Trusted compliance intelligence
for the Defense Industrial Base

Stay ahead of CMMC and DoD cybersecurity developments with AI-powered news aggregation, personalized updates, and source-backed answers.

LatestCyber AB Town Hall recap: October 2026 Town Hall
Latest
[Virtual Event] Cybersecurity Outlook 2027[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AISecretary of War Pete Hegseth Orders Sweeping Overhaul of Military Education to Refocus on Combat LethalityShared cyber services turn recent OMB memo into cyber advantageTexas Cyber Command hosts partner-nation defense delegation during Texas Military Department engagementState Department's push to cancel hundreds of contracts left behind a trail of mistakes, watchdog findsNIST: Solo Shouldn't Mean Less SecureNeros to expand domestic drone production with $450M Pentagon loanDefense industry takes aim at ‘right to repair’ as NDAA decision loomsTrump Administration Deepens Interagency Collaboration to Protect the Nation's Skies From Unmanned ThreatsDrones incoming! New innovations on offer in UAS tech | Defense News Weekly Full Episode 11.10.26Drones that see, sense and hunt | Business of Defense – Part 2

Newsroom

No new filings today, showing this week's developments

Enforcement

DOJ Reaches $13 Million False Claims Act Settlement with Defense Contractors Over Cybersecurity Compliance Failures

Key Takeaways Cybersecurity noncompliance continues to create FCA exposure. The settlement demonstrates that contractors may face significant liability for allegedly failing to satisfy contractual cybersecurity obligations, even when the government’s...

GovCon & Trade · Nov 5, 2026

Guidance

NIST SP 800-171 Revision 2 vs. Revision 3: What Really Changed at the Assessment Objective Level?

When NIST released Revision 3 of Special Publication 800-171 in May 2024, much of the discussion focused on changes to security requirements, new requirement families, and the introduction of organization-defined parameters (ODPs).  Those changes are important. However, comparing security requirements alone does not necessarily reveal how organizations will need to adjust their security programs or Read More

CMMCAudit.org — CMMC Audit Preparation · Nov 6, 2026

Catch up on compliance news

Have a question about this news? Ask the CMMCSimple Assistant

Chat in plain English and get answers grounded in the latest coverage, with source links. No account needed to try it. News awareness only, not legal or compliance advice.

Ask the assistant

Cyber, Defense & Compliance Intelligence

Newest first, updated continuously

DoD

Texas Cyber Command hosts partner-nation defense delegation during Texas Military Department engagement

SAN ANTONIO — Texas Cyber Command and the Texas Military Department (TMD) hosted a United Arab Emirates (UAE) defense attaché delegation Oct. 21, 2026, as part of a four-day senior leader engagement in Austin and San Antonio. The Department of Defense (DoD) State Partnership Program (SPP) serves as the United States’ most enduring and innovative security cooperation initiates.

DVIDS · Nov 9, 2026

Cloud Security

Simplify cross-partition access with AWS IAM outbound identity federation

You can now use tokens from AWS Identity and Access Management (IAM) outbound federation to assume roles in other Amazon Web Services (AWS) partitions. When your workloads run across AWS partitions such as Commercial, China, GovCloud (US), and European Sovereign Cloud, a workload in one partition might need to access resources or communicate with AWS

AWS Security Blog · Nov 9, 2026

Cyber News

NIST: Solo Shouldn't Mean Less Secure

New guidance provides a basic framework for less-technical solo business owners, but it may miss the mark on how to secure technology that requires no human oversight.

Dark Reading · Nov 9, 2026

Cyber News

The Biggest Threat to Your GRC Job Isn’t AI. It’s Ignoring AI.

AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. Anecdotes examines three essential skills for the AI-driven GRC workplace: data literacy, agent governance, and communication.

