Understanding CMMC: A Roadmap for Federal Contractors

Posted on by Jeff Ladner

The Department of Defense (DoD) recently announced new cybersecurity compliance mandates for contractors and subcontractors in the DoD’s supply chain. Private companies that process, store or transmit DoD data are now required to comply with the Cybersecurity Maturity Model Certification, or CMMC.

The new mandate impacts every private company that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). That’s a large group: According to the DoD’s own estimation, at least 220,000 private companies currently have access to FCI and CUI and require CMMC certification.

Because the CMMC is relatively new, some organizations may be struggling to understand their obligations. Learn more about exactly what the CMMC is and what steps organizations should take right now to be prepared for audits and remain eligible for DoD contracts.

What Is CMMC?

CMMC is the cybersecurity compliance structure used by the Department of Defense. High-profile security breaches like Solar Winds highlighted the need for rigorous data protection throughout the DoD supply chain. The DoD implements the CMMC framework to vet potential contractors and subcontractors and protect against third-party data breaches.

There are three CMMC certification levels: 1, 2 and 3. The different levels correspond to the degree of sensitive information being handled. All companies that contract with DoD need to have at least Level 1 CMMC, while companies that handle more sensitive information will need to have Level 2 or Level 3 cybersecurity compliance certifications.

Recent Changes to CMMC

The CMMC has recently undergone some amendments. An older version of the CMMC, or CMMC 1.0, was implemented in 2019. The new version, CMMC 2.0, came into effect at the end of 2024.

Contractors must now comply with CMMC 2.0, although implementation is taking place in stages. For any organization contracting with the Defense Department, the most important takeaway is that you absolutely must be CMMC compliant to continue working with the Department.

What Level of CMMC Certification Do You Need?

If your organization handles any FCI or CUI, you’ll need CMMC certification. Which level is right for you? You can’t know for certain until you apply for a contract, as there is some variation from one external contract to another.

However, you can make an educated guess about the certification you’ll need. The DoD’s Scoping and Assessment Guide also provides more detail about the standards for each level.

Level 1 CMMC

Level 1 is the most straightforward CMMC certification. It doesn’t require third-party auditing; contractors do a self-assessment to get the certification.

Level 1 is usually appropriate for contractors who handle FCI material and nothing else. FCI is unclassified Government information that isn’t publicly available. Details about Government employees or facilities, for example, might be categorized as FCI. Although the information is sensitive, it is not considered critical enough to require the extra protection of a Level 2 or Level 3 certification.

Level 2 CMMC

If your organization handles both CUI and FCI, you will probably require Level 2 CMMC certification.

In many cases, Level 2 certification is straightforward and can be achieved through a self-certification process. However, in some cases you will need to pass a third-party audit for Level 2 certification. The procedure depends on the sensitivity of the data you’ll be handling. The more sensitive the information, the more precautions the DoD puts in place to prevent a potentially disastrous security breach.

Level 3 CMMC

Level 3 CMMC is the most serious and the most difficult certification to obtain. If your organization routinely handles both CUI and FCI and also deals with material that impacts DoD operations, then you may need this certification.

Level 3 CMMC mandates stricter protections than the other two certification levels. It’s required in cases where a data breach could create widespread problems for the Department of Defense, or even for national security.

To obtain Level 3 CMMC certification, you must undergo a Government audit. The Government will thoroughly assess your security system and determine whether it meets the appropriate standards for certification.

What Is the Cybersecurity Compliance Timeline?

CMMC 2.0 came into effect in December 2024. From that date on, organizations working with the Department of Defense are mandated to begin implementing CMMC compliance according to a 4-phase plan.

Phase 1

This stage began in December 2024, as soon as CMMC 2.0 came into effect. During Phase 1, prospective new DoD contractors are required to conduct a self-assessment to ensure cybersecurity compliance according to Level 1 or 2 CMMC. Phase 1 requirements went into effect November 10, 2025.

Phase 2

The full Level 2 standard comes into effect in November 2026, ushering in Phase 2 of CMMC 2.0. At this stage, contractors are subject to third-party audits to ensure cybersecurity compliance with Level 2 and Level 3 certification.

Phase 3

Phase 3 is set to begin in November 2027. At that time, organizations that handle the most sensitive data will be mandated to undergo a Government-run security audit to ensure compliance with Level 3 CMMC certification.

Phase 4

In November 2028, all new defense contracts will contain language stipulating the CMMC level requirement.

What Steps Should You Take To Comply with the CMMC?

Cybersecurity compliance is fairly straightforward and can be broken down into a few key steps.

Step One: Preparation

Determine which certification level is appropriate for your organization and its needs. Begin by deciding which contracts you’d like to apply for, and use the contracts to decide the appropriate certification level.

Remember that it’s always a good idea to aim for the lowest appropriate certification level, as higher levels are more difficult to obtain. If you are not dealing with highly sensitive data, it’s not worth trying to obtain the Level 3 certification.

Step Two: Internal Assessment

Conduct a preliminary assessment of your organization, analyzing where you will need to make changes to achieve cybersecurity compliance.

It’s good practice to do this in two stages. First, complete a self-assessment. Next, check your assessment with an objective source.

Step Three: Third-Party Audit

If you’re working towards Level 2 or Level 3 certification, you’ll need to be audited, either by an approved third-party auditor or by the Government. The CMMC marketplace makes it easy to set up the assessment. Again, you should first perform a self-assessment to make sure that you’ve addressed any shortfalls in your organization before you undergo this audit.

Step Four: Course Correction

The audit may reveal deficiencies in your security system. If so, you may be granted time to correct these deficiencies and still successfully apply for your CMMC certification.

Once you receive your CMMC certification, you’ll need to renew it once a year to confirm that your organization is keeping up with DoD best practices for cybersecurity.

Get Started With the CMMC Certification Process

Get guidance on preparing for CMMC certification.
Learn how one civil engineering firm worked with Onspring to earn its CMMC certification.
Request a demo to explore the benefits of partnering with Onspring.

