Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
Zero Trust Security
agentic AI ai agents AI Security Cyber Security enterprise cybersecurity Identity Governance Identity Security Machine Identities Non-Human Identities Zero Trust Security

AI Agents Expose Growing Identity Security Gaps in Enterprise Environments

 

In the face of the rapid adoption of artificial intelligence agents, enterprise security is faced with an increased challenge, as organizations struggle to maintain an increasing number of non-human identities gaining access to sensitive information and critical systems. In an increasingly automated world, security experts warn that each new AI agent introduces another trusted identity into the organization. 

The use of machine identities increases an organization's attack surface without proper oversight, making it harder for security teams to maintain a complete inventory of privileged accounts and monitor their interactions with critical business systems if they are not monitored properly. As opposed to human users, AI agents, service accounts, OAuth applications, and workload identities do not follow traditional employee lifecycles. 

There are many advantages to generating them automatically, inheriting permissions, interacting across multiple systems, and often remaining active long after the applications that generated them cease to exist. In the opinion of security experts, this emerging ecosystem is leading to weaknesses in identity governance that many organizations have yet to address. According to the Non-Human Identity Management Group, machine identities outnumber human users by up to 50 to 1 in many enterprise environments. 

Some of these technologies exist only temporarily, while others continue to operate without any clear ownership for years, making it difficult to determine who created them, what resources they are allowed access to, and whether they are still necessary for security teams to monitor. During a cyber campaign conducted in 2025, threat actor UNC6395 exploited a trusted OAuth token associated with Salesloft's Drift chat integration, demonstrating the risk. 

Instead of exploiting a software vulnerability, the attackers exploited an already trustworthy machine identity in order to access AWS credentials, Snowflake tokens, and other sensitive data across Salesforce environments. The incident demonstrated how compromised machine identities can become gateways to broader enterprise cyberattacks. Security professionals emphasize that artificial intelligence itself is not creating new cybersecurity problems but rather accelerating existing ones. 

With organizations deploying AI-powered agents to automate business processes, the number of privileged identities is continuing to increase, increasing the attack surface if governance processes do not keep pace. Additionally, experts maintain that AI agents are not simply software tools but should be regarded as a distinct class of digital identity instead. 

With AI systems increasingly accessing enterprise applications, making decisions, and executing workflows independently, organizations must provide each AI agent with a unique identity, clear permissions, and full accountability in order to ensure that its actions can be monitored and audited.  

The Netwrix Data and Identity Security Report 2026 reported that organizations with significant increases in the number of identities experienced a 43% breach rate over the previous year, compared to 11% among organizations with no significant changes in their identity landscape due to artificial intelligence. There is no doubt that visibility alone is not sufficient to address the concerns of many affected organizations, as they already invested in identity governance and monitoring. 

There is also a growing concern regarding agent sprawl, in which organizations deploy artificial intelligence assistants and autonomous agents rapidly without establishing governance frameworks. As the number of machine identities within an organization increases, cybersecurity experts warn that this can cause duplicate AI agents, inconsistent permissions, and increased operational, security, and compliance risks.  

As well as stressing the importance of identifying machine identities, the report stresses the imperative of continuous identity governance which tracks ownership, permissions, lifecycles, and access rights throughout the lifespan of every AI agent and non-human identity. The accumulative nature of trusted identities can increase the likelihood that unauthorized access and misuse can occur without ongoing governance. The following four key questions should be answered continuously by organizations for every identity in their environment: What identities exist? 

Who owns them? What can they access? When should they be retired? Unless clear ownership and lifecycle management are in place, AI-driven identities may silently accumulate excessive privileges and provide an opportunity for attackers. Experts also recommend that AI agents be subject to the Zero Trust security principles. 

The same way that human users require continuous verification and least privilege access, AI agents should be given only the appropriate permissions to accomplish their duties. Keeping detailed audit logs and implementing lifecycle controls (including the capability of quickly eradicating or retiring unnecessary agents) can reduce security risks over the long term. 

A growing number of industries are adopting artificial intelligence, which requires cybersecurity strategies to evolve beyond traditional user-focused identity management strategies. It has been recommended that organizations establish stronger governance for non-human identities, identify an owner for each AI agent, and periodically review their permissions. 

