CyberSheath

10/23/2026

𝗧𝗮𝗹𝗲𝘀 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗖𝘆𝗯𝗲𝗿 𝗖𝗿𝘆𝗽𝘁: 𝗧𝗵𝗲 𝗔𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁 𝗧𝗵𝗮𝘁 𝗖𝗮𝗺𝗲 𝗕𝗮𝗰𝗸 𝘁𝗼 𝗛𝗮𝘂𝗻𝘁 𝗬𝗼𝘂 👻

The contractor reported a strong SPRS score. Leadership believed its cybersecurity program was in good shape. But then DIBCAC came calling. 💀

Outdated documentation. Missing evidence. Security controls that weren't implemented as reported.

Suddenly, the contractor's reported compliance didn't match its actual cybersecurity posture. And the consequences could extend beyond the assessment.

In June 2026, LOGZONE Inc. agreed to pay $507,144 to resolve False Claims Act allegations involving NIST SP 800-171 noncompliance. The case followed a DCMA assessment that identified discrepancies between the company's reported score and its implementation of security controls. The settlement did not include a determination of liability.

The lesson? Your SPRS score should reflect what you can actually demonstrate.

𝗝𝗼𝗶𝗻 𝗼𝘂𝗿 𝗢𝗰𝘁𝗼𝗯𝗲𝗿 𝟮𝟴 𝗗𝗜𝗕𝗖𝗔𝗖 𝘄𝗲𝗯𝗶𝗻𝗮𝗿 𝘁𝗼 𝗹𝗲𝗮𝗿𝗻 𝘄𝗵𝗮𝘁 𝗴𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗮𝘀𝘀𝗲𝘀𝘀𝗼𝗿𝘀 𝗲𝘃𝗮𝗹𝘂𝗮𝘁𝗲 𝗮𝗻𝗱 𝗵𝗼𝘄 𝘁𝗼 𝗽𝗿𝗲𝗽𝗮𝗿𝗲: https://bit.ly/3UatVus

10/22/2026

How involved should CEOs be in their organization's cybersecurity?

For Janet Grondin, CEO of Stellar Solutions and retired U.S. Air Force Colonel, executive involvement is essential, especially for organizations supporting national security.

In the latest episode of Mission: Cyber, Janet joins CyberSheath CEO Emil Sayegh to discuss why CEOs need to understand their organization's cybersecurity posture without getting caught up in day-to-day IT operations.

That means knowing who has access to sensitive information, how security policies are enforced, and whether the organization has visibility into potential threats.

And when it comes to CMMC, Janet's perspective is clear. Defense contractors have a responsibility to protect the information entrusted to them, regardless of changing government requirements or timelines.

As Janet puts it: “Cybersecurity is foundational for our business.”

Tune into the full episode for more on mission-driven leadership, making high-stakes decisions, and what it takes to protect the mission.

🎧 Listen on Apple Podcasts: https://podcasts.apple.com/us/podcast/janet-grondin-on-mission-driven-leadership-national/id6788538904?i=1000793431172
🎙️ Listen on Spotify: https://open.spotify.com/episode/2McreDZmFhSzL4sjBlTorl

10/20/2026

Does your SPRS score accurately reflect your organization's cybersecurity program? 🤔

Your Supplier Performance Risk System (SPRS) score represents your reported implementation of NIST SP 800-171 requirements. But during a DIBCAC assessment, government assessors look beyond the number.

They examine your System Security Plan (SSP), supporting evidence, and whether documented security controls are actually implemented.

Join CyberSheath on October 28 as Andrew Zoppi, Director of Compliance Operations, explores:

🔹 Why SPRS scores should reflect your current cybersecurity environment
🔹 NIST SP 800-171 requirements that have historically challenged contractors
🔹 What assessors look for when validating SSPs, controls, and evidence
🔹 How to identify potential gaps and strengthen assessment preparation

Get a clearer understanding of what DIBCAC evaluates and how to prepare with confidence.

Register today: https://bit.ly/3UatVus

10/16/2026

Heading to CS5 East next week? Let us know!

Michael Bailie, Scott Whitehouse, Reema Patel, Eric Hutts, and Emil Sayegh will be there October 22–23 and would love to connect!

Whether you're preparing for a CMMC assessment, navigating CUI protection requirements, or planning for ongoing compliance, our team would love to grab a coffee and talk about your priorities.

📍 Ga***rd National Resort & Convention Center
👋 CyberSheath | Booth 36

See you at CS5 East!

10/13/2026

What distinguishes contractors who are well-prepared for a DIBCAC assessment?

Join CyberSheath on October 28 as Andrew Zoppi, Director of Compliance Operations, shares practical insights from supporting contractors through assessment preparation and remediation, including:

🔹 Common patterns, challenges, and misconceptions from the field
🔹 How to strengthen assessment preparation and supporting evidence
🔹 Turning assessment findings into sustainable cybersecurity improvements
🔹 Maintaining documentation, security practices, and ongoing compliance

Register today: https://bit.ly/3UatVus

10/12/2026

Your cybersecurity provider helps you meet compliance requirements. But can they help you prove it?

According to the 2026 State of the Defense Industrial Base Report, 97% of surveyed contractors that completed an assessment conducted by a C3PAO used a managed services provider or advisory firm to prepare.