Artificial Intelligence and Cybersecurity: A Federal Perspective

Posted on by Jeff Ladner

As artificial intelligence (AI) continues to expand across Government operations, Federal agencies must integrate advanced AI technology to strengthen cybersecurity while staying ahead of new cyber threats. This is especially crucial in environments where critical systems, personally identifiable information (PII), and critical infrastructure are constantly targeted by sophisticated adversaries.

AI is a double-edged sword. Malicious actors now use machine learning techniques, deep learning and generative AI to scale cyberattacks at unprecedented speed. At the same time, security teams are successfully deploying advanced AI algorithms, security tools and threat intelligence to detect, defend and respond faster. Striking the right balance is essential for Federal leaders responsible for safeguarding national interests.

In this article, we’ll talk about how to find the right balance between exploiting AI’s capabilities and guarding against the risks. We’ll also explore the specific threats agencies face today, and discuss how AI can help by automating risk management.

The Growing Cybersecurity Challenge

Ransomware, large-scale phishing campaigns and deepfake social engineering attacks are accelerating due to advancements in AI systems and large language models (LLMs). Cybercriminals can cast a wider net than ever before, with little effort and at a low cost to themselves, especially when targeting critical infrastructure and Federal systems.

Increased Threats

It’s worth noting that even benign AI applications are paving the way for more cyber events. When Government agencies adopt AI tools, they automatically expand their networks and their “attack surfaces,” requiring new security measures and stronger vulnerability assessment practices.

AI’s automation and speed enable large-scale attacks. AI can rapidly scan and scrape online databases and analyze network traffic, looking for potential targets to attack. Hackers can use AI’s no-code automation capabilities to create the code for malware at high speed, and to send out phishing emails at a larger scale than ever before. AI’s natural language processing (NLP) capabilities allow it to create credible “deepfake” video and audio at high speed, as well.

The vast majority of these attacks are unsuccessful, but it only takes one careless end user to click a bad link to a malicious website, or to click a link that triggers a domain blocking failure. That’s why it’s so important for security teams to be on their guard. Fortunately, AI tools can also help. Just as no-code automation helps hackers, it also helps agencies protect themselves against threats.

Leveraging AI Tools To Fight Cyberattacks

The same capabilities that can make AI useful for hackers also make it a great tool in fighting cyber threats. Automation, speed and the ability to identify patterns are all invaluable for countering online threats.

Using AI to Identify Phishing Attacks

AI excels at assisting with phishing detection. AI and Machine Learning (ML) tools can quickly “read” incoming emails and texts and scan them for telltale signs of danger, like unusual sender addresses. AI’s natural language processing capabilities also help. NLP tools scan incoming messages for unusual phrasing or a strange tone, which might indicate a phishing attack.

Most spam folders are powered by AI and ML tools. These tools are constantly learning on the job, too. Whenever you mark an incoming email “spam,” your software learns a little more about what you consider to be spam. Going forward, it incorporates that information into its workflow.

Using AI To Scan for Malware

AI-powered antivirus tools scan for malware more effectively than older antivirus detection systems. The AI software scans and analyzes huge quantities of data in network traffic and system logs to identify patterns that could indicate a virus. Because deep learning models are so good at identifying patterns and spotting anomalies, it can often spot new viruses early on.

Older antivirus software relies on known viral signatures. While useful, these tools can’t keep up with new threats evolving through AI algorithms. That’s the AI difference: predictive pattern detection supports proactive cybersecurity solutions and strengthens incident response.

Using AI To Identify Threats From Within

AI can help to spot attacks from within. The software establishes a baseline of user behavior, like normal login hours and normal patterns of data access. When there’s a change in that baseline, the AI tool flags it for further investigation.

AI looks for changes like unusual activity outside of a team member’s normal working hours or location-based aberrations. For example, if a member of your team normally logs in at 9 a.m. and out at 5 p.m., the AI tool will notice if they start logging in again at midnight to download files. Even if they have authorization to view that information, it’s worth asking why they suddenly need to access it at an unusual time. In the same vein, further review may be warranted if an employee views a record from an atypical IP address.

Using AI To Actively Fight Threats

Beyond identifying cyber threats, AI tools can proactively defend systems. They block or isolate compromised devices, enforce malicious domain blocking, apply system patches and notify security teams of attempted attacks.

AI-backed incident response workflows reduce the spread of malware and help protect the network even when one endpoint is compromised.

Exercising Precaution: Building Guardrails for AI

AI is a valuable tool for fighting cyber threats. However, it’s important to protect your network and end users against AI’s natural pitfalls. Federal agencies have a special responsibility to install guardrails in accordance with the relevant regulations and guidelines.

AI guardrails ensure that the technology behaves according to ethical standards, avoiding bias and making appropriate use of sensitive data. To some extent, AI itself can create guidelines. Generative AI tools can routinely scan for ethical problems and alert managers to any new issues.

However, human oversight remains crucial, and agencies should appoint managers to be directly accountable for AI supervision. The NIST AI Risk Management Framework provides detailed guidance for managers and anyone else involved in managing AI guardrails.

Making the Best Use of AI

Government agencies can’t turn their backs on AI. The technology offers too many benefits to stop using it. However, leaders must be aware that expanding AI also opens them up to greater threats. It’s also critical to be alert to the many dangers posed by AI-enabled cyberattacks.

The first step? Inform yourself about how AI can impact your agency. To get started, learn about AI integration into GRC today.

The Process-Oriented View: CISO Visibility During an OT Attack

Posted on by Michael G. "Schu" Schumacher

When a cyber incident occurs in an operational technology (OT) environment, understanding what is actually happening can become difficult. Control systems may continue to display normal readings even if attackers have begun manipulating logic or feedback within Programmable Logic Controllers (PLCs) or Human-Machine Interfaces (HMIs). Operators see stable values while underlying conditions start to diverge from what is shown on screen.