A lack of such controls could result in trusted AI-powered identities becoming one of the most overlooked attack vectors in today's enterprise environments, according to experts.
Read more »
Website Security
Cyber Security digital marketing Site Performance Website Maintenance Website Security

Regular Website Maintenance: Why It Matters

 

A website is often the first place customers meet your brand, but many businesses treat it like a one-time project. That is a mistake. Once a site goes live, it needs regular attention to stay secure, fast, and useful. Without maintenance, even a well-designed website can begin to slow down, break in small ways, or create trust issues for visitors. Over time, outdated software, broken links, and stale content can quietly damage your online presence and make your business look inactive. 

The first major reason for regular maintenance is security. Websites are constantly exposed to threats such as outdated plugins, weak passwords, malware, and other vulnerabilities. When updates are ignored, attackers can exploit those gaps and compromise user data or site functionality. Regular patches, monitoring, and backups reduce that risk and give businesses a much stronger defense. For any company that collects leads, processes payments, or stores customer information, maintenance is a basic part of digital protection.

The second reason is performance. A website that loads slowly or behaves unpredictably can frustrate visitors within seconds. Images may become too heavy, scripts may conflict, and plugins may stop working properly after updates elsewhere in the system. Regular checks help identify these issues before they hurt conversions. A faster, smoother site also supports better engagement because users are more likely to stay, explore, and complete a form or purchase when the experience feels effortless. 

The third reason is search visibility. Search engines prefer websites that are current, technically sound, and easy to crawl. If pages contain broken links, missing metadata, outdated content, or poor mobile performance, rankings can suffer. Maintenance helps keep content fresh and signals that the site is active and relevant. That matters because search traffic is often one of the most valuable sources of visitors for businesses that want steady, long-term growth. 

Regular maintenance also improves credibility. Visitors notice when a site feels abandoned, loads slowly, or contains old information. A website should evolve with your business, your audience, and your goals. When you treat maintenance as an ongoing habit instead of an emergency fix, you protect your brand, support your marketing, and reduce expensive problems later. In short, a maintained website is not just healthier; it is more trustworthy and more effective.
Read more »
Cybersecurity Governance
AI cybersecurity AI governance AI technology CISO CISO best practices CISOs Cyber Security Cybersecurity Governance

Splunk Report Finds One in Five CISOs Pressured to Hide Cybersecurity Incidents

 

The Splunk 2026 CISO report makes public the challenges that CISOs face when trying to meet the rising demand to mask security incidents while also complying with tightening disclosure laws. According to the report, which draws its conclusions from the responses of 650 CISOs, 20% of respondents had experienced pressure from their organization not to disclose a cybersecurity incident or breach, and 53% of those who were challenged had reported an incident or breach anyway. 

It is stated that business and regulatory priorities conflict, putting CISOs in the middle of a regulatory dilemma. In addition, there is a growing sense among CISOs that they could face disciplinary or legal repercussions if they fail to protect the company from cyber ​​security threats. The percentage of CISOs concerned about being held accountable for a cyber ​​incident increased from 56% in 2025 to 78% in 2026. 

The report also shows that 79% of CISOs believe their jobs have become increasingly complex over the last year, with 43% reporting having taken on new roles and responsibilities outside their primary function, such as preventing fraud and financial crime. Moreover, 96% of CISOs responded that they are now responsible for the governance and risk management of artificial intelligence. This is yet another factor contributing to the complexity of the CISO’s work, as they must ensure that companies adopt responsible AI practices. 

The increasing difficulty of the CISO position is reflected in the fact that 26% of CISOs stated they have considered quitting their jobs due to the burdensome nature of the role. It is therefore not surprising that the report’s findings coincide with new government regulations that further tighten cybersecurity disclosure laws. For example, according to the Cyber Security and Resilience (Network and Information Systems) Bill currently under consideration in the UK Parliament, organizations in the UK will be required to report on major cyber ​​security incidents and strengthen board-level oversight of cybersecurity. 

CISOs must therefore carefully weigh the risks and benefits of any response, as reporting an incident too soon could result in financial losses for the company, whereas reporting it later could incur severe regulatory penalties. The report recommends that CISOs focus on building and maintaining strong governance by providing detailed information on how and by whom incidents were uncovered, as well as which steps had been taken to investigate and remediate the damage. 