BleepingComputer · Nov 9, 2026

Cyber News

ARTEX goes from pentesting tool to attacker staple in three months

A security researcher’s AI agent breached an internal sales application used by WorkOS’s go-to-market teams, the developer platform provider confirmed on Friday. “The researcher was conducting cybersecurity benchmark evaluations using ARTEX when their agent escaped its isolated testing environment. Its interaction with WorkOS was unintended,” WorkOS said. The researcher confirmed that they deleted and did not further share the customer data the agent obtained from WorkOS’s systems, and the company acknowledged the security failings that

Help Net Security · Nov 9, 2026

Cyber News

Hackers abuse refrigeration controllers to send spam and route proxy traffic

Internet-exposed refrigeration controllers used in supermarkets and cold storage facilities are being hijacked and turned into infrastructure for a suspected spam botnet and proxy services, SecurityScorecard has found. The report follows a string of attacks against European refrigeration systems, which Help Net Security started covering in October, when hundreds of French supermarkets had to throw out spoiled stock after attackers took over the systems running their fridges and freezers overnight and switched them to heating.

Help Net Security · Nov 9, 2026

Cyber News

Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. "PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file

The Hacker News · Nov 9, 2026

Cyber News

⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More

A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed

The Hacker News · Nov 9, 2026

Cyber News

PyPI makes release attestations easier to find with new security tab

The Python Package Index (PyPI) has added a security tab to its project pages, giving developers a place to check where individual release files came from. How PyPI shows where release files came from The Security tab shows whether release files have digital attestations, which provide verifiable information about how a file was published or built. A release has full provenance when every file has at least one attestation. A PyPI Publish attestation identifies the

Help Net Security · Nov 9, 2026

Federal Policy

Department of Agriculture: Little Transparency on Whether Key Issues Were Analyzed Before Reorganization Decision

What GAO Found In July 2025, the U.S. Department of Agriculture (USDA) announced a plan to reorganize the department, including relocating thousands of staff positions from the National Capital Region to five hub locations across the country. In the spring of 2026, all eight USDA mission areas and several agencies announced reorganization plans, including relocating certain agency functions. The department’s actions are the subject of federal litigation seeking to stop USDA from implementing its reorganization plan. Five Hub Locations and Other Selected Relocations from the National Capital Region Planned by the U.S. Department of Agriculture (USDA) USDA’s workforce decreased by 20 percent from December 2024 through March 2026, from about 91,000 employees to about 73,000. Individual USDA agencies decreased from 12 percent (Forest Service) to 41 percent (National Institute of Food and Agriculture). The extent to which USDA conducted and considered analysis before announcing the department’s reorganization is unknown. Several leading practices can help agencies conduct appropriate analyses and make sound decisions when they reorganize and relocate staff, including practices rel

GAO Reports · Nov 9, 2026

Federal Policy

Opioid Overdose Reversal Medications: Medicare and Medicaid Enrollees Generally Had Coverage in Selected Recent Years

What GAO Found Naloxone and nalmefene, the two types of opioid overdose reversal medications, are available as both injections and nasal sprays and as generic and brand versions. Naloxone is also available in low and high doses. Low-dose naloxone nasal sprays have been available for over-the-counter (OTC) use since 2023. GAO’s analysis of federal data show that all enrollees of Medicare Part D and Medicaid had coverage of some form of naloxone in 2025 and 2024, respectively, while coverage of nalmefene—a newer and longer acting medication—was less common (see figure). Medicare Part D Enrollee and Medicaid Coverage of Opioid Reversal Medications Note: For the purposes of this report, GAO identified states as having Medicaid coverage if there was utilization of opioid overdose reversal medications; other states may have coverage but no utilization of these medications. Medicare Part D out-of-pocket costs for both drugs varied by formulation and brand or generic status, with the lowest costs for generic naloxone injections, ranging from a $3 to $10 median copay. The highest out-of-pocket costs ranged from a 25 to 35 percent median coinsurance for brand high-dose naloxone and nal

GAO Reports · Nov 9, 2026

Federal Policy

Financial Audit: Bureau of the Fiscal Service’s FY 2026 and FY 2025 Schedules of Federal Debt

What GAO Found GAO found (1) the Bureau of the Fiscal Service’s Schedules of Federal Debt for fiscal years 2026 and 2025 are fairly presented in all material respects and (2) Fiscal Service maintained, in all material respects, effective internal control over financial reporting relevant to the Schedule of Federal Debt as of September 30, 2026. GAO’s tests of selected provisions of applicable laws, regulations, contracts, and grant agreements related to the Schedule of Federal Debt disclosed no instances of reportable noncompliance for fiscal year 2026. Over the past 10 years, from fiscal year 2016 through fiscal year 2026, total federal debt managed by Fiscal Service has increased by about 105 percent from $19.6 trillion to $40.2 trillion. Total Federal Debt Outstanding, September 30, 2016, through September 30, 2026 Note: A small amount of total federal debt is not subject to the debt limit. During fiscal year 2026, total federal debt increased by about $2.5 trillion, with about $2.1 trillion of the increase in debt held by the public (i.e., investors outside the federal government). Debt held by the public is increasing mainly because the federal government continues to s