If process data at the controller level is falsified, every connected monitoring and cybersecurity tool reflects the same false picture. At that point, the Chief Information Security Officer (CISO) and operations team lose reliable visibility into the physical process that underpins production and safety.

The choices that follow each carry risk:

Shutting down operations may prevent escalation but could also cause costly downtime if the intrusion is contained to the network.
Continuing to operate may expose critical assets to damage if the manipulation extends to the process layer.

A recent cyber event at Norway’s Risevatnet dam illustrates this limitation.
During the incident, operators lost visibility into parts of the control system, yet intrusion detection and monitoring tools reported no anomalies. The breach was discovered only when on-site personnel noticed irregular behavior in equipment operations.

This outcome speaks to a broader issue in OT cybersecurity. Network-based detection tools can confirm whether communication channels are functioning, but they cannot independently verify whether the process data itself is genuine. If attackers manipulate information within PLCs or HMIs, every connected dashboard, alarm and analytic layer reflects the same falsified values. In effect, the system becomes blind at the moment visibility is most needed.

The Risevatnet case shows how quickly a cybersecurity failure can become an operational one. When control room data appears normal, incident response slows and decisions depend on incomplete or misleading information. Without a way to validate what is happening at the physical process level, teams must rely on manual observation or external cues, a reactive approach that offers no real protection in complex or distributed environments.

SIGA’s SigaML², available through Carahsoft, addresses this visibility gap by providing an independent, out-of-band view of the industrial process. The system collects unfiltered electrical signals directly from field I/Os (data that cannot be spoofed or altered) and applies multi-level analytics across Purdue Levels 0–4 to detect anomalies and false-data injections in real time.

Its components work together to create an evidence-based view of the process:

SigaGuard sensors capture raw electrical data directly from equipment.
SigaGuardX software correlates Level 0-4 information to identify inconsistencies and possible manipulations.
S-PAS simulation tools allow cybersecurity and operations teams to rehearse attack scenarios and refine incident response playbooks.

These capabilities give CISOs and plant operators verifiable insight during an active incident, helping determine whether an event is operational or cyber in nature and guiding containment or recovery actions.

Regulatory frameworks including Network and Information Security Directive 2 (NIS2), Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) and the latest National Institute of Standards and Technology (NIST) guidance highlight the importance of process-level monitoring and validation.

As oversight expands, CISOs and plant operators are expected to provide verifiable evidence of what occurred during an event, more than network logs or alarms.
Meeting that requirement depends on having data sources that remain trustworthy even when control networks are compromised.

SigaML² provides that capability, giving security and operations teams a direct, unaltered view of the physical process when clarity matters most.

Explore how SIGA’s cyber-physical security solutions empower CISOs with greater visibility during OT attacks. Visit Carahsoft’s SIGA solutions page to discover how your agency can enhance its infrastructure resilience.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SIGA, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

From Compliance to Capability: Key Insights from CS5 CMMC Global Conference 2025

Posted on by Alex Whitworth

The CS5 CMMC Global Conference 2025, the official conference of The Cyber AB, brought together more than 1,000 senior leaders from the Department of War (DOW), the Cyber AB, Federal agencies and the broader Defense Industrial Base (DIB) in Washington, D.C. The conference served as the essential gathering for defense contractors and DIB suppliers to chart the next phase of Cybersecurity Maturity Model Certification (CMMC) implementation, cyber resilience and supply chain security. Speakers explored key themes, including:

CMMC’s Next Phase: Turning Compliance into Capability and Defending the Digital Nation
AI-Driven Compliance
Driving Operational Excellence through Documentation
Combat Readiness: Scaling Across the Defense Ecosystem
Strengthening Supply Chain Resilience

CMMC’s Next Phase

Turning Compliance into Capability

CMMC’s next phase represents precision in action and marks a national shift from policy compliance to operational defense. The United States now views information security as a foundational element of national defense. Safeguarding Controlled Unclassified Information (CUI), whether technical information, operational intelligence or logistical data, is inseparable from mission readiness and warfighter support. The DIB now operates as the digital frontline of national security, where compliance is no longer optional but an essential layer of protection.

Defending the Digital Nation

Contractors demonstrate that they not only meet Federal requirements but also actively share the responsibility of defending the nation’s digital infrastructure. CMMC represents both a compliance framework and a patriotic commitment to protecting critical information, ensuring that data remains secure in an era where proximity to the battlefield no longer determines risk.

AI-Driven Compliance

Artificial Intelligence is transforming the CMMC landscape by acting as a force multiplier for speed, accuracy and operational efficiency. Across the Defense Industrial Base, AI-enabled tools are drafting policies, tagging evidence, detecting anomalies and summarizing documentation that once required extensive manual effort. Large language models (LLMs) can rapidly produce preliminary content that validates cybersecurity readiness and synthesizes complex data, enabling DIB contractors to prepare security readiness at scale. Speakers emphasized the need for human oversight to ensure that AI-generated output is validated and aligned with compliance integrity, as automation without governance creates new vulnerabilities. In practice, organizations should leverage AI to enhance efficiency and maintain traceable audit trails, while reserving decision-making, evidence validation and risk assessment for qualified staff.

When implemented responsibly, AI enables a balanced model of collaboration between human expertise and machine efficiency, accelerating readiness without compromising accountability or security.

Driving Operational Excellence through Documentation

Governance, Risk and Compliance (GRC) platforms serve as key accelerators by automating version controls, maintaining audit trails, centralizing repositories and linking policies directly to evidence. Updating documentation frequently ensures team alignment and simplifies compliance upkeep as levels role out and evaluations are conducted. Embedding documentation into corporate culture ensures long-term sustainability and empowers teams to focus on meaningful security efforts rather than reactive updates.

