CCI staff share recent surveys, reports and analysis on risk, compliance, governance, infosec and leadership issues. Share details of your survey with us: editor@corporatecomplianceinsights.com.
47% DIB continuing to enhance cybersecurity despite federal government pause
About 47% of defense contractors are moving forward with third-party cybersecurity verifications even as the Department of War has paused CMMC Phase 2, a survey by Redspin found.
The survey of 131 defense industrial base (DIB) contractors found 47% are continuing DFARS 252.204-7012, NIST SP 800-171 and CMMC efforts toward future third-party certification despite the fact that Secretary of War Pete Hegseth in July halted rollout of CMMC Phase 2, which was scheduled to take effect in November.
A good chunk of contractors are pressing on, but the pause is causing some to hit the brakes. Almost 22% reported that they’re slowing or halting their CMMC efforts, while 20% said they were pausing their certification spending and another 3% reported decreasing this investment.
Contractors still see reaching CMMC Level 2 as meaningful, with 75% of respondents saying that even with the pause, achieving Level 2 delivers value to their organization beyond contract eligibility. Of those, almost 69% said the value was independent validation of cybersecurity programs. Other Level 2 values DIB contractors identified were demonstrating commitment to protecting controlled unclassified information (63%), supporting eligibility for future defense contracts (60%) and meeting customer or prime contractor expectations (60%).
Increased job pressure hits 75% of risk leaders
Risk leaders are feeling strained with three in four reporting that pressure has increased on their role in the past year, a survey by Riskonnect found.
The survey of more than 250 risk, compliance and resilience professionals also discovered that 20% said the rise in pressure was significant. More than a third (37%) described their job pressure as “high” or “extreme.”
“That increased pressure is not surprising since risk leaders are shouldering much more than a few years ago,” a summary of the survey said. “They’re expected to cover more ground, see further ahead, and respond faster, all without a corresponding increase in headcount or budget.”
Sometimes other departments are causing headaches for risk teams. About two in five (41%) reported that another department had made a risk-based decision in the past year without consulting the risk team that had a significant, unforeseen disruption on a different area of the organization.
Rising economic and political risks may also be contributing to the squeeze risk leaders are feeling. Economic risks rose to the top of risk leaders’ concerns after a two-year reign by cybersecurity risk. The two categories tied this year with 55% saying economic and cybersecurity risks were the biggest threats their companies face. More than a third (38%) named political risk as a top concern, making it the second most reported threat by risk professionals, followed by geopolitical and talent risks (37% each).
