Built on Avatara’s FedRAMP Moderate Equivalency platform foundation, MRO provides organizations with a fully managed Controlled Unclassified Information (CUI) enclave that supports all 110 CMMC Level 2 controls and enables customers to inherit 80% of the CMMC Level 2 practice objectives on Day 1, accelerating CMMC readiness timelines to as little as 60 days.

The launch comes at a critical moment for the DIB. As CMMC requirements move into active enforcement across the Department of Defense (DoD) supply chains, thousands of contractors face mounting pressure to secure compliant infrastructure, complete documentation requirements, and schedule assessments in an increasingly constrained certification market.

“Companies should be focused on growing their business and supporting their customers — not spending years navigating fragmented infrastructure, disconnected security tools, and compliance uncertainty,” said Rob McCormick, founder and CEO of Avatara. “Our mission is to help organizations thrive in regulated environments by simplifying the path to secure operations and compliance readiness, and MRO is here and now for an industry that needs trusted solutions.”

“Enterprises across the DIB understand that compliance is no longer optional — but most do not have the time, internal resources, or operational runway to spend a year rebuilding infrastructure and documentation from scratch,” said Matt Pushkin, vice president of compliance and government Sslutions at Avatara. “MRO gives contractors a deterministic path forward. We provide the compliant platform foundation, the operational support, and the documentation acceleration needed to move organizations toward assessment readiness quickly and confidently.”

Source: Avatara

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post Avatara launches CMMC readiness offering appeared first on Intelligence Community News.

With CMMC requirements now embedded in DoW contract solicitations and renewals, primes face growing risk due to limited visibility into supplier compliance readiness, putting key programs at risk when suppliers fail to achieve CMMC accreditation on time.  A single uncertified supplier can mean disqualification from contract award. Together, A-LIGN and Exostar make the path to certification for primes and their suppliers faster and more straightforward, while giving primes unprecedented confidence in the security and compliance of their supply chains.

“The defense supply chain is only as strong as its weakest link,” said Scott Price, CEO of A-LIGN. “By pairing Exostar’s supply chain visibility capabilities with A-LIGN’s experienced CMMC teams that conduct rigorous assessments at scale, we’re giving prime contractors the confidence that every supplier in their network gets certified and compliant before affecting DoW revenue streams. The partnership will help contractors drive readiness, strengthen security at scale, and position themselves for success.”

“Our community has trusted us to deliver supply chain visibility and management and secure, compliant collaboration for over two decades. We’ve understood the importance of CMMC to the DoW and the DIB since the framework was first proposed in 2019, leading us to invest in the development of our innovative CMMC Ready Suite of products and managed services,” said Richard Addi, CEO at Exostar. “Partnering with A-LIGN complements our CMMC Ready Suite with the resources necessary to give our customers the direct, trusted accreditation assessment pathway imperative for primes and suppliers to protect and enhance their DoW revenue streams.”

Source: Exostar

Stay in the know with breaking news from across the IC and IC contracting landscape by becoming a paid subscriber to IC News. Your support makes our work possible.

The post A-LIGN and Exostar partner appeared first on Intelligence Community News.

Approximately 68,000 small and mid-sized defense contractors handle sensitive DoD data, including Controlled Unclassified Information (CUI), making them persistent targets for cyber-attacks. While large defense contractors have the tools, staff, and budgets to address these risks, smaller contractors often do not. At the same time, they face increasing DoD compliance requirements—particularly CMMC Level 2—adding cost and operational complexity. Organizations must also demonstrate to contractor leadership and external compliance auditors that cybersecurity controls are effective.

One critical requirement for both cybersecurity and compliance is the ability to continuously detect and rapidly block threats. DIB CyberDome features components for both individual contractor protection and collective defense across participating organizations.

Unlike traditional approaches that rely on complex, costly, and labor-intensive mechanisms, DIB CyberDome provides automated, adaptive defense that addresses both cybersecurity and compliance requirements in a deployable, cost-efficient model.

CyberDome directly addresses the two most operationally complex CMMC Level 2 requirements — continuous boundary monitoring (SI.L2-3.14.6) and network protection (SC.L2-3.13.1) — controls that typically require costly SIEM, SOAR, and 24/7 SOC investments that most small contractors cannot sustain.

The launch comes as defense contractors face increasing cyber threats from international adversaries and accelerated timelines for CMMC Level 2 compliance.

Vince Crisler, chief strategy officer at Celerium and former White House CISO, noted, “Small and mid-sized defense contractors are now facing the same level of adversary sophistication as the largest primes, but without comparable resources or visibility. DIB CyberDome changes that model — putting automated, real-time threat detection and blocking at the network boundary, where breaches actually begin, without requiring the staff or infrastructure that smaller contractors don’t have.”

Source: Celerium

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post Celerium launches DIB CyberDome appeared first on Intelligence Community News.