Best Practices:

Automate version controls and standardizes templates to ensure consistency
Use GRC systems to consolidate documentation and eliminate silos
Treat documentation as continuous validation: write it, organize it and prove it
Integrate compliance reviews into routine workflows to sustain readiness and confidence

Combat Readiness: Scaling Across the Defense Ecosystem

The official enforcement of Title 48 of the Code of Federal Regulations on November 10, 2025, will operationalize CMMC as a mandatory requirement for Federal contracts, transforming cybersecurity from a best practice into an enforceable procurement standard across the DIB.

As CMMC Phase 1 begins, compliance must be achievable and affordable, particularly for small and mid-sized contractors that anchor the defense supply chain. Organizations should use this time to budget to train and develop strategies for compliance, leveraging hyperscalers and automation to accelerate readiness. Speakers emphasized that scalable readiness, supported by harmonized frameworks and the reduction of overlapping requirements, is critical to sustaining momentum toward full certification.

Early preparation is essential, as a limited number of assessors may create scheduling delays once enforcement expands. Companies that act now by documenting, training and aligning their operations with Federal standards will not only meet compliance expectations but also reinforce their resilience, competitiveness and commitment to securing the nation’s defense ecosystem.

Strengthening Supply Chain Resilience

High-profile cyber intrusions reaffirmed a simple truth: supply chain security is the foundation of national security. Every organization must know what it protects, how it protects it and how that protection is verified through certification. Compliance is no longer just a cost of doing business; it is both a competitive advantage and a national defense imperative. Contractors should prepare their teams to understand eligibility requirements, strengthen internal controls and treat certification as an investment in long-term success. By embedding compliance into corporate culture and operational workflows, companies not only safeguard data but also enhance brand credibility, reduce systemic risk and ensure continuity of operations across the DIB.

Each contractor that fortifies its cyber posture strengthens the resilience of the entire supply chain because securing the DIB is securing the nation.

How Carahsoft Can Help

Whether your organization is preparing for its first CMMC assessment or advancing its cybersecurity maturity, there are continuous opportunities to strengthen readiness and collaboration across the Defense Industrial Base.

Explore CMMC Resources

Visit Carahsoft’s CMMC page to access compliance guides, vendor solutions and educational content designed to support Defense Industrial Base organizations at every maturity level. From understanding capability domains to preparing for assessments, our resources help organizations make informed decisions throughout their CMMC journey.

Download our comprehensive Cybersecurity Maturity Model Certification Framework Guide to understand the requirements, assessment processes and best practices for achieving CMMC compliance across all maturity levels.

Connect with CMMC Experts

Gaining CMMC compliance can be a complex and time-consuming process, but Carahsoft can guide your organization through every stage. Partnered with more than 200 cybersecurity vendors, Carahsoft connects DIB organizations with the right technologies, service providers and experts to address every maturity level and capability domain.

Contact the Carahsoft Team at (888) 662-2724 or CMMC@carahsoft.com to discuss your organization’s specific compliance needs and discover tailored solutions from our network of cybersecurity partners.

Attend Upcoming CMMC Events

Stay informed on the latest CMMC developments through Carahsoft-hosted workshops, webinars and training sessions. Through our network of partners, policy insights and educational events, Carahsoft helps organizations advance their cybersecurity maturity and meet evolving compliance requirements. Register to receive updates on upcoming CMMC-focused events and training opportunities.

Building the Future of Higher Education Through Strategic Partnerships

Posted on by Tim Boltz

After more than 20 years of simplifying and facilitating technology procurement for higher education institutions, Carahsoft has developed a unique perspective: the greatest opportunities for innovation emerge when technology providers and campus leaders work together strategically, not just transactionally. Today’s most successful higher education IT initiatives share a common thread — they’re built on partnerships that align institutional needs with provider capabilities from the start.

This collaborative approach is transforming how campuses modernize infrastructure, strengthen cybersecurity and enable research excellence. Here’s what we’ve learned about building partnerships that deliver measurable results.

Understanding the Higher Education Technology Landscape

Campus CIOs are leading one of the most exciting periods of transformation in higher education history. The integration of Artificial Intelligence, machine learning and advanced analytics is opening new possibilities for research, student success and operational efficiency. At the same time, institutions are successfully navigating budget optimization, evolving institutional priorities and the ongoing need to strengthen cybersecurity posture.

From our vantage point as a Public Sector distributor working with hundreds of technology providers, resellers, implementation partners and thousands of institutions, we see tremendous momentum. Campuses are successfully deploying innovative solutions. Providers are developing platforms specifically designed for the unique needs of higher education. The opportunity now is to accelerate this progress through stronger collaboration and shared service.

What Campus Leaders Need to Succeed:

The most effective technology investments share common characteristics. They align with institutional strategy while delivering quick return on investment. They address current staffing realities rather than requiring extensive internal expertise. They integrate seamlessly with existing systems and workflows. Most importantly, they come with implementation support that helps institutions realize value quickly.

What Technology Providers Understand:

Leading providers recognize that higher education is a diverse marketplace with unique needs across institutions. A comprehensive research university has different needs than a liberal arts college or community college system. Successful vendors tailor their offerings to match institutional capacity which provides modular implementations that can scale over time as budgets and expertise grow.

Carahsoft’s Unique Position in Higher Education Technology

Our role as The Trusted Education IT Solutions Provider® and a Public Sector distributor gives us a distinctive perspective that benefits both institutions and providers. We facilitate numerous higher education technology transactions annually through cooperative contracts like OMNIA Partners, NASPO ValuePoint, The Quilt, E&I Cooperative Services and Internet2. This position allows us to see patterns and opportunities that emerge across the entire ecosystem.

View Carahsoft’s comprehensive suite of EdTech Contracts.

Operational Intelligence That Drives Better Outcomes:

Through more than two decades of higher education partnerships, we’ve developed deep knowledge of what drives successful technology adoption. We understand which contract vehicles institutions prefer and why. We know which implementation approaches deliver the fastest time-to-value. We’ve seen which vendor partnerships create the most sustainable long-term relationships.

