CMMC & Cybersecurity Intelligence Brief – 11

Three structural shifts are converging this week that will reshape the CMMC compliance landscape through the rest of 2026. On April 1, ISACA formally assumed control of all CMMC assessor and instructor credentialing from the Cyber AB, creating the first major governance transition since the program’s inception and raising questions about assessor pipeline capacity during a period when the defense industry has seen a nearly 200 percent increase in certified organizations in just six months. Simultaneously, the White House released its 2026 national cyber strategy, reinforcing zero trust architecture as a non-negotiable federal standard and setting a 2035 deadline for post-quantum cryptographic transition, signals that will cascade into contractor procurement requirements. Meanwhile, a DoD Inspector General advisory found that the department itself is still failing to properly mark CUI data, with recommendations from a 2023 audit remaining open, a finding that undermines the very foundation of CMMC scoping for every contractor in the supply chain. On the threat front, CISA added the TrueConf CVE-2026-3502 zero-day to the KEV catalog after Check Point exposed Operation TrueChaos, a supply chain attack that weaponized software update mechanisms against government targets.

In This Issue

Development 01  |  Governance / Capacity Shift

ISACA Assumes CMMC Assessor Credentialing as Cyber AB Transitions Core Function

On April 1, 2026, ISACA formally became the sole CMMC Assessor and Instructor Certification Organization (CAICO), completing a 90-day transition from the Cyber AB that began in January. The change transfers credentialing authority for CMMC Certified Professionals (CCP), CMMC Certified Assessors (CCA and Lead CCA), and CMMC Certified Instructors (CCI) to ISACA, a global organization with more than 180,000 members and established credential management infrastructure across 188 countries.

The transition matters for defense contractors for two reasons. First, the assessor pipeline feeding C3PAO capacity is now governed by a different organization with different processes, timelines, and renewal procedures. During the 90-day transition period (January through March 2026), the Cyber AB and ISACA worked in tandem to migrate credentialing systems and support processes. Anyone renewing after April 1 now interfaces with ISACA’s systems rather than the Cyber AB’s. Second, ISACA’s scale creates an opportunity to expand the assessor workforce more rapidly than the Cyber AB could alone. With approximately 635 Certified CMMC Assessors (per Cyber AB December 2025 town hall data) serving an ecosystem of 80,000-plus contractors that need Level 2 certification, the credentialing bottleneck is one of the primary constraints on assessment capacity.

The Cyber AB retains authority over the CMMC Marketplace, Tier 3 background checks, and all Registered Practitioner programs. Todd Gagnon, a career U.S. Naval officer with experience across the federal cyber apparatus, leads the CMMC program at ISACA. The structural separation is now clear: the Cyber AB accredits C3PAOs, ISACA credentials the individual assessors and instructors who conduct assessments.

The practical implication for contractors is that any assessment timeline built around assessor availability should account for the transition. Organizations with assessments scheduled for Q2 or Q3 2026 should confirm that their assigned assessors have completed the migration to ISACA’s credentialing system and that no lapses in certification status have occurred during the handoff.

Source: ISACA press release via BusinessWire, December 17, 2025; DefenseScoop, December 17, 2025; Cyber AB December 2025 Town Hall recap via CMMC.com; ISACA 2026 Volume 1 Newsletter

Development 02  |  Policy Movement / Strategic Direction

White House 2026 Cyber Strategy Signals Zero Trust, Post-Quantum, and AI Requirements Coming to Contractor Procurements

On March 6, 2026, the White House released “President Trump’s Cyber Strategy for America,” accompanied by an Executive Order on combating cybercrime. For defense contractors, the strategy is not a regulation, but it is the clearest signal yet of where procurement requirements are heading over the next three to five years.

Three priorities in the strategy carry direct implications for the defense industrial base. First, zero trust architecture is described as the expected standard across all federal systems and agencies, not aspirational but required. Contractors whose environments interact with federal systems will face increasing pressure to demonstrate zero trust implementations, particularly for identity verification, micro-segmentation, and least-privilege access, controls that align directly with NIST SP 800-171 requirements under CMMC.

Second, the strategy establishes a 2035 deadline for completing the transition to post-quantum cryptographic standards. Infrastructure decisions made in the next 12 to 18 months will determine whether agencies and their contractors can meet that timeline. For CMMC-assessed organizations, this signals that cryptographic module requirements will evolve beyond the current FIPS 140-3 transition already underway.

