Risk Management

A recent report indicates nearly 90% of state CIOs prioritize cybersecurity for critical infrastructure. With states boosting support to municipalities, there's a rising demand for cybersecurity services and assessments, highlighting potential procurement opportunities.

Computer Aid (CAI) rejected a subcontractor's insurance certificate for lacking **Cyber Liability** and **Professional Liability** coverage. This situation emphasizes the importance for subcontractors to ensure their insurance meets specific contract requirements, which could affect approval processes for federal contracts.

The National Institute of Standards and Technology (NIST) has published a draft extending cybersecurity guidance for operational technology (OT). Stakeholders can comment on the draft until November 30, 2026, as it aims to improve security across critical sectors like water and agriculture amidst rising cyber threats.

Recent insights indicate that federal procurement reforms could significantly alter contractor risk management strategies. With **$793 billion** in federal contract commitments and a **66%** competition rate in **FY2025**, companies must adapt to compressed timelines and heightened financial implications arising from procurement centralization.

Cybersecurity professionals emphasize the need for clear scoping documentation in CMMC Level 2 assessments. Precise boundary definitions help streamline compliance efforts and reduce costs by focusing resources only on the relevant environments.

Procurement professionals are grappling with enforcing IT security clauses in third-party risk management contracts. The importance of executive support and tiered risk-based policies is emphasized to drive compliance and protect sensitive data.

The IRS's effort to enhance its cybersecurity measures is hindered by ongoing vulnerabilities, according to a recent TIGTA report. This situation presents procurement opportunities for vendors in cybersecurity solutions, as the agency seeks to meet critical compliance and security challenges.

The **Information Security Oversight Office (ISOO)** has mandated that federal agencies provide clearer guidance for contractors managing **Controlled Unclassified Information (CUI)**. This initiative aims to bolster compliance by streamlining identification, safeguarding, and reporting processes for CUI. Contractors will need to adapt their compliance programs to align with these new directives.

The recent Trade and Cargo Security Summit in Dallas, hosted by **U.S. Customs and Border Protection** (CBP), brought together over 4,300 participants from government and industry to discuss critical supply chain issues. This initiative underscores the potential for procurement opportunities in compliance and risk management, vital for enhancing economic security.

The U.S. Department of Agriculture has launched enrollment for the 2026 and 2027 Agriculture Risk Coverage (ARC) and Price Loss Coverage (PLC) programs. This represents a significant shift in farm policy, offering new opportunities for contractors in agricultural data management and risk services.

Federal financial regulatory agencies have proposed updated guidance for managing third-party risks in banks and credit unions. This new, principles-based framework aims to enhance risk management practices, with substantial implications for procurement strategies and compliance requirements among vendors servicing these financial institutions.

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered all federal agencies to patch a critical vulnerability in Cisco's Secure Firepower Management Center (FMC) software by September 12, 2026. Failure to act could expose federal networks to severe cyber threats, necessitating increased procurement efforts in cybersecurity services.

The National Institute of Standards and Technology has finalized a new Meta-Framework to bolster manufacturing supply chain transparency and risk management. By promoting decentralized traceability, it offers procurement professionals an essential tool for mitigating risks associated with counterfeit components and ensuring product integrity.

The USDA Farm Service Agency (FSA) has updated its lending rates to enhance access for agricultural producers as of February 2025. Additionally, several counties in Maryland have been designated as natural disaster areas due to drought, allowing for expanded disaster assistance.

The FDIC's July 2026 enforcement actions include five orders impacting banks and individuals. While no hearings are scheduled for September, industry stakeholders should assess the implications for compliance services and regulatory adherence strategies.

Cisco has identified a critical zero-day vulnerability requiring federal agencies to take immediate action. Agencies must patch affected systems by August 14, 2026, emphasizing the importance of robust cybersecurity measures in procurement and risk management.

Manufacturers and distributors in the U.S. are reducing vital cybersecurity practices in 2026. This trend raises serious concerns for compliance with federal mandates, especially within the Department of Defense (DoD), creating potential risks for contractors and their government engagements.