This intelligence allows us to facilitate introductions and partnerships with a high probability of success. When a campus CIO describes their modernization goals, we can connect them with providers who have delivered similar outcomes for comparable institutions or state systems. When a technology provider wants to expand in higher education, we can share insights about institutional priorities, procurement preferences and implementation best practices.

Portfolio Breadth Enables Better Solutions:

Carahsoft’s portfolio spans Cybersecurity, Artificial Intelligence, MultiCloud, DevSecOps, analytics, identity management and more. This breadth enables us to help institutions build integrated solutions rather than purchasing point products. We can facilitate “Better Together” approaches where complementary technologies from multiple vendors create more comprehensive capabilities.

Accelerating Success Through Strategic Collaboration

Streamlined Procurement Accelerates Deployment:

Higher education institutions can access pre-negotiated pricing and state specific terms through cooperative contracts, satisfying lengthy RFP requirements and negotiations with vendors. This allows IT teams to focus resources on implementation and adoption rather than procurement administration.

Learn more about Carahsoft’s education contract vehicles and how they simplify procurement for your institution.

Implementation Support Addresses Resource Constraints:

Through Carahsoft’s reseller network, institutions can access partners who specialize in higher education deployments. These partners offer managed services, implementation support and ongoing optimization that address staffing challenges. This allows campuses to deploy more sophisticated solutions than internal resources alone would permit.

The Path Forward: Partnership as Strategy

As the higher education technology landscape continues to evolve, the institutions and providers that thrive will be those who embrace strategic partnership as a core operating principle. For campus leaders, this means viewing technology procurement not as a transaction but as relationship-building. For technology providers, this means investing in deep understanding of higher education operations, budget cycles and institutional priorities.

Carahsoft and our reseller partner are committed to facilitating these strategic partnerships. Our team of higher education specialists brings decades of combined experience in both campus IT operations and technology provider relationships. Together, we can ensure that every institution has access to innovative solutions that enable research excellence, student success and operational efficiency.

Ready to explore strategic technology partnerships for your institution? Contact Carahsoft’s higher education team to discuss your modernization goals and discover solutions tailored to your needs.

Technology providers seeking to expand in higher education? Connect with our team to learn how Carahsoft can accelerate your growth through strategic partnerships and streamlined procurement.

Top 5 Insights from IACP Annual 2025

Posted on by George Vit

The 2025 International Association of Chiefs of Police (IACP) Annual conference served as a premier gathering for law enforcement and partners to share the latest in technology and industry solutions.

Carahsoft and its partners attended to connect on the latest in law enforcement technology.

Five key themes stood out throughout the sessions: 

1. AI-Assisted Investigations

In the session “The AI-Powered Investigator: Surfacing Insights in Law Enforcement,” speaker Jeremy Peterson presented on leveraging artificial intelligence (AI) to enhance law enforcement investigations while maintaining compliance and auditability. While AI offers tremendous potential for supercharging investigations, its function as a “black box” means it lacks the transparency required in regulated environments. With the use of multiple specialized AI agents, law enforcement can utilize guardrails and clear audit trails for working within structured workflows, rather than relying on a single generic AI. In one case study, Special Agent Isabella Rossi investigated a multi-state burglary operation, where AI identified connections between stolen crypto-mining hardware and a warehouse fire, helped draft legal documents like subpoenas and generated lookout alerts. Solutions from industry innovators such as Veritone and Tranquility AI are already helping agencies put these concepts into practice, offering AI-powered tools that enable law enforcement agencies to rapidly analyze data and tailor solutions to their specific workflows, expediting investigation processes.

2. Protecting Officers Through Drones

In the panel “Don’t Let Them Go in Blind: Evolving Drones as First Responders to Protect Every Patrol Officer,” speakers discussed the role of comprehensive Drones as First Responders (DFR) for law enforcement. DFR designed with public safety in mind effectively address critical challenges in the field, including staffing shortages, response times and officer safety. Outdoor DFR systems, which are currently operational across multiple jurisdictions with multiple docks per city responding to thousands of monthly calls, have demonstrated the ability to arrive on scene in under two minutes, reduce crime through rapid visual documentation, decrease use of force incidents and clear 20-40% of calls without officer dispatch. New indoor drones address the situational awareness gap that occurs when officers enter buildings, providing capabilities for confined space navigation, perching for up to three hours, two-way communication replacing traditional throw phones, 4K night vision and obstacle avoidance technology. They are all deployable within 30 seconds from a patrol vehicle. The new technology offers remote piloting, freeing officers to focus on incident command rather than drone operation.

3. Instant Translation with AI Services

At the panel “Enhancing Emergency Communications with an End-to-End AI Assistive Platform,” speaker Brad Flanagan, Prepared’s Public Safety Answering Point (PSAP) Ambassador, discussed how AI-powered platforms are improving the efficiency of for 911 emergency call centers by providing comprehensive support and incident resolution. Translation-based AI systems, such as those created by Prepared and Hyper, offer real-time language interpretation in over 240 languages through text, automatic transcription and AI agent conferencing, significantly reducing wait times for interpreters and improving emergency response, including instances where cardiac arrests and domestic violence situations were handled more effectively. The platform consolidates multiple location verification systems into a single interface, reducing address errors from six per month to a timeframe of six months, despite having less experienced staff. AI translators enable rapid incident review and reporting by automatically organizing call recordings, radio traffic and transcripts, reducing review time. The current system includes AI-assisted call triage during high-volume situations, post-call performance analysis within two minutes, live guidance for call-takers on protocol-specific questions and training simulations for staff development. AI platforms provide field responders and administrators with real-time data insights and analytics to improve emergency response quality and efficiency.

