Kiteworks has announced a strategic partnership with A-LIGN, a Certified CMMC Third Party Assessor Organization (C3PAO), to help Defense Industrial Base (DIB) organizations strengthen their cybersecurity posture and prepare for CMMC 2.0 Level 2 certification.

The partnership comes after the Department of War suspended CMMC Phase II on July 13, 2026 and launched a 60-day review of the program. According to Kiteworks, Phase I self-assessment requirements and DFARS 252.204-7012 obligations remain in effect and protecting Controlled Unclassified Information (CUI) across the defense supply chain continues to be a priority.

Under the partnership, organizations can deploy the Kiteworks Control Plane to implement a substantial majority of CMMC Level 2 requirements out of the box, addressing domains that commonly result in evidence gaps during third-party assessments. Organizations can then separately engage A-LIGN to independently assess that evidence through its CMMC assessment process.

Kiteworks noted that A-LIGN's role is limited to independent assessments. The company does not provide consulting, remediation or implementation guidance and organizations remain free to work with any authorized or accredited C3PAO.

Kiteworks said its platform is FedRAMP High In Process and FedRAMP Moderate Authorized and has completed nine consecutive years of annual 3PAO audits validating 325 NIST 800-53 controls since 2017. The platform is also FIPS 140-3 validated and deploys as a hardened single-tenant virtual appliance. According to the company, the platform also supports Hold Your Own Key (HYOK) encryption, allowing customers to maintain ownership of their cryptographic keys.

"Protecting the DIB was never about a single deadline, but rather about building data security practices durable enough to hold up no matter how the compliance timeline evolves," said Kurt Michael, chief revenue officer at Kiteworks. "Kiteworks and A-LIGN share that same vision. Through our partnership, Kiteworks helps organizations put comprehensive controls at the data layer, and A-LIGN, a top C3PAO, brings the experience and rigor to help validate that work through independent assessment. Whether an organization is early in the process or already underway, Kiteworks helps them get the right controls in place so they can walk into the assessment room prepared."

According to the announcement, A-LIGN has conducted nearly 100 CMMC Level 2 assessments across DIB organizations of varying sizes. Its assessors evaluate the full scope of CMMC Level 2 requirements, including governance, personnel, physical and organizational controls. The company also ranks among the top three FedRAMP assessors and has experience documenting and defending compliance evidence for federal agencies.

"There's some uncertainty right now about when, and in what form, CMMC's third-party assessment requirements will return from the Department's review, but the underlying requirements haven't gone anywhere," said Nicholas Ludy, chief growth officer at A-LIGN. "The commitment to securing the DIB doesn't hinge on any single implementation date. As CMMC requirements evolve, Kiteworks will keep giving DIB organizations a practical path to stronger data security and audit readiness, and A-LIGN will continue to deliver rigorous, independent assessments, so organizations are prepared whenever the certification timeline is finalized."