PolicyCortex
Request Access

Entries, newest first

  1. CMMC Phase II Is Suspended: What You Still Have to DoThe Department of War suspended CMMC Phase II on July 13, 2026, but kept Phase I self-assessments, NIST SP 800-171 Rev. 2 enforcement, and DFARS 252.204-7012 obligations in place.7 min
  2. The $507K LOGZONE Settlement: Your SPRS Score Is Now False Claims Act EvidenceDOJ settled with a company that posted a 110 SPRS score and later received a -170 government assessment.9 min
  3. The C3PAO Capacity Math After the CMMC Phase II SuspensionThe Phase II countdown is gone, but C3PAO capacity still matters for contract-specific and voluntary assessment plans.10 min
  4. CMMC Level 2 Requirements in 2026: The Complete GuideCMMC Phase II is suspended, but the 110-requirement NIST 800-171 Rev. 2 baseline, Phase I self-assessments, and DFARS safeguarding obligations remain active.14 min
  5. The Safety Sandwich: How PolicyCortex Gives AI Safe Write Access to Cloud EnvironmentsGiving AI autonomous write access to production cloud environments sounds dangerous.9 min
  6. CMMC Level 2 Compliance Costs: The Complete Breakdown for 2026Most organizations budget for the C3PAO assessment and forget about everything else.10 min
  7. NIST 800-171 Cloud Compliance: The Practical Guide for AWS, Azure, and GCPImplementing NIST 800-171 in cloud environments is fundamentally different from on-premises.12 min
  8. The Alert Queue That Never Empties: Why CSPM Visibility Isn't EnoughYour CSPM tool is finding everything. Your queue is growing anyway.8 min
  9. CMMC Phase II Timeline Suspended: What the 60-Day Review ChangesThe Department of War suspended the November 2026 Phase II transition and future milestones.10 min
  10. The CMMC Level 2 Self-Assessment Trap (And How to Avoid It)Most organizations that submit optimistic SPRS scores don't realize they're creating legal exposure, not just compliance risk.9 min
  11. CMMC 2.0: What You Need to KnowThe CMMC program is officially active with assessments underway.2 min

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where the evidence is stored in each delivery mode.
authorization
Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
baseline
NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.

Read the entries. Then verify the record they describe.

Request AccessBook a call