4. Cybersecurity in the Modern Age

During the session “Cyber Threats to Critical Communications Systems,” speaker Travis Randall discussed the evolving cybersecurity threats that Public Safety organizations face. Agencies are increasingly vulnerable due to their combination of sensitive data and critical high-availability systems, such as dispatch, 911 and radio networks. The primary threat is ransomware groups, who often operate through a sophisticated criminal ecosystem of developers, affiliates and access brokers, conducting attacks at scale that have significantly disrupted emergency communications. Randall details how these attacks typically exploit valid credentials, unpatched vulnerabilities, misconfigured VPNs and weak access controls to compromise networks, often using legitimate system tools rather than obvious malware to evade detection. To stay on top of ransomware groups, agencies must employ essential defensive measures like offline backups, multi-factor authentication, privilege management, vulnerability patching and continuous network monitoring.

5. Improving Awareness with Real-Time Crime Centers

In the session “Real-Time Crime Centers: A Real Possibility for Small and Midsize Agencies,” speakers Chris Henningsen, President at the National Real Time Crime Center Association, and Chris Settle, Police Chief of Culpeper Police Department, discussed the operation of real-time crime centers. The speakers emphasize that real-time centers serve as technology hubs providing situational awareness and acting as force multipliers during staffing shortages, are attainable for agencies of all sizes. Centers can start small with minimal resources, such as a computer, radio and analyst, and scale over time based on demonstrated successes and measurable outcomes. Key components include integrating existing resources like traffic cameras, body-worn cameras, license plate readers, drones and community partner camera feeds to provide officers with critical information before arriving at scenes, often achieving response times of seconds rather than minutes.

Some of the benefits include that real-time crime centers can:

Reduce investigation time with camera networks and LPR technology

Enhance recruitment and retention by demonstrating technological investment and officer safety support

Enables officers to connect with back-up support, who can view footage and provide aid in real-time

Henningsen and Settle stress that effective implementation requires cross-training staff, tracking progress through data analytics and continuously pursuing partnerships with technology vendors, such as Flock Safety, to share resources and best practices.

Maintaining pace with the evolving technology landscape ensures that law enforcement and confidential data remains protected. Through AI, real-time crime centers, drones and ransomware protection, law enforcement remains committed to protecting civilians.

Missed IACP Annual? Attend Carahsoft’s 2026 law enforcement innovation summit to learn more about the latest technology and solutions in law enforcement.

Securing Government AI: Why Federal Agencies Need a Trust Layer for Accountable, Compliant Deployment

Posted on by Seema Khinda Johnson

Federal agencies must deploy AI fast – but safely. The White House’s Executive Order, new OMB guidance requiring Chief AI Officers, and citizen expectations are driving rapid adoption. More than 1,700 AI use cases are already live across Government, doubling in just one year.

The challenge? Traditional security can’t keep up with AI systems operating at machine speed and scale. Federal agencies need Zero Trust architecture built specifically for AI agents, not retrofitted legacy systems. The recent addition of Nuggets’ Trust Layer solutions to the GSA Schedule provides exactly that foundation.

The Zero Trust Imperative for Government AI

Here’s the reality: AI agents make thousands of decisions per second across multiple systems. Without Zero Trust verification, agencies can’t prove who authorized what action, when or with which data.

The core challenges are clear:

Speed vs oversight: AI operates faster than current security can verify
Scale: Thousands of simultaneous agent interactions with no unified oversight
Accountability gaps: No audit trails for autonomous decisions in black-box systems
Compliance blind spots: NIST IAL2/IAL3 standards weren’t designed for autonomous AI
Sophisticated threats: AI-powered spoofing attacks that overwhelm legacy defenses

Federal agencies face intense pressure to adopt AI, but risks around bias, privacy, accountability and public trust threaten safe deployment. The gap between what agencies must deliver–secure, transparent, compliant services—and what legacy systems can support continues to widen.

Why Legacy Solutions Can’t Keep Up

Traditional identity systems were built for humans, not AI agents. While protocols like Agent-to-Agent (A2A) and Model Context Protocol (MCP) enable coordination between agents and tools, they don’t verify trust, intent or authorization, especially when handling sensitive Government data.

Point solutions create security silos and compliance blind spots. Legacy frameworks simply don’t account for autonomous decision-making, leaving agencies without proof of who or what acted, when and with proper authorization. Without this foundation, compliance and accountability are left to chance.

The Trust Layer Solution: Zero Trust for AI

Nuggets provides purpose-built Zero Trust architecture for agentic AI. Recognized by Gartner as a leader in decentralized identity, our trust layer embeds verification into every AI interaction, no matter the agent, system or data involved.

The comprehensive architecture creates compliance by design through three core capabilities:

Verifiable Identity: Cryptographically verified identity for every human, organization and AI agent that works across all platforms, contexts, devices and systems.

Complete Audit Trails: Every AI decision creates tamper-proof records with consent receipts and authorization proofs that meet Federal accountability requirements.

Standards Compliance: Built-in adherence to NIST IAL2/IAL3, AAL2 and UK Digital Identity Trust Framework requirements, ensuring agencies can deploy AI while meeting stringent security standards.

The result: a Zero Trust foundation on which agencies can deploy autonomous AI systems with confidence that every action is verified, compliant and auditable. This will enable both rapid innovation and Government accountability.

Real Impact: Government AI That Works

For Government IT leaders, the practical outcomes are substantial and measurable. Agencies using Nuggets’ trust layer achieve:

Operational Confidence: AI agents operate autonomously while maintaining security standards, delivering efficiency without sacrificing oversight.

Compliance Assurance: Built-in adherence to Federal identity verification requirements eliminates compliance guesswork.

Mission Success: Complete audit trails for all AI interactions and decisions ensure accountability while preventing unauthorized actions that could compromise sensitive operations.

Real-world use cases demonstrate the impact: automated document processing across agencies with complete audit trails, AI-driven eligibility checks and fraud detection that withstand regulatory scrutiny, secure inter-agency data sharing with verified agent identities and AI-powered citizen services that maintain privacy while delivering efficiency.