Third, the strategy signals that federal agencies will increasingly deploy AI-native cybersecurity tools for defensive operations. Vendors and contractors able to demonstrate AI-enhanced security capabilities, including automated threat detection, compliance document retrieval, and incident summarization, will carry a competitive advantage in future procurement evaluations.

Notably, the strategy eschews discussion of new regulations or increased liabilities for U.S. companies, instead focusing on challenging foreign adversaries, streamlining regulations, and relying on the private sector to identify and disrupt attacks. Multiple legal analyses note, however, that federal modernization priorities tend to cascade into regulatory expectations. As PwC’s analysis observes, “as government procurement standards evolve and cybersecurity baselines rise, contractors and ecosystem partners will likely be required to meet higher thresholds.”

Source: White House, March 6, 2026; PwC, March 2026; Mayer Brown, March 2026; Ryan & Wetmore, 2026; SBS Cyber Security, March 2026; Wiley, March 2026

Development 03  |  Enforcement Trend / Compliance Infrastructure

DoD Inspector General Finds Pervasive CUI Marking Failures, Raising CMMC Scoping Questions for Contractors

A DoD Inspector General management advisory (DODIG-2026-047), published February 4, 2026, found that DoD components are still failing to properly mark Controlled Unclassified Information. The advisory identified that organizations frequently omitted the required designation indicator block entirely, and when they did include markings, they often defaulted to overly restrictive dissemination controls such as “Federal Employees and Contractors Only” rather than applying no limited dissemination control when none was warranted. Federal News Network reported on the advisory in April 2026, noting that six of the 14 recommendations from a 2023 audit of the CUI program remain open.

This finding carries direct consequences for every defense contractor preparing for or maintaining CMMC certification. CMMC scoping begins with identifying where CUI exists in contractor systems. If the government entity generating the CUI applies incorrect markings, applies overly broad markings, or fails to mark documents at all, the contractor inherits a scoping problem that is not of their making. Over-marking causes contractors to bring more systems, networks, and personnel into the CMMC assessment boundary than necessary, increasing both assessment cost and remediation burden. Under-marking or absent marking creates the opposite risk: CUI flowing through systems that lack the required 110 controls, exposing the contractor to both assessment failure and FCA liability.

The IG advisory was originally prompted by a broader investigation into how DoD components handle sensitive information. Of the five new recommendations issued, two have been resolved and closed. Three remain open, including revisions to guidance and training documents that would clarify proper use of limited dissemination controls. The intelligence and security office has updated FAQs on the DoD CUI Program website, but the systemic training and guidance gaps that drive marking failures remain unresolved.

The practical takeaway for contractors is defensive: do not assume that CUI markings on government-furnished information are accurate. Organizations should independently verify CUI categories and markings on received data against the CUI Registry and applicable contract language, particularly before finalizing CMMC assessment boundaries. Scoping errors caused by inherited marking deficiencies are not a defense in an assessment.

Source: DoD Inspector General, DODIG-2026-047, February 4, 2026; Federal News Network, April 2026; DoD IG DODIG-2023-078, 2023

Development 04  |  Threat Intelligence / Supply Chain Security

CISA KEV Alert: TrueConf CVE-2026-3502 / Operation TrueChaos Weaponizes Software Update Mechanism

CISA added CVE-2026-3502 to its Known Exploited Vulnerabilities catalog on April 2, 2026, with a federal remediation deadline of April 16 under Binding Operational Directive 22-01. The vulnerability, carrying a CVSS score of 7.8, affects TrueConf Client, a video conferencing and collaboration platform used across government and enterprise environments. What makes this vulnerability distinctive is not just the flaw itself but the attack methodology: Operation TrueChaos, documented by Check Point Research, represents a supply chain attack that weaponized a trusted software update mechanism against government targets.

The attack operated as follows: threat actors compromised a central on-premises TrueConf server operated by a government IT organization in Southeast Asia. They replaced a legitimate client update package with a malicious one. Because the TrueConf Client does not validate the authenticity or integrity of downloaded update files before executing them, the malicious update installed and executed automatically across connected endpoints. The payload deployed reconnaissance tools, established persistence, escalated privileges, and established command-and-control communications, all through a channel that users and security tools trusted.

