CISO Perspective Agent Identity / SERVICE_AGENT Cortex AI Gateway Preview Updated 17 Sep 2026 Insights · AI Security and Identity AI agents are becoming privileged identities Snowflake’s work on AI agent identity and AI gateways shows where enterprise security is heading. The risk to watch is not the model. It is the authority you hand […]
Snowflake Agent Identity: AI Agents as Privileged Identities Read More »
Under 32 CFR § 170.22, the Affirming Official is defined by responsibility and authority, not by title. A CISO may qualify. So may an owner. A systems administrator who knows the environment best often does not — and neither does your MSP, consultant or C3PAO. What the rule actually requires, and what should sit in front of the signatory first.
CMMC SPRS Affirmation: Who Can Sign and What the Affirming Official Is Certifying Read More »
CMMC Regulatory Brief · 01 Class Deviation 2026-O0025 Rev. 3 DFARS Part 240 · FAR Part 40 Updated 09 Sep 2026 Insights · CMMC & NIST SP 800-171 C3PAO wasn’t removed. Read the status list. Both C3PAO statuses survive in the revised DFARS text — and requiring activities have been directed not to designate them.
Is C3PAO Still Required? CMMC Phase 2 Suspension Explained? Read More »
AI Governance Brief · 02 DFARS 252.204-7012 · NIST SP 800-171 · FedRAMP CUI & Generative AI Updated 06 Sep 2026 Insights · AI Governance Can you put CUI into generative AI? The honest answer is that it depends on five things, and none of them is the vendor’s marketing page. A decision framework for
Can you put CUI into generative AI Read More »
Vendor Brief · 01 32 CFR 170 · DFARS 252.204-7012 · NIST SP 800-171 ESP / SPA Scoping Updated 06 Sep 2026 Insights · AI Governance Are AI vendors ESPs or SPAs under CMMC? The question assumes the two are competing labels for the same thing. They aren’t — and the classification follows the data
AI Vendors Under CMMC: ESP, SPA, or Neither? Read More »
what the Phase 2 pause did not change Two separate obligations that contractors routinely collapse into one. The certification milestone is suspended; the self-assessment, the posted score and the annual affirmation are not. What you still owe under 7019 and 7020.
SPRS score vs CMMC: what the Phase 2 pause did not change Read More »
Innovation Without Control Is Risk An engineer pastes a firewall config into a chat window and solves the problem in four minutes. Why that is a control failure, and how to permit AI use without putting CUI outside your boundary.
AI in CMMC Level 2: Innovation Without Control Is Risk Read More »
What AI changes, and what it doesn’t Four areas where AI workloads genuinely alter the control set — power and cooling, cluster fabric, accelerator tenancy, data disposal — and the much longer list where the existing 800-53 baseline already covers you.
Data center security: What AI changes, and what it doesn’t Read More »
defined for a CUI environment Most threat lists mix three unrelated things: AI used against you, attacks on the AI you deploy, and risk you create yourself. Separating them is what makes the list usable for scoping.
AI cybersecurity threats, defined for a CUI environment Read More »
What Actually Changes in Each Governance Process This is not a new compliance program. Walking through inventory, access management, boundary control and classification to show which existing processes need a line added, and which need nothing.
AI in a CUI Environment: What Actually Changes in Each Governance Process Read More »
