🦄 Jeff McCoy

CMMC gets talked about like a goldmine. With over 300,000 defense contractors in the ecosystem, the opportunity is there. But so is the cost of getting it wrong. Before getting into tools, certifications, or service design, there’s a more important question to answer first: does this actually make sense for your business? We put together a simple starting point to help you evaluate that decision more clearly. If you’re considering this space, this is a good place to begin. 👉 https://hubs.la/Q04b8yFz0 #CMMC #MSP #ManagedServices #Cybersecurity

12

1 Comment

One question every defense contractor SHOULD be able to answer about their AI tools: Is it listed on the FedRAMP Marketplace? If you don't know...we'd recommend fixing that because every time your team uploads CUI to a platform that isn't FedRAMP High authorized, you're exposed (!). Take it from MORSECORP's $4.6 million loss earlier this year 🫣 For using a third-party email host that lacked FedRAMP protections, they had to pay up and settle False Claims Act allegations. Just like you could, they fell for the classic confusion: equating CMMC Level 2 certification with FedRAMP certification. They're completely different. If a vendor says their company is "CMMC Level 2 certified," that just certifies the company itself - not the products. FedRAMP certifies cloud products. The good news: verification takes <30 seconds. Go to the FedRAMP Marketplace. Search for your vendor. Check the impact level. Done ✅ P.S. GovSignals is the *only* AI proposal platform listed at FedRAMP High. You can verify that on the Marketplace right now.

10

1 Comment

Don’t want to put your #SecurityClearance level on your résumé? Here are ways I’ve seen professionals commonly list clearance status instead: • Active security clearance • Active government-issued security clearance • Current U.S. Government security clearance • Maintains an active security clearance • Holds an active clearance

53

8 Comments

HERE’S WHAT MOST DEFENSE CONTRACTORS AREN’T PLANNING FOR YET: Three converging timelines that will reshape CMMC compliance in the next 7 months. Timeline 1: Rev 3 Transition 📅 DoD has published ODP values for NIST SP 800-171 Rev 3 📅 Transition window: 2H 2026–early 2027 📅 Organizations conducting SSP refreshes NOW can incorporate Rev 3 at lower cost Timeline 2: AI/ML Security 📅 NDAA FY2026 Section 1513 — DoD AI/ML cybersecurity framework 📅 June 16, 2026 status update deadline to Congress 📅 Built on existing DFARS/CMMC infrastructure — not a separate system Timeline 3: Assessment Capacity 📅 Phase 2 mandatory C3PAO assessments begin November 2026 📅 Scheduling window: approximately 7 months from today 📅 C3PAO backlogs have not materially eased The convergence: 🚀 These three timelines collide in Q3/Q4 2026 🚀 Organizations that wait will face compressed schedules, limited assessor availability, and higher remediation costs 🚀 The planning window is now — not after the first deadline passes Which of these three timelines are you actively managing against? #CMMC #NIST800171 #DefenseContracting #CMMCCompliance #CyberResilience

2

In the DoD supply chain, "security-ish" is a fast track to a lost contract. 📑⚠️ A small supplier recently found this out the hard way. They had the tools, but they lacked the discipline. When the prime contractor asked for proof of MFA and separate logins, the room went silent. Shared accounts and inconsistent MFA aren't just "bad habits"—they are non-compliances that stall deals. We stepped in to implement the Level 1 Fundamentals: ✅ MFA Everywhere: No exceptions, across all systems. ✅ Identity Integrity: Eliminated shared accounts for total accountability. ✅ Access Control: Tightened admin privileges and brought all devices into policy. ✅ Clean Proof: Established the documentation needed to satisfy the Prime's requirements. Cybersecurity for defense work doesn't always require a dramatic overhaul; it requires the fundamentals done the right way. Is your "quiet room" moment coming? Let’s get your basics audit-ready before you sign that next contract. #DoD #CMMC #GovCon #CyberSecurity #Compliance #XactITSolutions #XactAISolutions

1

If your organization handles data related to missiles, nuclear technology, or defense activities, you’re likely dealing with Export Controlled Information (ECI). Because it's categorized as CUI by the DoD, that means strict safeguarding requirements under DFARS and CMMC apply. With CMMC enforcement starting next month, contractors handling this data can’t afford compliance gaps. Learn what ECI is, the laws that regulate it, and how to protect it before CMMC requirements start showing up in your contracts. 👉 Read our guide: https://lnkd.in/ePz8XD9T

14

BlackSky Geospatial Solutions has been awarded a $99 million sole-source contract by the Air Force for the development of an optical imaging system testbed as part of the SBIR Phase III program. #govcon #governmentcontracting #defensecontracts

2

The US Army is launching Network Modernization Experiment (NetModX), its annual push to accelerate advanced technology for the battlefield. Read full story: https://lnkd.in/ekA5XUgw --- #GovConNews #NetModX #USArmy