The Defense Industrial Base is comprised of thousands of defense contractors and partners that design, develop, and manufacture combat mission systems, platforms, and technologies that are essential to the US military’s digital strength. These organizations require secure environments to conduct classified research and development, system integration, testing and evaluation, and mission support activities for Department of War programs across all warfighting domains. With the Defense Industrial Base Isolated Cloud, these organizations can now access Oracle’s isolated cloud infrastructure while maintaining strict compliance with Department of War security standards and classification protocols.

DICE enables the expansion of existing on-premises classified independent research and development environments into Oracle Cloud Infrastructure while ensuring the boundaries of the Secret Internet Protocol Router Network (SIPRNet) and the Joint Worldwide Intelligence Communications System (JWICS) are respected. Critically, the new cloud environment allows multiple Defense Industry Base members to collaborate securely on joint classified programs. In addition, DICE will help accelerate program timelines and enhance mission effectiveness by providing users with granular access controls to workloads and resources within isolated environments.

“The Defense Industrial Base Isolated Cloud Environment represents our unwavering commitment to both the Department of War and its partners who develop the combat systems that protect our nation and support our warfighters worldwide,” said Kim Lynch, executive vice president, government, defense and intelligence, Oracle. “The ability for multiple defense contractors to collaborate securely on classified programs is essential to maintaining US technological superiority during this time of increased strategic competition.”

Source: Oracle

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post Oracle launches DIB Isolated Cloud appeared first on Intelligence Community News.

The Cybersecurity Maturity Model Certification (CMMC) program was developed by the U.S. Department of Defense (DoD) to strengthen cybersecurity across the Defense Industrial Base (DIB) and verify that contractors protect sensitive information appropriately. Cyber threats targeting the Defense Industrial Base continue to grow in both frequency and sophistication. The CMMC program provides the DoD with greater assurance that its partners are equipped to defend sensitive information and maintain operational integrity.

For defense contractors, CMMC requirements are increasingly tied to eligibility for certain DoD contracts. Because Evolver achieved Level 2 certification via a C3PAO assessment, customers and partners can have added confidence in the company’s independently verified approach to protecting Controlled Unclassified Information (CUI) and managing cyber risk, the company said.

CMMC Level 2 certification helps reduce risk for organizations that handle CUI and operate in high-trust environments.

Source: Evolver

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post Evolver achieves CMMC Level 2 appeared first on Intelligence Community News.

“By partnering with Carahsoft, we are bringing the next generation of compliance architecture to the public sector,” said Nick Summers, CEO and co-founder at ComplAi. “The GRC market is bifurcating. On one side are platforms that store compliance documents. On the other are platforms that capture compliance decisions — the full chain of evidence, reasoning and authorization behind every determination. ComplAi is the only platform purpose-built on a context-graph architecture with native data protection and asset intelligence as foundational layers. We govern compliance continuously, at the most atomic level of every framework we support, with full decision lineage that makes every future determination faster and more defensible. Other GRCs report on compliance. ComplAi governs it.”

ComplAi is the first compliance platform built on a context-graph architecture with native data security posture management and cyber asset attack surface management as foundational layers — not bolt-on integrations. Where traditional GRC platforms store static documents and control statuses, ComplAi captures the full decision lineage behind every compliance determination: what assets were in scope, what data classifications applied, what the live infrastructure state was and who authorized the action. That decision graph compounds over time, building an organizational compliance intelligence asset that legacy architectures cannot replicate. ComplAi supports CMMC, NIST 800-171, NIST 800-53, FedRAMP and continuous ATO environments.

“ComplAi empowers agencies with real-time visibility into sensitive data and assets,” said Brian O’Donnell, vice president of cybersecurity solutions at Carahsoft. “The platform accelerates certification readiness, reduces operational costs and delivers continuous assurance across cloud and on-premise environments. Carahsoft and our reseller partners look forward to collaborating with ComplAi to bring the proactive compliance platform to the public sector.”

Source: Carahsoft

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post ComplAi and Carahsoft partner appeared first on Intelligence Community News.

The rigorous independent assessment was conducted by a Certified Third-Party Assessment Organization (C3PAO), validating that SMX has implemented and institutionalized the security practices aligned to National Institute of Standards and Technology Special Publication (NIST SP) 800-171 required under CMMC Level 2. Fewer than 300 organizations across the DIB, which includes more than 75,000 contractors supporting the Department of War (DoW) have achieved this certification to date.

CMMC 2.0, formally released by the DoW in December 2024, establishes mandatory cybersecurity standards for contractors handling sensitive defense information. Level 2 certification confirms that SMX maintains the advanced security controls, continuous monitoring capabilities, and governance frameworks required to protect CUI and support national security missions.