This will ensure that the CISO’s decisions regarding disclosure of an incident are based on verifiable facts and figures. By analyzing all relevant data across enterprise networks, cloud, endpoints, or servers, the security leader can build a comprehensive report outlining the exact course of action taken after the breach was discovered. This will help to both satisfy regulatory authorities during an audit and assist in determining if and when a report needs to be filed. 

The report therefore highlights the fact that the role of the CISO has changed dramatically and now entails a wide range of responsibilities, requiring them to make decisions that go beyond the realm of traditional cybersecurity.
Read more »
European Union
ADDW Advanced Driver Cyber Security Driver Distraction Warning System EU vehicle safety rules European Union

EU Mandates Driver Distraction Warning Systems in All New Vehicles Amid Privacy and Safety Debate

 

 
The European Union has introduced stricter vehicle safety regulations, making Advanced Driver Distraction Warning (ADDW) systems mandatory in all newly registered vehicles across member states from this week. The move is part of the European Commission’s expanded General Safety Regulation, aimed at reducing road fatalities and improving overall traffic safety.

Although Europe is considered one of the safest regions for road travel, the European Commission noted in its announcement that "the number of deaths and injuries from road accidents is still too high." To address this, the updated rules introduce several advanced safety requirements for new vehicles.

In addition to ADDW systems, the new legislation requires advanced emergency braking systems capable of detecting pedestrians and cyclists, along with improved forward visibility features. Driver distraction monitoring technology, which uses cameras to observe a driver's attention levels, will now become a standard feature in all newly registered vehicles.

These camera-based systems continuously monitor a driver's eye movements and facial expressions using sensors positioned behind the steering wheel or above the vehicle’s infotainment display. If the system determines that the driver has looked away from the road for an extended period, it issues alerts encouraging them to refocus.

Depending on the manufacturer, these alerts may include audible warnings, dashboard notifications, or the temporary disabling of features such as adaptive cruise control and other automated driving functions.

However, the mandate has sparked criticism from some quarters. The European Conservative described the Commission’s decision as the "latest annoying piece of EU overregulation," raising concerns over the lack of transparency regarding how data collected by these systems will be managed.

Current ADDW systems are designed to function in a closed-loop environment, where all information is processed locally within the vehicle without being transmitted to external servers. Despite this, concerns persist over the future handling of driver data as vehicles become increasingly connected.

Since April 2018, all newly approved passenger cars and light vans sold in the European Union have been equipped with the eCall emergency system, which automatically contacts emergency services following a serious accident. Combined with forecasts from consulting firm McKinsey that 95% of vehicles worldwide will be internet-connected by 2030, experts believe driver-monitoring information could eventually be transmitted beyond the vehicle.

Privacy concerns have already been highlighted in previous research. In 2023, Mozilla reviewed the privacy practices of 25 automotive brands and found that none met the organization's own privacy and security expectations. The report described connected vehicles as "the worst product category we have ever reviewed for privacy."

The issue has also drawn regulatory attention outside Europe. In 2024, the Texas Attorney General launched an investigation into several automobile manufacturers following allegations that they were collecting extensive driver data and selling it to third parties.

Critics argue that the European Union has yet to clearly define how information gathered by ADDW systems will be governed. They warn that such data could potentially be used in areas such as insurance pricing or legal proceedings in the future.

Beyond privacy issues, some motorists have questioned the usability of driver monitoring technology, arguing that overly sensitive systems can themselves become a source of distraction by issuing unnecessary alerts during routine driving activities.

While Euro NCAP has indicated that it aims to reduce reliance on "annoying" in-car safety features, the European Union’s latest regulations place greater emphasis on driver monitoring technologies, highlighting the ongoing debate between improving road safety and protecting driver privacy.
Read more »
Ransomware
AI Autonomous Agents Cyber Security Langflow Bug Ransomware

AI Agent Runs First End-to-End Ransomware Attack

 

Security researchers have long warned that AI would lower the barrier to cybercrime, but the latest case makes that threat tangible. In the operation described by Sysdig and covered by Forbes, an autonomous agent carried out the technical steps of a ransomware attack from initial access to encryption and ransom-note generation. The group’s analysis suggests the attack was not a simple script; it adapted when it hit obstacles, corrected its own mistakes, and kept moving without a human at the keyboard. 

The campaign reportedly began with an exposed Langflow incident, which the attacker used to gain access through a known vulnerability. From there, the agent searched for secrets, including credentials and cloud keys, then expanded into a production environment and escalated privileges. Researchers said it encrypted more than 1,300 configuration records and generated its own ransom note with a Bitcoin address, showing how an AI system can combine reconnaissance, exploitation, and extortion in one chain. 

