The Cape Endeavors Blog
News, Insights, and Analysis for Government Contractors

Updated September 4th, 2026 to reflect the September 3rd class deviation, the status of the CMMC Reform Task Force, and recent enforcement actions. On July 13, the Department of War suspended CMMC Phase 2, the third-party (C3PAO) certification requirements that were set to become a condition of award on November 10, 2026. On September 3, that pause was written into acquisition policy through a formal class deviation, making it more durable than a memo alone. That has created

The rules for protecting Controlled Unclassified Information (CUI) are changing again, and this time they reach far beyond the defense industrial base. In June 2026, the FAR Council released an updated CUI proposed rule that standardizes how CUI is identified and flowed down across federal contracts, and, most significantly, makes NIST SP 800-171 Revision 3 the baseline for contractors handling CUI. For any company navigating flow-down requirements, it's the most important de

When a prime contractor calls and says, "we need your manufacturing capacity, and we need you CMMC certified," most subcontractors hear a burden. Fitz-Thors heard an opportunity. The Alabama-based engineering and manufacturing firm was newer to the defense space than most. Ownership had long wanted to move into defense contracting, and when they finally committed, they did something a lot of small subcontractors don't: they decided to get ahead of the compliance curve instead

Why the decisive battle in a Civil Cyber-Fraud Initiative matter is evidentiary, not legal, and why most defense contractors can't fight it alone. When a defense contractor receives a Civil Investigative Demand tied to the Department of Justice's Civil Cyber-Fraud Initiative, the instinct in the room is to reach for the legal argument. Was the cybersecurity requirement actually material to payment? Was any misrepresentation knowing? Does the implied-certification theory hold

CMMC has become very good at asking organizations to prove that their declared CUI environment is properly secured. It is far less effective at proving the assumption on which the entire assessment depends: Is the organization's CUI actually where they say (or think) it is? The Fundamental Problem CMMC begins with a declared assessment scope and CUI boundary. 800-171 is pretty clear, scope is wherever you process, store and transmit CUI Assessors then evaluate whether appropr

Cape Endeavors has welcomed cybersecurity leader Barry Hensley as Executive Advisor, bringing nearly four decades of military cyber operations, enterprise security, threat intelligence, and executive risk management experience. Hensley will help guide Cape Endeavors’ strategy for protecting Controlled Unclassified Information, reducing cyber risk, and helping Defense Industrial Base organizations navigate evolving federal cybersecurity requirements.

Terrence McGraw Chief Executive Officer @ Cape Endeavors Inc | CMMC Compliance Experts | CMMC L2/3 Compliant Enclaves | CUI Scanning | Security Operations | Incident Response | vCISO consulting In 2004, serious people were certain Sarbanes-Oxley would destroy American capital markets. The objections to Section 404 went like this: compliance costs came in far above the original estimates, there weren't enough qualified auditors to meet demand, the burden fell hardest on small