“Achieving CMMC 2.0 Level 2 certification underscores SMX’s unwavering commitment to securing the defense supply chain and protecting the sensitive information entrusted to us,” said Anthony Vultaggio, chief technology officer at SMX. “We view CMMC not simply as a compliance requirement, but as a strategic imperative-enabling us to deliver resilient, secure, and mission-focused solutions to our DoW clients.”

Source: SMX

IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.

The post SMX achieves CMMC 2.0 level 2 appeared first on Intelligence Community News.

“This achievement represents an important milestone for CenCore. Our collaboration with NIWC will provide modular facilities that are domestically manufactured, enhancing the DIB and reducing the U.S. government’s reliance on foreign suppliers. We remain committed to proactively addressing national security threats and supply chain risks. CenCore’s modular solutions offer rapid deployment, resilience, and high-level integration,” said Adam Fife, CEO of CenCore.

Under this contract, CenCore will design, manufacture, deliver, assemble, and install up to eight relocatable modular facilities, each approximately 4,800 square feet, at NIWC Atlantic sites in the Charleston, South Carolina region. The single-story facilities will be placed on pre-existing concrete pads. These modular facilities will deliver secure, scalable, and rapidly deployable infrastructure, accelerating construction schedules, and offering greater flexibility compared to conventional building methods.

Source: CenCore

Stay in the know with breaking news from across the IC and IC contracting landscape by becoming a paid subscriber to IC News. Your support makes our work possible.

The post CenCore secures NIWC Atlantic contract appeared first on Intelligence Community News.

“We are thrilled to partner with Carahsoft to help agencies protect the critical systems they depend on,” said Florian Doumenc, CEO and co-founder of Trout Software. “Much of the nation’s critical infrastructure still relies on aging OT equipment that cannot be patched or moved to the cloud. Trout Access Gate places a security proxy, deployable in minutes, directly in front of these assets to enable agencies to strengthen resilience with zero downtime and accelerate their path to compliance.”

Trout Access Gate applies Zero Trust security to the essential OT and legacy systems that support public operations, including Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) servers, sensors, cameras, building automation systems, controllers and equipment.

With a single appliance per site, Trout Access Gate places a dedicated security proxy in front of each critical asset, providing:

• Zero Trust access controls
• Network and asset cloaking
• Micro-segmentation without network redesign
• Secure remote operations
• Protocol filtering and audit visibility
• CMMC / NIST 800-171 ready safeguards

This approach enables organizations to strengthen cyber-physical resilience while maintaining existing infrastructure, which is a priority for municipalities, public utilities, defense logistics sites and manufacturing operations that support the Defense Industrial Base.

“Adding Trout Software to our portfolio enables organizations to modernize on-premise and OT security quickly and with minimal disruption,” said Alex Whitworth, cybersecurity solutions vertical executive at Carahsoft. “As cyber threats increasingly target legacy systems and critical infrastructure, Trout’s on-premise Zero Trust overlay delivers a critical capability for our Government and DIB customers, particularly as they work toward NIST 800-171 and CMMC compliance. Carahsoft and our reseller partners are pleased to collaborate with Trout Software to help protect our nation’s critical infrastructures.”

Source: Carahsoft

Like IC News? Then please consider subscribing. You’ll get full access to our searchable library of 10,000+ articles, plus new articles each weekday.

The post Trout Software and Carahsoft partner appeared first on Intelligence Community News.

The P2 Compliance Program is designed to support organizations that handle Federal Contract Information (FCI) and are required to implement CMMC Level 1 practices. The approach focuses on clear control interpretation, defensible evidence development, and documentation practices that support accurate self-attestation in accordance with the CMMC framework.

“CMMC Level 1 self-attestation is not a paperwork exercise as it requires deliberate implementation and defensible evidence,” said System High Director of Digital Risk and Compliance Dan Stallings. “System High’s P2 Compliance Program helps organizations understand the government’s intent, apply the controls correctly, and attest with confidence knowing their cybersecurity posture aligns with CMMC expectations.”

System High delivers cybersecurity, compliance, and mission assurance solutions supporting the Defense and Intelligence communities. Through the P2 Compliance Program, System High enables organizations to meet evolving cybersecurity requirements with clarity, discipline, and operational realism. The goal is to empower the DIB to achieve certification confidently and maintain mission readiness through proactive governance.

System High supports contractors with interpretation and implementation of CMMC Level 1 practice; policy and procedure development aligned to government guidance; evidence identification and validation to support self-attestation; and readiness reviews deigned to reduce compliance risk.

“By leveraging System High’s vast experience across both cleared and unclassified environments, we help organizations establish repeatable, sustainable compliance programs that withstand scrutiny and support future CMMC maturity,” Stallings added.

Source: System High

Stay in the know with breaking news from across the IC and IC contracting landscape by becoming a paid subscriber to IC News. Your support makes our work possible.

The post System High unveils P2 program appeared first on Intelligence Community News.