Fortreum

Unpacking DoD Class Deviation 2026-O0025: what the September 4th memo means for CMMC, 3rd party assessments, and DFARS compliance for defense contractors.

Most conversations we have about Protected B start in the wrong place. A provider holding a FedRAMP authorization asks how much of their control evidence transfers, and everyone leaves thinking this is a security assessment with some paperwork attached. F

/PRNewswire/ -- Claroty Public Sector LLC, the cyber-physical systems (CPS) protection company for U.S. government, today announced in partnership with...

Ask anyone running continuous monitoring for a FedRAMP-authorized cloud service offering right now how their open vulnerability count is trending, and "flat" is not the answer you'll get. Across our Continuous Monitoring (ConMon) and advisory engagements,

When FedRAMP published its Consolidated Rules for 2026 earlier this summer, most of the important dates were still ahead of us. That has changed. As of today, the transition is no longer theoretical: the FedRAMP Ready path has closed, the FedRAMP 20x Clas

A week ago, the Department of War suspended CMMC Phase II, and the defense industrial base spent about seventy-two hours trying to figure out what it meant. That was a reasonable response. The announcement moved faster than the details did, and a lot of t

The DoD just tightened who is allowed to touch your IL4 and IL5 environment, and relaxed a few of the rules. The Department of Defense released V1R7 of the Cloud Computing SRG, and if you are a CSP holding or pursuing a Provisional Authorization, this rel

The Department of War suspended the C3PAO requirement today. It did not suspend the Level 1 and Level 2 bar, the contract clause, or your liability under the False Claims Act. Here is what actually changed, and what did not. Fortreum is a trust partner to

A breach at a major consulting firm this week is a reminder that the most dangerous exposure is not customer records. It is the keys to the build pipeline. This week, a major IT services and consulting firm confirmed a security breach after a threat actor