standard
NIST publication defining the 110 security controls against which DIB contractors score themselves in SPRS.
No evidence-backed relationships are recorded.
A CyberScoop op-ed argues that a prolonged conflict with Iran will show up as sustained low-grade disruption at small operators and sub-tier defense suppliers, and that US agencies should be wargaming it now.
Reality
The Department of War took the third-party assessment requirement out of the November contract cycle and asked a task force to rethink the program. Suppliers now decide alone how much remediation to keep funding.
Reality
ICIT's Parham Eftekhari says CISA is rehiring under acting leadership while keeping vulnerability management running, and that states keep writing AI law regardless of Executive Order 14365. Two of his five items already bind.
Reality
The Pentagon pulled the C3PAO certification deadline on July 13 and left Phase 1 self-assessment, SPRS scoring and DIBCAC spot checks exactly where they were.
Reality
CyberSheath's 2026 survey puts the average SPRS self-assessment at +51, but only 65% of contractors trust their own number. Treat supplier scores as claims, not findings.
Reality