Each deployment proves that agencies can achieve both AI innovation and Government accountability, systems that are trusted by regulators, citizens and the mission itself.

The GSA Schedule Advantage

Procurement complexity often slows Government adoption of new technologies, but Nuggets eliminates these barriers. The solution is available through multiple pre-vetted contract vehicles, including GSA Schedule No. 47QSWA18D008F, SEWP V contracts, ITES-SW2, NASPO ValuePoint, OMNIA Partners and E&I Contract.

This means agencies can move from evaluation to deployment quickly, leveraging Carahsoft’s established Government relationships and support infrastructure. No lengthy procurement delays, no security gaps, no compliance questions.

Ready for Trusted AI Deployment?

As agencies expand AI capabilities, traditional security cannot keep pace with the speed, scale and complexity of autonomous systems. Purpose-built Zero Trust infrastructure is essential for agencies that must balance innovation mandates with compliance requirements and public accountability.

See how Federal agencies are deploying AI that’s secure, compliant, transparent and trusted. Schedule a personalized demo to explore how Nuggets’ Trust Layer can secure your agency’s AI deployment with the accountability that Government operations require.

Deploy AI that’s trusted by regulators, citizens and your mission. Contact Carahsoft at (844) 214-4790 or Nuggets@carahsoft.com. Learn more at www.carahsoft.com/nuggets.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Nuggets, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Enabling Rapid Compliance with Sysfleet’s RPA Tools

Posted on by Sam Timothy

As technology evolves, Government agencies seek to modernize effectively, securely and efficiently. By utilizing Sysfleet’s RPA tools, agencies can reach compliance, automate workflows, embed data loss prevention and promote solution-based, application life-cycle models.

The Power of RPA

Robotic Process Automation (RPA) tools refer to automation software that performs repetitive, rule-based tasks. In Government agencies, increasing efficiency is a primary concern, as it enables agencies to deliver solutions in a timely fashion.

There are three main benefits to RPA tools. RPA tools:

Shorten the life cycle of requests
Eradicate human error by automating menial tasks
Improve security by detecting anomalies

Traditionally, Government struggles with high-risk projects; projects require an investment of time to gain approvals, and market monopolies result in high premiums. RPA enables Government to shorten the life cycle of projects, which reduces costs and expedites delivery time.

With the added capabilities of artificial intelligence (AI) and machine learning (ML), RPA tools can replace old-school application program interfaces (APIs) development, which can be draining and slow. Through hyper-automation, RPA enables users to carry out operations swiftly.

Meeting Government Needs with RPA

Before onboarding new technology like RPA tools, the Government expects certain inherited features, such as web content, accessibility controls, guidelines and FedRAMP certification. Sysfleet Consulting LLC, a technology solutions company that simplifies business processes, automates workflows and improves efficiency through system integration, is equipped to address the unique needs of Government agencies and enterprises.

Sysfleet helps Government agencies and enterprises gain compliance and audit readiness with its RPA solutions. Sysfleet’s RPA solutions have a unique focus on compliance automation. By transforming manual workflows into controlled, automated processes, Sysfleet embeds audit readiness and data security directly into agency workflow. Additionally, Sysfleet’s RPA tools can modernize with existing legacy systems without disrupting ongoing operations, cutting down on modernization costs. Sysfleet has delivered measurable results, enabling agencies to cut down on processing time by 30-70%, saving hundreds of labor hours quarterly.

Products to Enable Rapid Compliance

As an official Microsoft partner, Sysfleet utilizes applications such as Power Automate, UiPath and Blue Prism Automation to help customers automate repetitive tasks. Through the Power Platform’s Center of Excellence (CoE), a Microsoft product that enables data loss prevention, Sysfleet automatically captures data, enabling users to follow and trace data trails. Additionally, Power Platform maps to National Institute of Standards and Technology (NIST) and Federal Regulation section 508, and can operate within existing Government cloud boundaries and other external systems.

Benefits of the RPA-Enabled Automation

Sysfleet improves operational performance through automation. Traditionally, State Government approvals take years, draining time and resources. With Sysfleet’s RPA tools, agencies can shorten internal approval time by 55%, gaining a return of investment within just six months. The tools automate safely and are easy to scale to existing applications. Additionally, Sysfleet’s RPA tool can expedite long manual processes that traditionally contain human errors due to their complexity.

Carahsoft and Sysfleet

Through strategic partnerships, Sysfleet ensures secure, scalable, future-ready solutions. Sysfleet has proven leadership in Government automation projects, delivering measurable results in mission-critical workflows. By partnering with Carahsoft, Sysfleet is further empowered to support the Public Sector. Carahsoft enables Sysfleet to reach Government customers nation-wide, to help agencies expedite the procurement process, scale and reach marketing and offer solution bundling.

Learn how agencies can accelerate modernization and embed security into every workflow.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Sysfleet, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Why CMDBs Alone Aren’t Enough for Effective Asset Management

Posted on by Raymond Purdy

Federal agencies rely on Configuration Management Databases (CMDBs) to track and manage their assets. But here’s the challenge: CMDBs depend entirely on the data that gets fed into them.

When discovery tools miss devices, when multiple tools report the same device but with different details, when manual processes slow down or when new virtual environments spin up outside of standard procedures, those assets are either invisible or in conflict in your CMDB.

IT and security teams are forced to turn to manual processes to prevent duplicate or inaccurate CMDB records and update missed asset changes. Yet even then, the system inevitably lags behind the reality of the assets in Federal environments.

As a result, your inventory becomes incomplete or outdated and creates real risks, from failed audits to unaddressed vulnerabilities to disruptions in critical business operations.

Your Federal team faces a difficult choice. You can spend significant time and resources continually auditing the CMDB, manually joining data from disparate tools to seek out the truth. Or you can accept the risk that comes with low-quality, “dirty” data. Neither option is ideal when you are accountable for meeting Federal security requirements.