But working with a provider doesn't automatically mean you're meeting DFARS, NIST SP 800-171, and CMMC requirements. Choosing the wrong partner can leave critical gaps in your cybersecurity and compliance program.

Cybersecurity Awareness Month is a reminder that protecting the mission requires shared responsibility, including choosing partners who can help you demonstrate compliance.

𝗛𝗲𝗿𝗲 𝗮𝗿𝗲 𝗳𝗶𝘃𝗲 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻𝘀 𝗲𝘃𝗲𝗿𝘆 𝗱𝗲𝗳𝗲𝗻𝘀𝗲 𝗰𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝗼𝗿 𝘀𝗵𝗼𝘂𝗹𝗱 𝗮𝘀𝗸 𝘁𝗵𝗲𝗶𝗿 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿:

1️⃣ Does your solution address all our compliance requirements? Or will we be left with gaps?
2️⃣ Can you demonstrate proven assessment success? Do you have customer references to back it up?
3️⃣ What's included, and what's not? Are there hidden costs or additional remediation fees?
4️⃣ Will you support us during an assessment? What does that support actually look like?
5️⃣ How do you ensure ongoing compliance after the initial assessment?

Choosing the right cybersecurity partner is about more than passing an assessment. It's about building confidence that your organization can protect sensitive information, maintain compliance, and demonstrate it when it matters.

Download our Compliance Vendor Selection Guide to learn what to look for, what to ask, and how to evaluate potential partners:

Cut through the confusion of CMMC compliance with a clear, actionable guide designed for DOD contractors looking for a CMMC partner.

10/09/2026

CyberSheath is honored and humbled to be named one of the 2026 Cyber50 honorees!

It’s a privilege to be recognized alongside so many exceptional leaders who are helping strengthen our cybersecurity community and advance the technologies that protect our organizations, our nation, and our future.

A sincere thank you to NVTC for this recognition and for bringing together such an inspiring community of cybersecurity professionals. We are grateful to be part of this group and excited to celebrate with fellow honorees at the NVTC Cyber Summit & Cyber50 Awards on October 28.
Congratulations to all of the 2026 Cyber50 honorees! 👏

10/09/2026

Tales from the Cyber Crypt: The Scope That Wouldn't Stop Growing 📚

It started as a manageable CMMC assessment. Then the contractor discovered something terrifying: Controlled Unclassified Information (CUI) was everywhere.

Employee laptops. Email inboxes. Shared drives. Business applications. Systems nobody initially considered part of the assessment. With every new discovery, the potential assessment boundary grew larger, bringing more systems, complexity, and costs into the picture.

The real nightmare? Not knowing where your CUI lives or how it moves through your organization.

Fortunately, this horror story has a way out.

Before defining your CMMC assessment boundary, identify where CUI is stored, processed, and transmitted, document how it flows between systems, and determine which users, applications, and supporting services need to be in scope.

For some contractors, a properly designed CUI enclave can help contain the sprawl by isolating CUI-related activity from broader commercial operations, potentially reducing assessment scope without disrupting the rest of the business.

Don't let scope creep become your next compliance nightmare.

Learn how a CUI enclave can help you establish a more manageable CMMC assessment boundary: https://bit.ly/4e10odg

10/08/2026

“If you wait for 100% information, in many cases the decision will be made for you.”

For Janet Grondin, CEO of Stellar Solutions and retired U.S. Air Force Colonel, making high-stakes decisions has been a defining part of a career dedicated to protecting the mission and strengthening national security.

With 26 years of Air Force service and experience solving complex engineering challenges across critical space systems and major aerospace programs, Janet brings a unique perspective on what it takes to lead when the stakes are high and the mission comes first.

In a new episode of Mission: Cyber, Janet joins CyberSheath CEO Emil Sayegh to discuss:

🔹 How engineering shaped her approach to leadership
🔹 Why GPS and space systems matter to national security and everyday life
🔹 Leadership lessons from her transition from military to corporate life
🔹 Why CEOs must stay engaged in cybersecurity and CMMC

For Janet, protecting the mission means safeguarding the freedoms that allow our country, our allies, and future generations to thrive.

🎧 Listen on Apple Podcasts: https://podcasts.apple.com/us/podcast/janet-grondin-on-mission-driven-leadership-national/id6788538904?i=1000793431172
🎙️ Listen on Spotify: https://open.spotify.com/episode/2McreDZmFhSzL4sjBlTorl

10/07/2026

A DIBCAC assessment shouldn’t come with surprises.

But if your documentation, evidence, and actual security practices don’t align, the gaps an assessment reveals could be scarier than you expect. 😨

Join CyberSheath on October 28 at 12 p.m. ET for DIBCAC Assessment: No Tricks, No Treats, Just the Facts, a practical look inside the DOD assessment process and what defense contractors should know before DIBCAC comes calling.

We’ll cover:

🔸 DIBCAC’s role and when assessments occur
🔸 What to expect from Medium and High assessments
🔸 What assessors look for in your SSP, controls, and evidence
🔸 Common assessment gaps and how to prepare
🔸 How DIBCAC and C3PAO assessments differ within CMMC

Don’t wait until an assessment is underway to discover the gaps in your cybersecurity program.

Register today: https://bit.ly/3UatVus