Guides and comparisons
Plain answers to the compliance questions teams search for: what changed, what still applies, and how the tools compare, with every source linked.
Guides
CMMC Phase 2 status: suspended. Here is what still applies.
November 10, 2026 is not a CMMC deadline. CMMC Phase 2, third-party (C3PAO) Level 2 certification, was suspended on July 13, 2026 and no new date has been announced. Phase 1 still applies: NIST SP 800-171 Rev 2 self-assessments, SPRS scores, annual affirmations and DFARS 252.204-7012.
READ →FedRAMP 20x explained: classes, KSIs and the 2027 dates.
FedRAMP 20x certifies cloud services against 46 Key Security Indicators (KSIs) that are validated by machine, not by a document review. Under the Consolidated Rules for 2026, certification Classes A to D replace Low, Moderate and High, the rules become mandatory on January 1, 2027, and FedRAMP stops accepting new Rev5 certifications on June 11, 2027.
READ →AWS Audit Manager alternatives, now that it is closed to new accounts
AWS Audit Manager stopped accepting new customers on April 30, 2026 and is in maintenance mode, with no new features or frameworks. The alternatives are AWS Config conformance packs, a compliance platform such as Vanta, Drata or Obsinto, or both together.
READ →Is AWS Security Hub enough for SOC 2?
No. AWS Security Hub finds technical misconfigurations, but it has no SOC 2 standard and AWS says its standards do not guarantee compliance. A SOC 2 audit also tests access reviews, change management, policies and evidence across the whole review period.
READ →