What makes the story unsettling is not only the automation, but the speed. One reported login failure was fixed in 31 seconds, a reminder that AI can iterate much faster than a human operator can type, think, or troubleshoot. That kind of responsiveness matters because ransomware succeeds by compressing the defender’s reaction time. If attackers can use agents to scan, pivot, and encrypt at machine speed, security teams will need similarly automated detection, containment, and recovery tools to keep up. 

Still, the incident also shows that “fully autonomous” cybercrime may be more complicated than the headline suggests. Later reporting said humans may have still chosen the target, prepared infrastructure, or supplied stolen credentials, even if the AI handled the intrusion itself. That distinction matters, because it means defenders are not just facing smarter malware, but a new hybrid model in which human planning and AI execution reinforce each other. The lesson for businesses is clear: reduce exposed services, enforce strong credential hygiene, segment critical systems, and assume that the next serious attack may be built and operated with far less human effort than before.
Read more »
Malicious calls
block scam calls Cyber Scammers Cyber Security Cyberspam IT Act Malicious calls

TRAI Seeks IT Act Powers to Act Against Spam-Tagging Apps Like Truecaller

 

The Telecom Regulatory Authority of India (TRAI) seeks new powers in the Information Technology (IT) Act to take action against call management apps, including Truecaller, Hiya, and Whoscall, for marking or blocking legitimate commercial calls as spam. The regulator has requested additional authority to act against call management apps for misidentifying or blocking approved commercial numbers. 

Sources said TRAI wanted to act against call management apps for misidentifying or blocking approved commercial numbers. Numbers in the 1400 and 1600 series have been designated for official promotional and customer service purposes. TRAI does not have the authority to prosecute such digital platforms because, unlike telecom licensees, who are bound by TRAI’s directions issued under the Telecom Regulation Act, they function as information intermediaries under the IT Act. 

However, authorities said TRAI had sought amendments to the IT Act to designate it as an “authorized agency” to notify such digital platforms of alleged violations of the IT Act, directing them to stop or take steps to bring their services within the bounds of the law. Authorities said the electronics and information technology ministry had approved the proposal in principle and that DoT would take up the needed legislative action with the ministry. However, authorities said TRAI did not seek to regulate call identifier apps but that the regulator felt that as information intermediaries, they should follow the laws and regulations administered by TRAI. 

Authorities felt that such apps’ labeling or blocking of numbers in the 1400 and 1600 series not only deprived authorized users of a reliable means of reaching out to them but also disrupted government-led outreach efforts, especially those using numbers in these series. Authorities said such interference disincentivized enterprises from using the 1400 and 1600 series of numbers and tempted them to use ordinary 10-digit mobile numbers for customer outreach. 

This defeats the purpose of having designated numbers since it becomes difficult for consumers to differentiate between legitimate and fraudulent callers, ultimately undermining consumer confidence and making it easier for spammers to masquerade as legitimate entities. Truecaller said in a statement reacting to the reports that it complied with the TRAI regulations about commercial numbers. 

The firm stated that it did not put spam labels over or block numbers in the 1400 and 1600 series despite being reported as spam on its app by many users. India seeks to balance consumer rights and obligations by regulating commercial communications while ensuring that legitimate communication avenues are not cut off for businesses that use spam calls to sell or inform the public.
Read more »
Manifold
AI Browsers Anthropic Claude Claude Code CVSS Cyber Security Google Manifold

Researchers Find Claude for Chrome Flaws That Could Let Malicious Extensions Trigger Sensitive Google Tasks




Researchers at Manifold Security have disclosed two security weaknesses in Anthropic's Claude for Chrome extension that could allow another browser extension with access to the Claude website to trigger predefined AI-powered actions involving a user's Gmail, Google Docs and Google Calendar.

According to the researchers, the issues remain present in version 1.0.80 of the extension despite earlier mitigations introduced after the disclosure of the "ClaudeBleed" vulnerability. While Anthropic restricted how external webpages can communicate with the extension, Manifold says the underlying trust boundary that determines whether a user intentionally initiated an action has not been fully addressed.