GAO Reports · Nov 9, 2026

Federal Policy

Social Security Administration: Actions Needed to Improve Data Exchanges for Beneficiaries in Foster Care

What GAO Found For children receiving Social Security benefits (beneficiaries), such as disability benefits, the Social Security Administration (SSA) typically assigns representative payees (payee) to manage those benefits. When children enter or exit foster care, SSA may need to change the payee. Since 2018, SSA has encouraged states to set up data exchanges to submit monthly data on children in foster care to help SSA identify when these beneficiaries need a new payee. Twenty-five states were submitting data through these exchanges, as of July 2026. However, no new states have begun submitting data since 2024; officials from four of eight selected states not submitting data had minimal awareness of the data exchanges. Yet, SSA has not changed its state outreach efforts, thereby limiting the number of beneficiaries covered under its exchanges (see figure). Number of Social Security Beneficiaries in Foster Care With a Representative Payee and States Submitting Data to SSA’s Foster Care Data Exchanges, Fiscal Year 2025   Note: The District of Columbia is counted as a state. The number of states submitting data is as of July 2026. SSA generates alerts from the data exchanges w

GAO Reports · Nov 9, 2026

Federal Policy

F-35 Program: DOD Needs to Strengthen Oversight of Tens of Billions of Dollars in Parts

What GAO Found The Department of Defense (DOD) continues to face challenges in accounting for F-35 parts, such as engines and tires. The F-35 program includes approximately 26 million F-35 parts, valued at approximately $31 billion and held at over 700 contractor- and government-managed facilities around the world. Although these are DOD-owned parts, DOD does not maintain complete records of the parts. Specifically, GAO found that DOD has not established procedures that ensure its own records will be sufficient to account for and financially report on the parts (see figure). For instance, records of F-35 parts in the F-35 program’s accountable property system of record (APSR) remain unreliable, since they do not reflect real-time changes and are inaccurate and incomplete. Also, the F-35 Joint Program Office (JPO) has not fully developed procedures to validate the accuracy of data it enters into the APSR. GAO has an open recommendation addressing this issue (GAO-22-105002). GAO also found that F-35 JPO’s physical inventory procedures did not adequately verify the existence and validate the completeness of F-35 parts. Without accurate data in its APSR and properly executed inventor

GAO Reports · Nov 9, 2026

Cyber News

AI Security

Two weeks ago, I attended the [un]prompted AI security conference in San Francisco. It was an excellent event: three days of very dense talks about all aspects of AI security. (My talk was about integrous AI, and I will post it when it is online.) AI security can be divided into three broad topics. It’s important for researchers to understand which one they are working on. And it’s important for us as a community to work on them all. They are: security of AI, security with AI, and security from AI. [un]prompted had good talks about all three...

Schneier on Security · Nov 9, 2026

Cyber News

Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million

Three men allegedly used deepfakes of company CEOs and law firm attorneys to trick employees into wiring more than $129 million to accounts the group controlled, the Justice Department said. The indictment names the three as Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. Soall used the alias “Rocky Balboa,” and Hazan went by “Superman Cash,” “Impossible Mission” and “Fat Boy,” among others. The scheme ran from 2024 to 2026 and usually opened

Help Net Security · Nov 9, 2026

Cyber News

Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars

The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an

The Hacker News · Nov 9, 2026

  1. 1Create a free account
  2. 2Pick your topics and platforms
  3. 3Read your tailored feed
  4. 4Ask the CMMCSimple Assistant

Get the feed your contracts depend on

Create a free account, pick your topics, and see your tailored compliance feed today.

Create a free accountBrowse the latest feed

Publish with CMMCSimple

Want to publish your news with CMMCSimple? Contact us at news@cmmcsimple.com.

Our RSS source list is reviewed and updated every two weeks on Friday, so newly accepted feeds appear with the next update.

© 2026 CMMCSimple