactly how to configure the antivirus or endpoint protection platform you already own (or are about to buy) so it moves you toward Maturity Level 1 or Level 2, rather than leaving you with a product that detects malware but does nothing for your actual compliance posture.
This is a hands-on build, not a theory lecture. By the end you will have a working application control policy, a patch cadence that satisfies ASD timeframes, and a documented maturity assessment you can hand to an auditor, a cyber insurer, or a government tender panel. We will use Microsoft Defender for Business and Bitdefender GravityZone as the two reference platforms throughout, because both are common in Australian SMB environments and both expose the controls the Essential Eight actually measures, but the steps translate to ESET PROTECT, CrowdStrike Falcon, or SentinelOne with minor naming differences.
https://tech-insider.org/au/essential-eight-maturity-model-antivirus-2026/
Refrigeration Controller Hack Spoils Food Across European Supermarkets
A cyberattack targeted refrigeration controllers, setting refrigerators and freezers across hundreds of supermarkets to defrost.
A cyberattack hit hundreds of supermarkets across Europe, setting refrigerators and freezers to defrost overnight.
Exploiting a vulnerability in refrigeration controllers, hackers reportedly raised temperatures to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food products and causing significant monetary damages.
The attack hit several supermarket chains across Europe, including Auchan, Carrefour, E.Leclerc, Intermarché (owned by Groupement Mousquetaire), and Monoprix, Reuters reports.
Most of the damage was done in France, but food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also affected.
https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets
| 