The procurement community expresses worries about the efficacy of Chief Information Security Officers in managing risk and technology procurement. There's a pressing need for contractors to engage clients prioritizing cybersecurity as a strategic focus rather than mere compliance, opening opportunities for consulting in governance and cultural change.

The Oregon Division of Financial Regulation has approved a **21.6%** average increase for individual health insurance plans while reducing the small group market increase from **17%** to **15.5%**. The state is investing an additional **$15 million** into the Oregon Reinsurance Program, ensuring market stability and influencing procurement approaches for health insurance vendors.

Evalian, a cybersecurity firm, addresses sector-specific threats and compliance challenges for UK financial organizations. Their services, including SOC and incident response, exemplify a growing need for organizations to bolster their cybersecurity measures and cope with evolving regulatory requirements.

The National Institute of Standards and Technology (NIST) recently finalized its IR 8374 Revision 1, detailing a comprehensive framework for managing ransomware risks. This development underscores an increasing regulatory focus on cybersecurity preparedness and will likely shift procurement requirements towards enhancing cybersecurity services among contractors.

New York State's Empire State Development has backed WithCoverage's Manhattan expansion with up to $3M in tax credits. The company's $25M investment in R&D will create 205 new jobs, enhancing the state's position in AI-driven risk management and fueling economic growth.

A major security flaw in ERPNext's Document Follow feature exposes sensitive data, impacting government operations. Agencies and contractors should swiftly assess their ERP systems to mitigate potential risks related to unauthorized data exposure.

The government emphasizes the need for a risk-based security approach that goes beyond mere compliance with regulations. As stakeholders recognize the importance of integrating compliance frameworks like ISO 27001 and NIST with robust security practices, procurement implications arise for vendors and contractors to adjust their proposals accordingly.

The cybersecurity sector is moving towards Continuous Threat Exposure Management (CTEM), shifting from static vulnerability assessments. This dynamic approach is crucial for government agencies managing industrial control systems and IIoT, incentivizing procurement teams to seek solutions that enhance real-time risk evaluation and prioritization.

The Cybersecurity and Infrastructure Security Agency (CISA) has released new guidance aimed at helping federal civilian agencies securely adopt and manage open-source software (OSS). This guidance highlights the importance of the C4 Framework, which will be critical for assessing the trustworthiness of OSS and ensuring compliance with recent executive orders.

As Germany enforces mandatory cybersecurity training for executives, companies face potential penalties for non-compliance. The NIS-2 directive aims to elevate cybersecurity standards, emphasizing personal liability and risk management for leadership in affected industries.

Several Minnesota municipal water utilities recently reported cyber incidents affecting operational technology, underscoring vulnerabilities in critical infrastructure. This highlights an urgent need for enhanced cybersecurity measures and procurement opportunities for contractors in the sector.

The USDA's Farm Service Agency (FSA) alerts agricultural producers about critical deadlines for disaster assistance programs in August 2026, including the ASCF and SDRP. These programs play a vital role in providing financial stability to producers grappling with rising costs and natural disasters, necessitating prompt engagement with FSA offices.

The Federal Reserve Board's Office of Inspector General has pinpointed critical deficiencies in the insider risk management program. This presents opportunities for contractors specializing in risk management solutions and cybersecurity services as the Board commits to implement recommended improvements by late 2027.

The European Union and South Korea have initiated the enforcement of their AI regulations, creating significant compliance challenges for telecommunications and technology providers. Companies must prepare for heightened scrutiny and penalties associated with non-compliance in their AI deployments.

Government agencies focus on strengthening SAP security within their cybersecurity strategies to prevent data breaches. This increased attention emphasizes the need for procurement teams to seek vendors with specialized knowledge in both cybersecurity and SAP governance compliance, signaling opportunities in the market for such solutions.

The U.S. Army Installation Management Command is hiring a Program Manager for Vendor Threat Mitigation to reduce risks from adversarial commercial support in Africa. This role is crucial for securing military operations and offers a competitive salary for qualified candidates with security clearance.