For defense contractors, the TrueChaos attack demonstrates a specific risk pattern: any on-premises collaboration or communication tool that distributes updates through a centralized server becomes a potential attack vector if that server is compromised. This is not limited to TrueConf. The attack methodology applies to any software platform where client updates are pushed from a central server without cryptographic signature verification. NIST SP 800-171 control 3.14.1 (flaw remediation) and 3.4.8 (application whitelisting) are directly relevant, as is the broader supply chain risk management emphasis in NIST SP 800-171 Rev 3.

The remediation is straightforward: upgrade to TrueConf Client version 8.5.3 or later, which was released in March 2026. Organizations should also audit any on-premises communication platforms for similar update integrity gaps and ensure that all software update mechanisms employ cryptographic signature verification.

Source: CISA Known Exploited Vulnerabilities Catalog, April 2, 2026; Check Point Research, March 2026; BleepingComputer, April 1, 2026; The Hacker News, March 2026; SecurityOnline.info, March 2026

Development 05  |  Capacity Shift / Market Data

CMMC Certification Velocity Accelerates 200%, But 99.5% of the DIB Remains Uncertified

The defense industry has seen a nearly 200 percent increase in CMMC Level 2 certified Organizations Seeking Certification (OSCs) over the last six months, according to data from a recent Cyber AB town hall referenced by 112Cyber. The acceleration is real: Infinite Electronics announced on April 2, 2026, that its Hayden, Idaho facility achieved Level 2 CMMC certification following a C3PAO assessment, validating the full 110 NIST SP 800-171 controls for its military defense product lines, including surge protection and connectivity solutions for missile defense platforms.

The acceleration is paired with structural developments. The 48 CFR DFARS rule is now in effect, C3PAOs are steadily joining the assessment ecosystem, and ISACA’s assumption of assessor credentialing (Development 01 above) could expand the assessor pipeline if its global credentialing infrastructure processes new candidates faster than the Cyber AB did. The number of active CMMC Level 2 solicitations on sam.gov continues to grow, and contracting officers now have clear authority to verify CMMC status in SPRS and withhold awards from non-compliant offerors.

However, the percentage tells the real story. Despite the 200 percent increase, only approximately 0.5 percent of the defense industrial base has achieved Level 2 certification. With Phase 2 enforcement beginning November 10, 2026, making third-party C3PAO assessment mandatory for most Level 2 contracts, the math remains daunting. Assessment lead times of three to six months mean that organizations not yet in the assessment pipeline may not reach certification before Phase 2 requirements appear in their solicitations.

The early mover advantage is measurable. Certified organizations are competing for contracts where non-certified competitors are disqualified at the gate. As the pool of CMMC-required solicitations expands through 2026, the competitive differentiation between certified and uncertified contractors will widen. Organizations still planning their assessment approach are not just behind on compliance; they are behind on market positioning.

Source: 112Cyber, 2026; Infinite Electronics via PR Newswire, April 2, 2026; PreVeil, 2026; Secureframe, 2026

FOR ORGANIZATIONS IN ACTIVE CMMC ASSESSMENT PREPARATION

Confirm that your assigned C3PAO’s assessors have completed their credential migration to ISACA. Request written confirmation of current CCA/Lead CCA status under the new credentialing system. If your assessment is scheduled for Q2 or Q3 2026, verify this within the next two weeks.

FOR ORGANIZATIONS SCOPING THEIR CMMC BOUNDARY

Implement an independent CUI verification step for all government-furnished information. Cross-reference received documents against the CUI Registry and your contract’s CUI requirements. Do not accept government markings at face value when building your assessment scope, particularly given the IG’s findings on pervasive marking errors.

FOR ORGANIZATIONS MANAGING ON-PREMISES COLLABORATION TOOLS

Audit every platform that distributes software updates through a centralized server for cryptographic signature verification of update packages. If any tool lacks this capability, assess whether it can be configured to add verification or whether it should be replaced with a solution that validates update integrity by default.

FOR ORGANIZATIONS PLANNING 12- TO 18-MONTH SECURITY ROADMAPS

Begin incorporating zero trust architecture milestones and post-quantum cryptographic readiness into your planning. While the White House strategy does not impose immediate requirements, the trajectory toward procurement standards incorporating these capabilities is clear. Early investment in these areas positions your organization both for CMMC and for the broader federal cybersecurity requirements that will follow.

