Kiteworks and A-LIGN Partner to Strengthen Cybersecurity Across the Defense Industrial Base

The Department of War suspended CMMC Phase II on July 13, 2026 and launched a 60-day review of the program, but the underlying responsibility has not changed: Phase I self-assessment requirements and DFARS 252.204-7012 obligations remain fully in force. The DoW has been explicit that it is reducing red tape, not cybersecurity expectations. Protecting the Controlled Unclassified Information handled by tens of thousands of DIB organizations remains essential to defending the supply chain against increasingly sophisticated threats.

The Kiteworks and A-LIGN partnership is built around a shared goal of helping DIB contractors protect that data, whether they are beginning to build out their data exchange controls or already in the assessment process and stalled on control gaps or evidence deficiencies. Organizations deploy the Kiteworks Control Plane to implement a substantial majority of CMMC Level 2 requirements out of the box, covering domains that commonly surface as evidence gaps in third-party assessments. Then, they can separately engage A-LIGN to independently assess that evidence through its rigorous assessment process. A-LIGN’s role in this partnership is limited to independent assessment: A-LIGN does not consult, remediate, or advise on control implementation, and DIB organizations remain free to engage any authorized or accredited C3PAO.

Kiteworks is FedRAMP High In Process and FedRAMP Moderate Authorized, [MG1] [TM2] with nine consecutive years of annual 3PAO audits validating 325 NIST 800-53 controls since 2017. [MB3] The platform is FIPS 140-3 validated and deploys as a hardened single-tenant virtual appliance, eliminating the CUI isolation failures that are among the most common reasons DIB organizations require remediation cycles before earning CMMC certification. In addition, Kiteworks supports Hold Your Own Key (HYOK) encryption, giving DIB customers full ownership of their cryptographic keys and reducing audit scope and third-party exposure.

“Protecting the DIB was never about a single deadline, but rather about building data security practices durable enough to hold up no matter how the compliance timeline evolves,” says Kurt Michael, Chief Revenue Officer, Kiteworks. “Kiteworks and A-LIGN share that same vision. Through our partnership, Kiteworks helps organizations put comprehensive controls at the data layer, and A-LIGN, a top C3PAO, brings the experience and rigor to help validate that work through independent assessment. Whether an organization is early in the process or already underway, Kiteworks helps them get the right controls in place so they can walk into the assessment room prepared.”

A-LIGN is one of the leading C3PAOs in the market and has conducted nearly 100 CMMC Level 2 assessments across DIB organizations of every size. The firm’s assessors cover the full scope of CMMC Level 2, including the governance, personnel, physical, and organizational controls. Beyond CMMC, A-LIGN is also one of the top three FedRAMP assessors, with a team of auditors with deep, firsthand familiarity with how federal agencies expect compliance evidence to be documented and defended.

“There’s some uncertainty right now about when, and in what form, CMMC’s third-party assessment requirements will return from the Department’s review, but the underlying requirements haven’t gone anywhere,” says Nicholas Ludy, Chief Growth Officer, A-LIGN. “The commitment to securing the DIB doesn’t hinge on any single implementation date. As CMMC requirements evolve, Kiteworks will keep giving DIB organizations a practical path to stronger data security and audit readiness, and A-LIGN will continue to deliver rigorous, independent assessments, so organizations are prepared whenever the certification timeline is finalized.”