ESET has reported 11 vulnerabilities in UEFI shim bootloaders signed by Microsoft, allowing attackers to sidestep UEFI Secure Boot. This discovery poses significant risks for government and critical infrastructure, necessitating immediate firmware updates and patching to ensure security. Cybersecurity contractors must prioritize these updates to protect their systems.

Government cybersecurity leaders are assessing the integration of AI for automating vulnerability reports. Although AI could enhance efficiency, there are significant concerns regarding the reliability of its outputs, which may impact decision-making processes at the executive level.

The use of Software Bill of Materials (SBOM) services is becoming a priority for federal agencies like **NIST** and **CISA** as they integrate these tools into their cybersecurity strategies. This trend offers procurement professionals insights into growing federal demand for enhanced software transparency and supply chain risk management capabilities.

CISO Global has automated and expanded its FedRAMP-certified TiGRIS platform to address complex compliance needs of federal clients. The integration of generative AI capabilities positions TiGRIS as a critical tool for contractors looking to enhance compliance operations and reduce risks in line with evolving federal standards.

U.S. critical infrastructure sectors are increasingly vulnerable to cyber-physical threats, necessitating procurement of advanced cybersecurity solutions. Contractors specializing in operational technology modernization are uniquely positioned to assist agencies in mitigating these risks.

Government and industry procurement professionals must adapt to new security questionnaire demands. Shifting focus beyond SOC 2 assessments, organizations are urged to integrate comprehensive security controls, ensuring better vendor risk evaluation and compliance verification.

Governor Kevin Stitt of Oklahoma expressed strong concerns regarding a proposed multimillion-dollar settlement related to a long-standing lawsuit against poultry producers. The settlement, if approved, may lead to regulatory uncertainties impacting family-run farms and the agricultural sector in the state.

Three ex-negotiators from DigitalMint and Sygnia received four-year prison sentences for their involvement in ransom schemes affecting major U.S. organizations. This event exposes insider threat vulnerabilities in cybersecurity contracts, prompting a reevaluation of vendor selection and oversight strategies across the sector.

Vanta has achieved FedRAMP 20x Class C certification for its Government Cloud platform, improving access for federal agencies. The certification supports IT modernization efforts and enhances compliance for contractors and resellers focused on cybersecurity and risk management.

The National Institute of Standards and Technology (NIST) released Special Publication 800-18 Revision 2, providing updated guidance on developing crucial system security and cybersecurity supply chain risk management plans. This revision emphasizes automated, machine-readable formats, offering significant procurement implications for federal agencies and contractors in aligning practices with federal standards.

The Intelligence Advanced Research Projects Activity (IARPA) has rejected a proposal from a small business and university due to significant risks associated with technical execution and scheduling. This decision underscores the importance for contractors to emphasize risk management strategies in their submissions to align with IARPA's demanding evaluation framework.

FedRAMP 20x is shifting federal cybersecurity compliance from point-in-time audits to continuous, automated monitoring. This transition is crucial for contractors in governance, risk, and compliance engineering, granting new avenues for providing advanced compliance technologies.

The Cybersecurity and Infrastructure Security Agency (CISA) is evolving its approach to federal cybersecurity by implementing an integrated defense system. This shift emphasizes the need for contractors with capabilities in cybersecurity integration and compliance, opening new procurement opportunities.

Recent findings reveal a significant vulnerability in the libssh2 SSH library, impacting many government systems and IoT devices. Agencies must expedite patch implementation and assess vendor capabilities to mitigate security risks associated with this flaw.

Security threats in supply chains from Africa to Southeast Asia disrupt operations and increase costs. Procurement professionals are urged to enhance visibility and build coalitions to address vulnerabilities and ensure continuity.

The UK has imposed sanctions on HTX due to its facilitation of Russian sanction evasion. This move necessitates increased scrutiny and adaptation within procurement strategies for blockchain and crypto service vendors.

The government is closely examining vendor adherence to **ISO 27001:2022**, specifically focusing on **Control 8.29**. This mandate requires comprehensive risk-based security testing integrated into the software development lifecycle, influencing procurement strategies and vendor selection in government contracts.