Business insights and articles written by our team of world-class professionals
For years, CMMC lived in the future tense. That ended on November 10, 2025, when the CMMC acquisition rule took effect and contracting officers began writing CMMC requirements into Department of Defense solicitations as a condition of award.
How the NIST 800-171 self-assessment scoring methodology works, why most SPRS scores are inflated, and how to fix yours before a prime or assessor checks.
Every defense contractor handling Controlled Unclassified Information has, somewhere in the Supplier Performance Risk System, a number between negative 203 and positive 110. That number is the organization’s self-assessed posture against NIST SP 800-171, and for years it functioned as paperwork: submitted once, rarely revisited, almost never checked
For nearly a decade, the FFIEC Cybersecurity Assessment Tool was the default self-assessment instrument for community banks and credit unions: fill in the inherent risk profile, map your maturity, hand the workbook to the examiner.
Ask a healthcare practice whether it is HIPAA compliant and the answer usually references the visible artifacts: the notice of privacy practices, the training video, the business associate agreements, maybe an encrypted email product. Ask the Office for Civil Rights what organizations get wrong, and the answer has been consistent across a decade of enforcement: the security risk analysis.
Most organizations that have an incident response plan have never run it. The document exists, the auditor saw it, the checkbox is checked, and the plan’s first execution is scheduled, implicitly, for the worst day in the company’s history.
Most small and medium businesses answer the security question with a name: we have an IT company. The IT company patches the servers, runs the antivirus, manages the firewall, and answers the tickets, and from the owner’s chair that looks like security, handled.
Every serious security framework demands a risk assessment, but few dictate exactly how to perform one, which leaves organizations choosing a methodology, often without realizing a choice is being made.
Nearly every framework requires security awareness training, nearly every organization buys some, and phishing remains the front door for a large share of breaches anyway. The uncomfortable conclusion is not that training does not work; it is that the training most organizations buy was designed to produce completion records, and completion records are what it produces.
The education sector spent years assuming obscurity was protection: who attacks a school district? The answer, it turned out, is anyone optimizing for victims with valuable data, thin defenses, lean IT staffing, and enormous pressure to restore operations quickly.