CyberSheath

08/31/2026

AI is changing the cybersecurity calculus fast. Attackers are using AI to automate reconnaissance, personalize phishing at scale, and develop malware that adapts in real time. For defense contractors handling Controlled Unclassified Information, the stakes are higher.

At CMMC CON 2026, Microsoft Chief Security Advisor Kevin Thomas will dig deeper into the new era of cyber threats in a session titled, “Security risks in the age of AI,” on Sept. 23 at 12 p.m. ET.

Thomas’ session will cover four areas, each with actionable steps contractors can take with existing resources:

🔸How the threat model has changed
🔸Where risk profiles are moving
🔸Fighting AI with AI while getting the basics right
🔸A 90-day start with the team you have

Register now for CMMC CON 2026 > https://bit.ly/3Ut9MzE

-171

08/28/2026

The 2026 State of the DIB Report found that the average Supplier Performance Risk System (SPRS) score rose to a five-year high of +51, up from +33 in 2025.

Yet confidence in those scores fell 24 percentage points. Only 65% of contractors say they’re extremely or very confident that their score is accurate, down from 89% last year and 94% in 2024.

So, can you trust your SPRS score?

Download the full report to see how your organization compares and what the data reveals about cybersecurity readiness across the DIB: https://bit.ly/45ELeWH

08/27/2026

“As we've seen in many leading cyber cases that have been brought forth by the government, it comes back to the evidence and documentation." 🧑‍⚖️🏛️

That point from Michael Gruden, Partner at Steptoe, gets to the heart of the compliance challenge facing the Defense Industrial Base: Can you prove that your cybersecurity claims match reality?

Defense contractors are responsible for accurately representing their cybersecurity posture. That means ensuring representations to the government are accurate and supportable — or risk legal exposure and enforcement.

In a new episode of Mission: Cyber, host Emil Sayegh sits down with Michael, a leading cybersecurity and incident-response attorney whose career spans the Pentagon, DHS, and private practice.

In this episode, they cover:

🔸 Why protecting CUI remains a fundamental obligation
🔸 How inaccurate attestations can create legal exposure
🔸 What DOJ enforcement means for contractors of all sizes
🔸 How organizations can pressure-test their cybersecurity posture

Whether you're a CEO, CIO, CISO, or compliance leader, this conversation offers a practical perspective on navigating cybersecurity requirements while protecting both the mission and your organization.

🎧 Listen on Apple Podcasts: https://podcasts.apple.com/us/podcast/michael-gruden-on-cui-protection-legal-exposure-and/id6788538904?i=1000786064026
🎙️ Listen on Spotify: https://open.spotify.com/episode/2qQqGpT7WRkKcijpKlPbHJ?si=zDXjnWXJR6Ot6aNwtuRzNw

08/26/2026

Pentagon leader James R. Mismash, Deputy Assistant Secretary of War for Industrial Base Growth and Director of Small Business Programs, will keynote CMMC CON 2026 on Sept. 24 at 9 a.m. ET.

Cybersecurity and industrial base readiness are inseparable. In his keynote, Mismash will share the government’s perspective on strengthening DIB cybersecurity, reducing unnecessary burden, eliminating barriers, accelerating capability delivery, and expanding participation across the defense supply chain.

Read the blog and register for the free virtual event (Sept. 23–24) > https://bit.ly/4d0tIjC

08/25/2026

SEP started its path to CMMC certification with an enterprise-wide gap assessment that revealed the need for a dedicated enclave.

Leadership then brought in outside expertise to help interpret the requirements and implement a solution that fit its existing operations. The result was a purpose-built enclave for its defense work that allowed commercial work to continue without disruption.

The company ultimately earned a perfect 110 on its CMMC Level 2 assessment.

Read the full case study: https://bit.ly/4xDbBrX

08/21/2026

Prime contractors are not waiting on CMMC timelines to raise the bar on supplier cybersecurity.

They are tightening flowdowns, asking for clearer evidence, and making supplier readiness part of sourcing and program risk decisions.

At CMMC CON 2026, the session “How Primes Are Prioritizing CMMC Readiness (and What They Expect from Subcontractors)” featuring Doug Cherry (Monterey Technologies, Inc.) and Megan Downie (Spirit Electronics) will unpack what that looks like in practice.

Hear directly from prime contractors on what requirements are becoming increasingly non-negotiable, the most common gaps they see across small and mid-sized suppliers, how they validate alignment to NIST SP 800-171 and what evidence they expect.

Register now: https://bit.ly/4qs5Lau

08/20/2026

The 2026 State of the Defense Industrial Base Report is here and this year’s findings reveal a critical shift in the DIB.

