Insights

CISO Perspective OCI Generative AI Agents Oracle Deep Data Security Published 28 Sep 2026 Insights · AI Security and Identity Oracle agentic AI security: four layers between an agent and your data IAM, agent identity, tool access and database-enforced authorization in OCI Generative AI and Oracle AI Database 26ai. What each layer does, where the

CISO Perspective Agent Identity / SERVICE_AGENT Cortex AI Gateway Preview Updated 17 Sep 2026 Insights · AI Security and Identity AI agents are becoming privileged identities Snowflake’s work on AI agent identity and AI gateways shows where enterprise security is heading. The risk to watch is not the model. It is the authority you hand

Under 32 CFR § 170.22, the Affirming Official is defined by responsibility and authority, not by title. A CISO may qualify. So may an owner. A systems administrator who knows the environment best often does not — and neither does your MSP, consultant or C3PAO. What the rule actually requires, and what should sit in front of the signatory first.

CMMC Regulatory Brief · 01 Class Deviation 2026-O0025 Rev. 3 DFARS Part 240 · FAR Part 40 Updated 09 Sep 2026 Insights · CMMC & NIST SP 800-171 C3PAO wasn’t removed. Read the status list. Both C3PAO statuses survive in the revised DFARS text — and requiring activities have been directed not to designate them.

AI Governance Brief · 02 DFARS 252.204-7012 · NIST SP 800-171 · FedRAMP CUI & Generative AI Updated 06 Sep 2026 Insights · AI Governance Can you put CUI into generative AI? The honest answer is that it depends on five things, and none of them is the vendor’s marketing page. A decision framework for

Vendor Brief · 01 32 CFR 170 · DFARS 252.204-7012 · NIST SP 800-171 ESP / SPA Scoping Updated 06 Sep 2026 Insights · AI Governance Are AI vendors ESPs or SPAs under CMMC? The question assumes the two are competing labels for the same thing. They aren’t — and the classification follows the data

what the Phase 2 pause did not change Two separate obligations that contractors routinely collapse into one. The certification milestone is suspended; the self-assessment, the posted score and the annual affirmation are not. What you still owe under 7019 and 7020.

What AI changes, and what it doesn’t Four areas where AI workloads genuinely alter the control set — power and cooling, cluster fabric, accelerator tenancy, data disposal — and the much longer list where the existing 800-53 baseline already covers you.

defined for a CUI environment Most threat lists mix three unrelated things: AI used against you, attacks on the AI you deploy, and risk you create yourself. Separating them is what makes the list usable for scoping.