RESPONDING TO DEVELOPMENT 03 (CUI MARKING FAILURES)

The DoD IG’s findings on CUI marking deficiencies make accurate CUI identification more critical than ever for contractors. The Federal Contract CUI Compliance Tracker (available now IN OUR SHOP) maps every federal contract to its CUI compliance framework, helping organizations independently verify CUI categories and marking requirements rather than relying on potentially flawed government markings.

RESPONDING TO DEVELOPMENT 05 (CERTIFICATION VELOCITY AND PHASE 2 COUNTDOWN)

With Phase 2 enforcement seven months away and assessment lead times stretching three to six months, the window for achieving certification is closing. The SSP Evidence Drill Tracker (available now IN OUR SHOP) identifies which controls your organization cannot prove before an assessor does, enabling targeted remediation before entering the formal assessment process.

RESPONDING TO DEVELOPMENT 01 (ISACA TRANSITION AND ASSESSMENT SCHEDULING)

Organizations scheduling C3PAO assessments in 2026 need to vet their assessment partner’s capacity and credentials. The C3PAO Due Diligence Questionnaire (available now IN OUR SHOP) provides the same questions experienced compliance leads ask when evaluating C3PAOs, now with added relevance as assessor credentials migrate to a new credentialing body.

RESPONDING TO DEVELOPMENT 02 (ZERO TRUST AND POST-QUANTUM STRATEGY SIGNALS)

The White House strategy reinforces that every NIST SP 800-171 control will face increasing scrutiny. The Documentation & Evidence Templates Pack (available now at agility-grp.com/shop) provides audit-ready documentation templates across all 14 control families, helping organizations build the evidence base that both current CMMC assessments and future procurement requirements will demand.

ISACA Credentialing Transition Is the First Governance Stress Test. The ISACA credentialing transition will be the first test of whether the CMMC ecosystem’s governance structure can evolve without disrupting assessment capacity. If the transition produces no measurable assessor availability gaps, it validates the decision to separate credentialing from accreditation. If gaps emerge, the capacity constraints documented in prior briefs will intensify during the most critical period before Phase 2 enforcement.

Post-Quantum Cryptography Will Collide with the FIPS 140-3 Transition. The White House cyber strategy’s post-quantum cryptography deadline creates a planning horizon that will collide with the FIPS 140-3 transition already underway. Contractors currently migrating from FIPS 140-2 validated modules should anticipate that the next cryptographic transition, to post-quantum algorithms, will begin before the current one fully settles. Infrastructure decisions made now should account for this dual transition path.

DoD CUI Marking Problems Will Persist. The DoD CUI marking problem is unlikely to resolve quickly. Three of five IG recommendations from the 2026 advisory remain open, and six of 14 from the 2023 audit are still unresolved. Contractors should expect inconsistent CUI markings from government sources for the foreseeable future and build independent verification into their standard operating procedures.

Supply Chain Attacks via Software Updates Are an Escalating Pattern. Supply chain attacks exploiting software update mechanisms are an escalating pattern. TrueConf joins SolarWinds, 3CX, and Codecov in the category of trusted update channels that have been weaponized. The CMMC emphasis on supply chain risk management in NIST SP 800-171 Rev 3 directly addresses this risk category, and organizations preparing for the eventual Rev 3 transition should prioritize supply chain integrity controls.

Official ISACA page for CMMC credentialing, including CCP, CCA, and CCI certification information and the transition from Cyber AB.

Full text of the national cyber strategy document setting zero trust, post-quantum, and AI security priorities.

The management advisory documenting pervasive CUI marking failures across DoD components.

Authoritative catalog of actively exploited vulnerabilities requiring remediation under BOD 22-01. Search for CVE-2026-3502 for the TrueConf entry.

Full technical analysis of the TrueConf supply chain attack, including attack chain, persistence mechanisms, and remediation guidance.

Central hub for CUI policy, training aids, and marking guidance, including the updated FAQ referenced in the IG advisory.

112Cyber, 2026. Analysis of certification velocity, Cyber AB town hall data, and the 200% OSC increase. Useful for benchmarking your organization’s certification timeline against the broader ecosystem.

Ryan & Wetmore, 2026. Practical analysis of how the White House strategy may affect procurement requirements, evaluation criteria, and subcontractor flow-down expectations.

Federal News Network, April 2026. Coverage of the IG advisory, including context on the 2023 audit’s unresolved recommendations and the systemic nature of the marking problem.

DefenseScoop, December 2025. Reporting on the CAICO transition, including the roles retained by the Cyber AB and ISACA’s plans for the program.