A Practical CMMC 2.0 and NIST Framework for Vendor Management Your vendors are shipping AI features you did not evaluate. A working approach to assessing AI in the supply chain against CMMC and NIST expectations, without a questionnaire nobody answers honestly.
Building Controls Into the Development Lifecycle Most AI governance programs are assembled in the wrong order — after the model is in production, when someone asks what it was trained on. What it looks like to build the controls in first.
AI Governance by Design: Building Controls Into the Development Lifecycle Read More »
what the rule actually says) What 32 CFR § 170.19 requires when categorizing assets, and the four places companies get it wrong. Most contractors find their boundary is wider than they assumed.
CMMC Scoping Guide Read More »
CMMC readiness: why so many companies think they’re ready) A template SSP, a score posted two years ago, and no asset inventory is not readiness. What a government-led assessment actually asks for, and how to test yourself against it before someone else does.
CMMC Readiness 2026 Read More »
A contractor once slid a binder across the table to me. Three hundred pages, professionally produced, every one of the 110 requirements addressed. He was proud of it, and he had every right to be — someone had done real work. I asked him what 3.1.5 meant in his environment. He looked at his IT
Get Familiar with Your Controls: Building Sustainable CMMC Compliance Read More »
*Insights · AI Governance · Updated 31 Aug 2026* The first time it landed in front of me, it was a network engineer with a firewall configuration open in one window and a chat window open in the other. A tunnel kept dropping. He pasted the running config in and asked why. He got a
AI in CMMC Environments: Hidden Risks to CUI and How to stay compliant Read More »
AI Security Series · 02 NIST SP 800-171 · CUI Insider Risk Updated 30 Aug 2026 Insights · AI Governance When an employee pastes CUI into a chatbot, what have you actually done? Almost no insider risk from AI tools is malicious. It’s someone saving twenty minutes at nine at night. For a contractor holding
Two years ago, the GRC role in most small defense contractors was a documentation role. Someone owned the policy set, someone tracked the POA&M, and the hard part was getting engineers to write down what they were already doing. That role has changed, and not because anyone announced it. It changed because AI showed up
Evolving the GRC Role in the AI Era: NIST AI RMF Read More »
AI Security Series · 03 NIST SP 800-171 · 3.2.1–3.2.3 Awareness & Training Updated 30 Aug 2026 Insights · Defense Industrial Base Your people will use AI anyway. Train them for the moment it matters. Generic AI awareness training teaches employees what a large language model is. It does not teach a program manager what
AI Awareness Training for Defense Contractors Read More »