The findings do not indicate that arbitrary websites can directly read a user's email or documents. Instead, the attack requires another browser extension that already has permission to execute scripts on the claude.ai domain. If such an extension is malicious or becomes compromised, it could abuse Claude's existing capabilities to initiate AI tasks that access a user's connected Google services.


Forged clicks can initiate predefined Claude actions

Following the earlier ClaudeBleed disclosure, Anthropic replaced unrestricted prompt handling with a fixed allowlist of predefined onboarding tasks. Rather than allowing external callers to submit arbitrary prompts, the extension now recognizes only nine task identifiers embedded within its code.

Among these are demonstration workflows for third-party services such as DoorDash, Salesforce and Zillow, along with tasks that interact with Gmail, Google Docs and Google Calendar. This design significantly narrows the attack surface because outside scripts can no longer provide custom instructions for Claude to execute.

However, Manifold Security found that the mechanism responsible for launching these tasks can still be manipulated.

The researchers explain that a content script running within the extension monitors the Claude webpage for clicks on a specific onboarding element. When a click occurs, the script reads the associated task identifier and forwards it to the extension, which opens Claude's side panel with the corresponding workflow prepared.

The problem lies in how those clicks are validated. Instead of confirming that the event originated from an actual user interaction, the extension accepts any matching click event, including one generated programmatically by JavaScript.

Modern browsers provide an "event.isTrusted" property that distinguishes genuine user actions from synthetic events created by scripts. According to Manifold, the extension does not verify this property before processing the request.

As a result, another extension capable of interacting with the Claude webpage can dynamically create the required element, assign one of the approved task identifiers and dispatch an artificial click event. Because the extension treats the event as legitimate, Claude opens the selected workflow as though the user had manually initiated it.

The researchers demonstrated this behavior using a short proof-of-concept script executed within the Claude page, showing that synthetic click events marked as untrusted were still accepted by the extension.


Approval settings determine the level of risk

Whether the forged action progresses beyond this point depends largely on how the extension has been configured.

For users operating under Claude's default "Ask before acting" setting, the extension still presents an approval prompt before carrying out actions involving Gmail, Google Docs or Google Calendar. This additional confirmation prevents automatic execution, although users could still unknowingly approve an attacker-triggered request.

The risk increases considerably for users who have enabled the optional "Act without asking" mode. In this configuration, the extension can perform supported tasks without requesting further confirmation, allowing attacker-triggered workflows to execute automatically.

Manifold assigned a CVSS severity score of 7.7 under the default approval model and 9.6 when unattended execution is enabled.

The researchers say a straightforward mitigation would be to reject any click event that was not generated by a genuine user, preventing scripts from activating these workflows through synthetic browser events.


Researchers identify second permission-handling concern

Manifold also disclosed a separate issue involving how the extension initializes permission settings when its side panel loads.

According to the researchers, if the panel starts with a specific URL parameter indicating that permission checks should be skipped, the extension immediately enters a mode that bypasses user approval for supported actions.

Although users receive a warning indicating that Claude now has broader authority to perform actions on their behalf, the privileged session has already been established by the time the notification appears.

The researchers emphasize that this second issue is not directly exploitable under current conditions because the parameter can presently be generated only by the extension itself. Nevertheless, they argue that any future vulnerability allowing a lower-privileged component to influence this parameter could eliminate the remaining approval barrier and enable silent execution.

Potential attack paths discussed by the researchers include future message-handling flaws, panel initialization bugs or cross-site scripting vulnerabilities that could expose the parameter to untrusted input.

To reduce that risk, Manifold recommends that the extension ignore permission-related values supplied through URLs and instead always initialize new sessions in approval mode.

The researchers classify the forged-task technique as an example of indirect prompt injection within the OWASP Top 10 for Large Language Model Applications because an attacker manipulates the AI agent into executing one of its own predefined workflows rather than supplying new instructions directly.

They also associate the unattended execution scenario with excessive agency, referring to AI systems that are granted broad authority to perform sensitive actions with minimal user oversight.

According to the report, these behaviors occur regardless of whether users are running Claude Opus, Sonnet or Fable, indicating that the weaknesses originate in the browser extension rather than the underlying language models.


Issues remain unresolved months after disclosure

Manifold Security reported both vulnerabilities to Anthropic on May 21 while testing version 1.0.72 of the extension. Anthropic acknowledged the reports the following day.