Fortunately, there’s a third, and much better option.

How to complement a CMDB with automated, actionable asset intelligence

To get a full picture of your asset landscape, you need to architect your asset data framework so that it continuously updates both itself and your CMDB. This is where the Axonius Asset Cloud platform comes in.

The Axonius Asset Cloud is an actionability platform that addresses the common gaps in CMDBs by automating asset discovery and inventory across the entire IT and security footprint. You get an always-current, comprehensive and accurate inventory of your entire asset ecosystem. Axonius also looks for potential policy violations and helps administrative and security teams in prioritizing configuration and vulnerability response efforts.

The Axonius Asset Cloud natively provides more than 1,200 adapters that connect to and integrate with commonly deployed security and IT tools, including 27 CMDB platforms. These adapters continuously collect information on 40+ types of assets across IT and security, including devices, users, software, vulnerabilities and configurations.

Axonius turns raw, noisy and overlapping data into a complete, accurate and always up-to-date model of your entire environment through the Axonius Asset Intelligence pipeline. The bar we set for the information Axonius serves is decision-grade output. Each stage in this intelligence pipeline solves a specific class of data engineering problems that static inventories, vulnerability scanners, SIEMs and CMDBs struggle to optimize on their own.

After building this normalized and correlated view of the assets and risks in your environment, Axonius then compares them to what’s in your agency’s CMDB, deletes unwanted or redundant tools from the list and adds any missing assets or metadata to your inventory. You can finally trade hours of data cleanup for decisive moves that secure your systems.

*Uncover assets not tracked in your CMDB*

Security operations teams benefit from the Axonius Asset Cloud as well. The platform can automatically create remediation tickets whenever it discovers a vulnerability. Operations teams can be alerted immediately and prioritize their response to the tickets based on severity or urgency, confident that they have a clear and complete picture of affected systems, users and devices.

Post-incident, the same reports in the Axonius Asset Cloud give teams confidence that the incident has been fully resolved by confirming that affected systems, applications or user accounts have been successfully and completely remediated.

Supercharging your CMDB with Axonius accomplishes multiple objectives:

Your agency gains a real-time, comprehensive view of all its assets, maximizing your CMDB investment and empowering both IT and Security operations.
You can instantly identify rogue or non-compliant assets and respond to ticket requests within a day.
You can uncover unused or legacy assets that are costing your agency money or putting it at risk.
You significantly reduce manual CMDB upkeep and free up hours for higher-impact work.

*Spot conflicting details or missing attributes*

Axonius in action: How the platform works with ServiceNow

Let’s take a look at how this works using the ServiceNow CMDB as an example. First, select the configuration items (assets) you want to ingest into ServiceNow. Axonius imports the selected data into ServiceNow via APIs. This allows you to query, visualize and take action on all of the CMDB data imported into the system.

From there, the platform goes to work, scanning assets, creating tickets, updating inventory and removing assets that should not be in the CMDB, all in real-time. You can then generate reports that highlight vulnerability gaps and items that require correction.

*Axonius complements CMDBs, such as ServiceNow, by highlighting asset trends and identifying missing devices and fields.*

You can use the combination of Axonius and ServiceNow, or other CMDBs, to ensure compliance with FISMA, CISA BOD 23-01 and other relevant standards. The Axonius Asset Cloud platform can pull compliance data from ServiceNow, eliminating the need for manual compliance tracking through the CMDB.

Want to see Axonius in action? Here’s a quick demo by James Flores showing how Axonius improves CMDB coverage.

Leveling up your CMDB

In a time when Government efficiency is under the microscope, agencies need more than a CMDB alone to manage their assets effectively. While CMDBs are valuable for tracking configurations and relationships, relying on them as the sole source of asset information can be time-consuming, impractical and potentially inaccurate. This leads to significant lost hours, unnecessary costs and damaging security vulnerabilities.

The best option—the only option, really—is to complement your CMDB with a solution that gives you instant visibility into its coverage.

The Axonius Asset Cloud allows you to identify gaps, track trends, update CIs and asset data in the CMDB and power incident response teams. It levels up your CMDB to save time, money and your organization from potentially serious security risks.

Learn more at https://www.axonius.com/federal-systems.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Axonius we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Cloud Security: Complex Threats, Clear Solutions

Posted on by Candace Thorson

Cloud technology, for many years, enticed agencies looking for savings and efficiencies. Organizations pursued “cloud-first” policies that migrated data and applications away from onsite infrastructure and into the control, at least in part, of cloud service providers. While the cloud offered promising advantages, some agencies encountered unexpected cost challenges along the way. And lately, malicious actors have gotten exceptionally good at exploiting cloud vulnerabilities.

There isn’t one way to secure your cloud platform, unfortunately. You need a holistic, Zero Trust approach that combines security controls with cyber policies and procedures. Strong encryption and access rules, automated updates, clear visibility and detailed incident response plans are all critical. Knowing who’s responsible for what should go without saying. And repatriating data — bringing it back on premises, for example — is often a commonsense answer.

“Agencies have to comply with stringent regulations … so that means they need a really robust [security] framework, all while managing the complexities of the cloud environment,” said Garrett Lee, Regional Vice President for Public Sector in Broadcom’s Enterprise Security Group. “Cloud, you know, solves some problems, but it also creates some others.” 

In this video interview, Lee explores both the opportunities that cloud computing offers and how to confront its security challenges. Topics include: 

What a holistic approach to cloud security entails
The cost and security drivers behind data repatriation, and why they matter
How to secure four critical domains: endpoints, data, the cloud and networks

Want to learn more cyber resilience strategies? Download Symantec, Carbon Black and Carahsoft’s guide to explore four critical cyber force multipliers that enhance agencies’ security posture amid growing threats and limited budgets.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Broadcom we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

This post originally appeared on GovLoop.com, and is re-published with permission