Agile IT

10/14/2026

The last of Cyber AB's five proposals is the one that should generate the most disagreement.

Cyber AB's own justification is a cost-benefit argument: protecting Federal Contract Information alone may not clear the Department of War's cost-benefit and risk-analysis threshold. Removing Level 1 would apply immediate relief to small businesses across the DIB.

That is not a claim that FCI doesn't need protecting. It's a claim that a standalone certification tier built around it may not be where the government's limited assessment capacity should go.

If Level 1 disappeared tomorrow, would your organization's FCI handling change, or would it stay exactly the same either way?

10/13/2026

Proposal four is a supply problem wearing a process costume.
CCA and CCP credentialing currently runs through DCSA's Tier 3 investigation process, which Cyber AB describes as cumbersome and exceedingly slow to adjudicate. Private-sector firms already offer Tier 3-equivalent background checks.

Letting those private-sector checks count would increase the supply of credentialed assessors and lower the cost of a Level 2 certification assessment industry-wide.

Every contractor stuck on a waitlist for an assessor is downstream of this exact bottleneck.

If assessor supply doubled tomorrow, would it move your certification timeline, or is something else the real constraint?
If timeline is what's actually in your way, here's how we help contractors move faster on Level 2:

Your CMMC assessment confirms your environment on one day. Your attestation requires it to still be true eleven months later, backed by the weight of the

10/08/2026

Proposal three in Cyber AB's Reform Task Force response takes direct aim at how the three-year cycle behaves.

The current model assesses a company at a single point in time, then locks that snapshot in for three years. Cyber AB's proposal would allow continuous monitoring and delta assessments instead.

Their own framing is blunt about the problem this solves: a static, point-in-time model disincentivizes companies from modernizing or improving their networks, because any change risks triggering a full reassessment.
An organization that upgrades its environment mid-cycle should not be penalized for the upgrade. Right now, in some cases, it is.

Has your organization ever held off on an improvement because of what it might do to your assessment status? More on what triggers a reassessment today:

Learn when to schedule a new CMMC assessment, what triggers reassessments, and how changes in scope, contracts, or compliance impact your certification process.

10/06/2026

The second of Cyber AB's five Reform Task Force proposals is pure math.
The current requirement is a minimum of three CCAs per C3PAO assessment team. Cyber AB is asking the task force to cut that to two.

Fewer required credentialed assessors per team means lower cost per assessment and more teams available to run them. Right now, assessor supply is one of the quieter bottlenecks slowing Level 2 certifications industry-wide.
This is the kind of proposal that sounds procedural until you're the company waiting on a C3PAO calendar.

Does your organization currently have a C3PAO booked, or are you still waiting for capacity to open up? More on where Level 2 assessment stands: https://agileit.com/cmmc-overview/

10/02/2026

Cyber AB sent five proposals to the Reform Task Force. This is the one that should worry you most if you're mid-decision on a CSP.

Cyber AB's own language calls the FedRAMP-to-CMMC relationship "fraught with confusion." Its response also states that 32 CFR Part 170 doesn't tell a contractor what its CSP, MSP, or MSSP has to do to meet conformity requirements.

That gap is not academic. It's the exact question behind every FedRAMP 20x conversation happening right now, and Cyber AB says the status of 20x remains unresolved at the regulatory level.

Until that clarity arrives, the safer read of DFARS 252.204-7012 hasn't changed: FedRAMP Moderate authorization or documented equivalency, not a designation still under internal debate.

If your CSP conversation is stuck on this exact ambiguity, what's the sticking point?

Not sure where your Microsoft cloud environment falls under CMMC Level 2? See what GCC High changes, where FedRAMP equivalency enters the picture, and what your CUI boundary requires.

Understand what CMMC Level 2 requires in Microsoft 365 GCC High environments, including NIST 800-171 alignment, cloud responsibilities, and assessment readiness.

09/30/2026

Five words that have saved more than one defense contractor: Native retention is not backup.

Microsoft 365 is remarkably resilient, as a service. Your data within it is a different story. Retention policies, recycle bins, and version history were designed for compliance and convenience, not for recovery. They won't save you from a ransomware event that encrypts synced files, a departed admin's cleanup script, or a well-meaning user who deleted the wrong SharePoint library six weeks ago.

For organizations handling CUI, the stakes are higher: Recovery isn't just an operational concern, it's part of your security story.
What real backup for Microsoft 365 looks like:

• Coverage across the workloads you actually use: Exchange, SharePoint, OneDrive, Teams, Microsoft 365 Groups.
• Backup policies, retention, and encryption you configured on purpose, not defaults you inherited.
• And the step almost everyone skips: TEST RESTORES. A backup you've never restored from is a hypothesis, not a safeguard.
We validate every backup deployment with test restores per workload before handoff, because the worst time to discover a backup gap is the day you need the data back.
When did you last test-restore from your Microsoft 365 backup? If the answer is "never" or "what backup?", let's fix that.

