ResourcesBlogTag: NIST 800-171
Blog entries tagged NIST 800-171
Every blog entry tagged NIST 800-171, newest first. Tags group the blog by subject so a reader working one requirement can follow it across entries as the rules change. Each entry shows when it was published and last updated; every entry is listed on the blog index.
11 entries
Entries, newest first
- OVHcloud CLI Releases Were Swapped for a Secret Stealing BuildAdvisory GHSA-862f-55f5-vmvw says a compromised developer account replaced OVHcloud CLI release binaries for 94 minutes on October 19, 2026.
- Stolen Keys, Signed Commands: The UpdraftCentral Supply Chain BackdoorAttackers stole TeamUpdraft's UpdraftCentral keys and pushed backdoors to WordPress sites as properly signed commands.
- Plex2Shell: Four Small Bugs Chained Into One TakeoverCISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026.
- CMMC Phase II Is Suspended: What Defense Contractors Still Have to DoThe Department of War suspended CMMC Phase II on July 13, 2026, but kept Phase I self-assessments, NIST SP 800-171 Rev. 2 enforcement, and DFARS 252.204-7012 obligations in place.
- The $507K LOGZONE Settlement: Your SPRS Score Is Now False Claims Act EvidenceDOJ settled with a defense contractor that posted a 110 SPRS score and later received a -170 government assessment.
- CMMC Level 2 Requirements in 2026: The Complete Guide for Defense ContractorsCMMC Phase II is suspended, but the 110-requirement NIST 800-171 Rev. 2 baseline, Phase I self-assessments, and DFARS safeguarding obligations remain active.
- NIST 800-171 Cloud Compliance: The Practical Guide for AWS, Azure, and GCPImplementing NIST 800-171 in cloud environments is fundamentally different from on-premises.
- The CMMC Level 2 Self-Assessment Trap (And How to Avoid It)Most defense contractors who submit optimistic SPRS scores don't realize they're creating legal exposure, not just compliance risk.
- Cloud Misconfiguration Statistics 2026: What's Actually Breaking Defense Contractor EnvironmentsData-driven analysis of cloud misconfiguration patterns across the Defense Industrial Base: top finding categories, specific failure modes, and what the numbers tell us about effective remediation.
- NIST 800-171 Rev 3: Key Changes and How to PrepareNIST SP 800-171 Revision 3 brings significant changes to the security requirements for protecting CUI.
- CMMC 2.0: What Defense Contractors Need to KnowThe CMMC program is officially active with assessments underway.
Related records
Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.
- proof.state
- Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- proof.change
- Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
- proof.agency
- Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- architecture
- Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.
Read the entries. Then verify the record they describe.