IT-CNP, Inc. GovDataHosting

10/08/2026

One question we hear from defense contractors all the time: is CMMC Level 2 the same as IL4 or IL5?

The short answer is no. CMMC Level 2 covers how your systems protect CUI under NIST SP 800-171. DoD Impact Levels 4 and 5 define the security bar for cloud environments hosting DoD data and mission systems.

Knowing which one applies to your contract, or whether you need both, can save you time, money, and a lot of compliance headaches.

Our latest article breaks down the differences and what they mean for contractor systems:
https://www.govdatahosting.com/cmmc-level-2-vs-dod-il4-il5-contractor-systems

09/25/2026

GovDataHosting is excited to sponsor the inaugural Centers for Medicare and Medicaid Services (CMS) Cloud Fusion Summit!

On Wednesday, September 30, we will be joining CMS leaders and technology partners to discuss the future of enterprise cloud at CMS, including multi-cloud strategy, security, governance, and operational excellence.

If secure, compliant cloud is on your agenda, let's connect. We hope to see you there!

View the full agenda to learn more:

Cloud. Cost. Governance. — Fused as One.

09/24/2026

FedRAMP 20x is changing the way cloud certification information is shared.

Instead of relying on a traditional certification document package, FedRAMP 20x moves toward continuously available certification data.

Under the traditional FedRAMP process, software companies assembled documents such as the System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and supporting artifacts and provided them to agencies when requested.

Under the Consolidated Rules for 2026, certification data must be available continuously in both human-readable and machine-readable formats.

For federal agencies, this means certification information must remain continuously available to agency personnel and automated systems, not simply provided as a document package at a single point in time.

For software companies, it means building and maintaining the infrastructure behind that access, including programmatic access, access controls, logging, availability, and keeping information synchronized across formats.

Sharing the data is the easy part. Governing who can access it, when they accessed it, and how the information stays accurate and available is where the engineering work comes in.

Software companies don't necessarily have to build that capability themselves. It can be inherited through the platform supporting their application, allowing their engineering teams to focus on the product rather than building another compliance system.

We take a closer look at FedRAMP 20x Trust Centers and Certification Data Sharing in our latest blog post.

Read full blog post: https://www.govdatahosting.com/fedramp-20x-trust-center-certification-data-sharing