Learn More about Ensure Microsoft 365 Backup Data Integrity 👇

Discover strategies to maintain data integrity during Microsoft 365 backups. Prevent corruption, ensure reliability, and meet compliance standards.

09/28/2026

Here's something that surprises people: a meaningful share of the defense contractors we move into GCC High are coming from Google Workspace.

It makes sense when you think about it. Plenty of companies built their business on Gmail and Google Drive, then won Department of War contracts, inherited CUI obligations, and discovered that their collaboration stack and their compliance requirements no longer match.

The good news: the path from Google to GCC High is well-worn. Gmail migrates to Exchange Online. Google Drive migrates to OneDrive. Google Shared Drives migrate to SharePoint. Identities are provisioned fresh in the target tenant with MFA and Conditional Access from day one.

The honest news: it takes planning. Calendar and contacts fidelity depends on what Google's APIs expose. Folder structures and permissions need a mapping strategy, not a copy-paste. And your email domain has to move in a carefully buffered cutover so mail never falls on the floor.

None of that is a reason to stay put. It's a reason to sequence the move properly.

If you're running Department of War contracts on Google Workspace and wondering how the jump works, we've made this exact move before. Happy to share what to expect.

09/23/2026

Some of the most important lines in our statements of work are the things we won't do.

We don't conduct formal CMMC assessments. We prepare your environment and your evidence. A certified C3PAO conducts the assessment. Any vendor who implies they can do both should worry you.

We don't own your CUI boundary. We consult on it, pressure-test it, and validate it, but you define it and you own it, because you're the one defending it to an assessor.

We don't run a 24×7 SOC. We configure the Microsoft-native security tooling and pair with a FedRAMP-authorized MSSP for around-the-clock monitoring. Depth over sprawl.

We don't take over your compliance program. Your SSP and policies stay yours: we support, your team and your compliance partner own.

Why draw these lines?
Because in the CMMC ecosystem, clean separation of duties isn't bureaucracy. It's what keeps your assessment credible. Assessors trust scopes with clear boundaries. So should you.

Vendors who do everything end up accountable for nothing. We'd rather be excellent inside our lane, Microsoft government cloud, migration, and the security engineering underneath your compliance story, and honest about where our lane ends.

09/21/2026

A question every defense contractor should ask their managed service provider: "Are you inside my CMMC assessment scope?"
Most MSPs are, and most don't realize what that costs their customers.

The traditional MSP model installs monitoring agents everywhere, connects third-party tools to your tenant, and holds standing admin accounts. Every one of those choices pulls the MSP itself into your CMMC boundary. Their tooling becomes your assessment problem.

There's a cleaner way to run managed services for the DIB:

• Named accounts. Engineers work under named user accounts in YOUR Entra ID: no shared logins, no generic admin credentials.
• VDI-only access. All remote work happens inside your virtual desktop, protected by your policies.
• Just-in-time elevation. Admin rights require a Privileged Identity Management request: approved, time-limited, and documented. No standing privileges. Ever.
• Evidence by default. Every session and change is recorded, so the audit trail exists before the assessor asks for it.

No RMM agents. No third-party tools bolted onto your tenant. No third-party service provider muddying your assessment boundary.

Managed services should make your CMMC story simpler, not longer. If your current provider can't explain their place in your boundary, that's worth a conversation.

09/17/2026

Here's a hard truth about CMMC: implementing the controls is only half the work.
An assessor doesn't just look at your environment. They look at how you've documented it, and this is where technically strong organizations stall:

A System Security Plan that describes your boundary, maps every control to how it's implemented, and distinguishes what you own from what's inherited from Microsoft.

Written policies and procedures an assessor expects to see: access control, incident response, change management, media protection, aligned to the NIST 800-171 control families and reflecting how you operate, not how a template imagines you do.

Evidence that lives somewhere findable. A GRC platform with controls loaded, evidence locations linked, and responsible parties named beats a folder of screenshots every single time.

We've watched contractors with genuinely well-configured environments lose months because the paper trail didn't match the tenant. And we've watched assessments go smoothly because every control had a narrative, an owner, and evidence waiting before anyone asked.

The environment proves you can protect CUI. The documentation proves you do: repeatedly, on purpose, in a way someone else could verify.
Build both. In that order, but build both.

hashtag hashtag hashtag hashtag hashtag hashtag