Kiteworks, A-LIGN team up on CMMC readiness for defense contractors

Kiteworks and A-LIGN announced a partnership to help Defense Industrial Base organizations strengthen data security and prepare for CMMC 2.0 Level 2 certification. The deal comes as the Department of War reviews the program but existing self-assessment and DFARS requirements remain in effect.

Why it matters: - Defense Industrial Base contractors still have to protect Controlled Unclassified Information even as the CMMC timeline shifts. - The partnership aims to reduce remediation cycles, close evidence gaps and help organizations get ready for independent assessment. - Better CMMC readiness can lower audit friction for contractors handling sensitive defense data.

What happened: - Kiteworks announced a strategic partnership with A-LIGN on July 23, 2026. - The companies said the effort is designed to help Defense Industrial Base organizations strengthen cybersecurity and prepare for CMMC 2.0 Level 2 certification. - The announcement follows the Department of War’s July 13, 2026 suspension of CMMC Phase II and a 60-day review of the program. - Phase I self-assessment requirements and DFARS 252.204-7012 obligations remain in force.

The details: - Kiteworks said its Control Plane can implement a substantial majority of CMMC Level 2 requirements out of the box. - The platform is aimed at domains that often create evidence gaps in third-party assessments. - A-LIGN will provide independent assessment services through its CMMC Third Party Assessor Organization role. - A-LIGN will not consult, remediate or advise on control implementation under the partnership. - Defense Industrial Base organizations can still engage any authorized or accredited C3PAO. - Kiteworks is FedRAMP High In Process and FedRAMP Moderate Authorized. - Kiteworks said it has completed nine consecutive years of annual 3PAO audits, validating 325 NIST 800-53 controls since 2017. - The platform is FIPS 140-3 validated. - Kiteworks deploys as a hardened single-tenant virtual appliance. - Kiteworks supports Hold Your Own Key encryption, giving customers control of their cryptographic keys. - A-LIGN said it has conducted nearly 100 CMMC Level 2 assessments across Defense Industrial Base organizations of all sizes. - A-LIGN assessors cover governance, personnel, physical and organizational controls. - A-LIGN is also one of the top three FedRAMP assessors, with auditors experienced in federal compliance evidence requirements. - Kiteworks said it protects more than 100 million end users and thousands of global enterprises and government agencies. - A-LIGN said it serves more than 6,400 organizations worldwide and has completed more than 36,000 audits. - A-LIGN said it is the No. 1 issuer of SOC 2 reports and a top three FedRAMP assessor. - A-LIGN’s services cover SOC 2, ISO 27001, FedRAMP, CMMC, ISO 42001, PCI and HITRUST. - More information is available in A-LIGN’s announcement.

Between the lines: - The partnership pairs implementation support with independent assessment, which can help contractors move from controls design to evidence validation faster. - The timing suggests both companies expect CMMC enforcement and third-party assessments to remain central once the Department of War finishes its review. - Kiteworks is positioning its platform as a data-layer control stack for organizations that need fewer remediation passes before certification.

What's next: - DIB organizations will continue working toward CMMC 2.0 Level 2 readiness while the Department of War reviews the program. - A-LIGN said it will keep delivering independent assessments as certification timelines evolve. - Kiteworks said it will continue helping organizations build out controls and audit readiness ahead of any finalized certification schedule.

The bottom line: - The partnership is built for contractors that need both stronger data security and a clearer path through CMMC assessment, regardless of how quickly the certification timeline returns.