The forged-click issue was closed on the basis that it fell within the scope of the previously reported ClaudeBleed investigation, which Anthropic indicated remained open while a more comprehensive solution was being developed.

The permission-handling report was classified as informational because the relevant parameter was intended for workflows that users had already configured for unattended execution.

Despite those responses, Manifold says it found the same vulnerable code paths unchanged after examining version 1.0.80 released on July 7.

As of July 14, the researchers noted that no CVE identifier had been assigned to either issue and Anthropic had not published a public advisory addressing the findings.

The latest research follows a series of security concerns involving AI-powered browser agents.

Earlier this year, researchers disclosed ClaudeBleed, a vulnerability that allowed websites to inject prompts into Claude for Chrome by exploiting how the extension trusted requests originating from the Claude website itself rather than verifying which script generated them.

LayerX, which originally disclosed ClaudeBleed, described the issue as a classic "confused deputy" problem, where software possessing legitimate privileges unknowingly performs actions on behalf of an untrusted requester.

Security researchers have also identified comparable trust-boundary weaknesses affecting other Anthropic products, including Claude Code, demonstrating broader challenges associated with AI agents that can directly interact with browsers, developer environments and online accounts.

The latest findings reinforce the importance of carefully validating user intent before granting AI assistants access to sensitive online services. As AI-powered browser agents become increasingly capable of interacting with email, documents and productivity platforms, researchers argue that ensuring those actions genuinely originate from users remains one of the most critical security controls.

Read more »
Department of Justice
CMMC 2.0 Cyber Security Cybersecurity measures Cybersecurity Policy Cybersecurity regulation Department of Justice

Pentagon Pauses CMMC Phase Two Rollout for 60-Day Review of Cybersecurity Program

 

The US Department of Defense (DoD) has decided to suspend the implementation of the cybersecurity maturity model certification (CMMC) second phase on a temporary basis. The DoD will conduct a 60-day review before continuing with the implementation of the new cybersecurity requirements that were supposed to take effect in November 2026. Chief information officer of the Department of War (DoW), Kirsten Davies, stated that the CMMC pause gives an opportunity to “remove burdensome requirements while still maintaining national security.” 

Davies emphasized that DoD’s phase one requirements as well as all the regulations regarding the protection of information, are still in full force until further notice. Additionally, Davies noted that the creation of the CMMC Review and Reform Task Force charged with soliciting feedback from industry constituencies ahead of any reconsideration of the program will contribute to burden reduction. 

In particular, the task force will ensure that small businesses and nontraditional contractors are not overly burdened by certification requirements, thus facilitating their participation in defense contracting. Undersecretary of War for Acquisition and Sustainment Michael Duffey stated that the DoD wants to prevent “small manufacturers from being shut out of the defense market due to the cost and complexity of the CMMC.” 

The cybersecurity maturity model certification policy sets out cybersecurity requirements for defense industrial base (DIB) companies and contractors. The CMMC 2.0 requirement is applicable to all DoD contractors and subcontractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). 

The newly implemented CMMC 2.0 cybersecurity requirements came into full force on November 10, 2025, and will be implemented in phases. During phase one, which was completed on November 10, 2025, organizations had to conduct self-assessments for Level 1 and some Level 2 contract work. Level 1 of the CMMC 2.0 covers the protection of FCI and requires a minimal level of cybersecurity maturity, while Level 2 covers the protection of CUI and includes the security requirements of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. 

On the other hand, Level 3 includes more stringent measures to protect against advanced persistent threats to sensitive DIB information. As of November 10, 2026, the beginning of the second phase, organizations will be required to undergo third-party assessment organization (TPO) certification for many Level 2 contracts. One of the reasons for postponing the second-phase implementation, as stated by officials, is the shortage of TPOs accredited to certify organizations ahead of the November 10, 2026 deadline. 

Under the initially established schedule, the third phase of the CMMC 2.0 implementation was set to begin in 2027. It included the introduction of Level 3 requirements for organizations that handle sensitive information and will affect most DoD contracts in Fiscal Year (FY) 2028. Finally, the fourth phase was supposed to ensure complete transition to the new framework in order to meet all CMMC requirements. 

As a result of the 60-day review, DoD officials will make recommendations on revising the CMMC 2.0 in order to reduce the burden on industry while addressing warfighters’ and authorizers’ needs in terms of enhanced cybersecurity.
Read more »
Subscribe to: Posts (Atom)