Governance, Risk and Compliance

The September 21 deadline moves FIPS 140-2 validations to historical status, creating new procurement and compliance questions for MSSPs and their clients.

C1 CISO Kevin Paige explains why AI agents have become an identity problem, where visibility is breaking down and how partners can build services around governing non-human access.

Contractors still need to meet existing security requirements, but the 60-day review could change how compliance is assessed, documented, and enforced across the defense supply chain.

Third-party certification requirements are on hold, but defense contractors still need to meet NIST security controls and support their SPRS scores.

As AI takes on classification, retention and legal hold work, MSSPs need audit trails that show how decisions were made, not just what actions were taken.

Firewall logs, MFA configs, backup proof. Assessors want to see it all, and they're not just asking the contractor.