The Cape Endeavors Blog
News, Insights, and Analysis for Government Contractors

The rules for protecting Controlled Unclassified Information (CUI) are changing again, and this time they reach far beyond the defense industrial base. In June 2026, the FAR Council released an updated CUI proposed rule that standardizes how CUI is identified and flowed down across federal contracts, and, most significantly, makes NIST SP 800-171 Revision 3 the baseline for contractors handling CUI. For any company navigating flow-down requirements, it's the most important de

Updated September 4th, 2026 to reflect the September 3rd class deviation, the status of the CMMC Reform Task Force, and recent enforcement actions. On July 13, the Department of War suspended CMMC Phase 2, the third-party (C3PAO) certification requirements that were set to become a condition of award on November 10, 2026. On September 3, that pause was written into acquisition policy through a formal class deviation, making it more durable than a memo alone. That has created

Supply chain security remains a critical challenge for organizations operating in the defense industrial base and other regulated sectors. Cyber threats, foreign influence, counterfeit components, and weak cybersecurity practices at any tier can compromise sensitive information and mission systems. Effective management of these risks requires both rigorous assessment of suppliers and the disciplined contractual transfer of requirements, commonly known as flow-down. NIST Speci

For years, much of the discussion surrounding Cybersecurity Maturity Model Certification (CMMC) has focused on assessment preparation, documentation, and implementing the technical safeguards required by NIST SP 800-171. Those remain essential components of compliance, but another challenge is quickly emerging that could have an even greater impact on the Defense Industrial Base. As CMMC requirements begin appearing in contracts, organizations will not only need to demonstrat

In the evolving landscape of CMMC compliance, staying ahead of the requirements is essential. The latest episode of Cape Endeavors' Bytes & Brew podcast features Terry McGraw, CEO of Cape Endeavors, in conversation with Cole French, Director of Cybersecurity Services at Kratos Defense & Security Solutions . As a leading C3PAO and FedRAMP 3PAO, Kratos provides invaluable perspectives on real-world CMMC Level 2 assessments. This discussion highlights trending topics such as ass