Defense contractors are making measurable cybersecurity progress but their confidence in that progress is falling. Our fifth annual study, conducted by Merrill Research, found:

🔸 SPRS scores hit +51, the highest in the study’s history
🔸 Confidence in those scores fell to 65%, down sharply from 89% last year
🔸 Only 1% of contractors say they’re fully ready for CMMC
🔸 Average annual compliance budgets reached $155,204

The numbers tell a complicated story. Investment is up, documentation is improving, and compliance scores are rising. But proving that reported compliance reflects operational reality — and that an Affirming Official can stand behind it — is becoming one of the DIB’s biggest challenges.

This year’s report also breaks down:

🔹 The impact of the Pentagon’s CMMC Phase 2 pause
🔹 Ongoing DOJ and DIBCAC enforcement
🔹 Third‑party risk across the supply chain
🔹 What defense contractors want improved

Get the full picture of where the DIB stands today and what it will take to stay compliant, competitive, and contract‑ready.

Download the 2026 State of the DIB Report:

By completing this form, I consent to receiving calls, texts and/or emails from CyberSheath regarding services and programs. Cybersecurity investment is

08/18/2026

Congratulations to Gemini Industries on achieving CMMC Level 2 certification with a perfect 110/110 score. 👏

With the support of CyberSheath, Gemini strengthened and sustained a mature cybersecurity program across a complex environment that includes multiple sites, ITAR-controlled programs, and ISO compliance requirements. The third-party assessment validated that investment and gives Gemini’s U.S. government and national security customers added confidence in how CUI is protected.

Read the full announcement to learn why Gemini chose to certify now and how the program was validated through third-party assessment >

Gemini Industries strengthened its cybersecurity program and achieved CMMC Level 2 certification with the support of CyberSheath.

08/17/2026

If you’ve spoken to a Microsoft 365 reseller recently, you were likely told you need GCC High, without an assessment of your environment, a review of your contracts, or a conversation about the types of data you handle.

Here’s what to consider before choosing the right environment for your organization to avoid unnecessary cost and complexity:

Choose GCC vs GCC High for DFARS, NIST 800-171 and CMMC based on contracts and CUI. Learn when ITAR/EAR requires GCC High and enclave options.

08/14/2026

SEP, one of Indiana's largest software development companies, recognized that independently verified CMMC compliance could strengthen its position in the defense market.

Their approach offers several lessons for defense contractors:

🔸 𝗕𝘂𝗶𝗹𝗱 𝘁𝗵𝗲 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗰𝗮𝘀𝗲 𝗯𝗲𝗳𝗼𝗿𝗲 𝘁𝗵𝗲 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗰𝗮𝘀𝗲. SEP’s leadership started by identifying the expected outcomes of certification — not just continued eligibility for defense work, but market distinction and new business development opportunities. That clarity on benefits informed every subsequent decision, from scoping to partner selection.

🔸 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱 𝘆𝗼𝘂𝗿 𝘁𝗼𝘁𝗮𝗹 𝗶𝗻𝘃𝗲𝘀𝘁𝗺𝗲𝗻𝘁, 𝗻𝗼𝘁 𝗷𝘂𝘀𝘁 𝘁𝗵𝗲 𝘂𝗽𝗳𝗿𝗼𝗻𝘁 𝗰𝗼𝘀𝘁. Assessment fees and implementation costs are only part of the picture. CMMC certification operates on a three-year cycle, and the ongoing cost of maintaining compliance should factor into the business case from the beginning.

🔸 𝗔𝘀𝘀𝗲𝘀𝘀 𝘁𝗵𝗲 𝗺𝗮𝘁𝘂𝗿𝗶𝘁𝘆 𝗼𝗳 𝘆𝗼𝘂𝗿 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗿𝗼𝗳𝗶𝗹𝗲 𝗲𝗮𝗿𝗹𝘆. A realistic understanding of your current security posture leads to a meaningful gap analysis, which in turn provides reliable cost projections and a defensible implementation timeline. Starting from assumptions rather than evidence creates risk on both fronts.

🔸 𝗦𝗲𝗹𝗲𝗰𝘁 𝗮 𝗽𝗮𝗿𝘁𝗻𝗲𝗿 𝗯𝗮𝘀𝗲𝗱 𝗼𝗻 𝘆𝗼𝘂𝗿 𝗼𝘄𝗻 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗻𝗲𝗲𝗱𝘀. SEP’s team invested time in understanding how it operates before evaluating partners, which allowed it to assess fit against defined criteria rather than relying on reputation or sales conversations alone.

Read the full story to see how SEP approached its path to CMMC certification: https://bit.ly/4xDbBrX