4

The GSA just announced new CUI requirements for ALL contractors. Starting now, if you have a GSA schedule and handle federal data, you must comply with NIST SP 800-171. This is not future tense. This is happening now. The requirements are identical to what DoD contractors have been preparing for with CMMC. 110 controls. Evidence collection. System security plans. If you are a GSA contractor, you need to assess your compliance posture now, before your next contract modification. We built GSA Ready Now to help. Free assessment tools, policy templates, and gap analysis. Start here: https://gsareadynow.com/ #GSACompliance #NIST800171 #FederalContractors #Cybersecurity

1

"If you want to do business with the federal government, specifically the DoD, do you want to bank on another company getting FedRAMP authorized in time? We’re not adding to our tech stack unless it’s CMMC compliant. This is the path forward. Our adversaries are trying to infiltrate our systems daily. If they’re not FedRAMP authorized, and you want to work with the DoD—run.”   That’s what one contractor shared during the ENR-hosted webinar on CMMC compliance.   Like many federal contractors, they assumed their compliance strategy was solid, until they realized the risk wasn’t just internal. Their entire ecosystem, from partners to vendors, had gaps that could cost them contracts.   That’s the reality of CMMC.   It’s not just another checkbox. It’s the new baseline for doing business with the DoD, and it’s already impacting revenue.   In this panel discussion, sponsored by Kahua, industry experts from Quanta Government Solutions, AVCOR CONSTRUCTION, LLC, Aprio, and K2, Inc. break down how they’re tackling this challenge. From aligning internal teams to guiding subs, they’re sharing what’s working and what’s not in real time.   Watch the full session to learn: ✅ How leading contractors are turning compliance into a competitive edge ✅ What it takes to build a scalable, cross-team compliance framework ✅ Common blind spots and lessons learned from the field ✅ Why choosing a FedRAMP-authorized platform like Kahua matters ✅ A quick demo of Kahua’s free CMMC Readiness app to help you get organized   Watch the full webinar now, link in the comments.

26

1 Comment

Today's top Govly Signals headlines: CISA and Federal Partners Release OT Zero-Trust Guidance Department of the Air Force Hosts LG-N Industry Day at Hanscom AFB USDA Awards Palantir Data Modernization Contract Read them all and more at signals.govly.com

1

A platform-ready architecture designed for national security and dual-use AI applications. Integrates secure code generation, decision support, and real-time deployment pipelines — purpose-built for DoD, ISR, and command-level systems.

2

In cybersecurity, your skills speak louder than your rank or title. Scott Lathrop from Raytheon shares what hiring managers are really looking for—technical competence. Whether you’re a developer, analyst, or penetration tester, your resume should highlight the hands-on experience that proves your expertise. Show what you can do, not just what you’ve done. That’s what sets you apart in a competitive field like cyber. Learn how to position your skills for success at 7Eagle.com/launch. #7EagleAcademy #MilitaryTransition #HireVeterans #SkillBridge #CyberSecurity #VeteranSuccess #CareerReadiness #TechCareers

4

Gray Analytics, a Huntsville based small business which strives to bring clarity to the critical mission of cybersecurity, is being awarded a 5-year $59.5M single-award IDIQ to support the digitization, modelling, and automation of the full lifecycle of systems engineering using a secure model-centric data-driven framework that incorporates model-based systems engineering, modular open systems approach, data engineering, development, security, and operations, and machine learning technologies. ==>> https://lnkd.in/exJSxvTJ Gray Analytics | David Jarmon | Scott Gray

17

3 Comments

Can you tell FCI from CUI? If you're in the DoD supply chain, this is not a trivia question. One letter different, 95 controls apart, and potentially the difference between bidding on a contract and being locked out of it entirely. Most contractors I talk to handle some of both — but aren't clear on which data falls where. And that's the problem: your CMMC level is determined by the most sensitive type of information you handle, not the average. Swipe through to get the quick version. 👇 If you're looking at a contract right now and trying to figure out where you land, book a free scoping session — link in the comments. We'll walk through what you actually handle and tell you whether Level 1 or Level 2 applies. No pitch, no pressure. #CMMC2026 #FederalContracting #CMMC #DIBcontractors #CUI #DefenseContracting #GovCon

[#Deltek Blog] Army MAPS, GovCon Proposals, and How Contractors can Compete In this Deltek article, the team breaks down what contractors need to know about the U.S. Army’s MAPS contract vehicle and how pursuit strategies are evolving for large, consolidated vehicles like this one. A few key points Deltek covers: • How MAPS consolidates prior Army contract vehicles into a single acquisition path • Why proposal readiness, gate criteria, and compliance matter more than ever • What GovCon teams should consider when competing on large, multi‑domain vehicles A useful read for contractors planning capture and proposal strategies around Army‑led opportunities. Read the Full Article in the comments #GovCon #SmallBusiness #Accounting #GovernmentContracting #GovernmentContractor #FederalContracting #FederalGovernment #DeltekPro #DeltekPartner #Army

3

1 Comment