DIB Cyber Cert Agenda 2026

Two days. Four modules. One comprehensive roadmap to DIB cyber compliance. Jump to:

09:00 Welcome and Introduction (P00a) TBA

Salon A

09:00 NIAP – CCEVS/PP Update (R00a) CSfC PMO Speaker TBA
The official U.S. scheme update: current NIAP/CCEVS priorities, Protection Profile (PP) roadmaps, what’s changing operationally for evaluations and maintenance, and what defense buyers should expect to see on the PCL over the next 12–18 months.

09:30 CC:2022 Transition & Mutual Recognition: What It Changes for DIB Product Roadmaps (R00b) TBA
A practical “what’s different now” briefing on CC:2022-era planning: how PP transitions and evolving mutual recognition expectations will impact product strategy, multi-market certification decisions, and schedule risk for DIB suppliers.

10:00 Lessons Learned from Recent Certifications: Reducing Rework in Scope, Evidence, and Crypto Dependencies (R00c) TBA
Case-study-driven guidance on what actually causes rework late in evaluations: mis-scoped TOE boundaries, evidence gaps, configuration drift, and crypto-validation dependencies—and how successful teams structure engineering and documentation to keep moving.

10:30 Mapping Common Criteria to CSfC, RMF, FedRAMP, and CMMC: How to Cut Duplicate Compliance Work (R00d) TBA
A crosswalk from CC deliverables (PP claims, Security Target assertions, evidence) to what integrators and authorizers need in CSfC and RMF packages—plus where FedRAMP and CMMC efforts can be leveraged instead of repeated.

11:30 Panel: Common Criteria in the DIB—What Buyers, Integrators, Vendors, and Labs Need to Fix Next (R01a) TBA
A candid, operational panel on the friction points everyone feels: PP scope realities, scheduling bottlenecks, sustaining certification in a high-CVE world, and what procurement, labs, and vendors can change that would measurably reduce cost and time without lowering assurance.

13:30 Cloud/SaaS Evaluations in Practice: FedRAMP Preconditions, Shared Responsibility, and Certification Drift (R02a) TBA
What changes when the TOE is a service: structuring SaaS/cloud architectures so evaluation is feasible, aligning with FedRAMP realities, and handling the hardest operational problem—continuous updates without losing the evaluated security posture.”

14:00 Vulnerability Handling & Assurance Continuity: Staying Certified While Patching Fast (R02b) TBA
Straight talk about CVEs in certified products: how vendors and labs handle “security-relevant” vulnerabilities, how to avoid certification derailment, and how to build patch workflows that satisfy customers, integrators, and scheme expectations.”

14:30 SBOM Under NIAP: What Evaluators Expect and How to Automate for Speed and Trust (R02c) TBA
SBOM as a certification input: what “good” looks like for NIAP submission and review, common failure modes, and how vendors can automate SBOM generation and dependency hygiene to shorten cycles and improve supply-chain visibility.”

15:00 CCUF and Technical Communities: How to Influence the Next Generation of Protection Profiles (R02d) TBA
How CCUF and iTC work actually drives PP direction—and how product developers, cloud providers, integrators, and labs can get ahead of new requirements in emerging domains (cloud-native architectures, virtualization, IoT/embedded).

16:00 Panel: The Future of Common Criteria—CC:2022 Rollout, Automation, PQ, and New Domains (R03a) TBA
A forward-looking strategy discussion focused on what will change next: CC:2022 transitions, evidence automation, SBOM/vulnerability-intelligence integration, and emerging technical domains (including PQ readiness and virtualization/cloud-native boundary problems).

09:00 Conference Welcome (P10a) Dominic Perez, CTO, Curtiss-Wright

09:10 CSfC PMO Introduction (P10b) John Dunker, Director CSfC PMO, National Security Agency (NSA)

11:00 CSfC PMO Program Updates and Process Improvements; Ask the PMO Panel (P11a) John Dunker, Director, CSfC Program Management Office, Panelists TBA

9:00 DIB Cloud Compliance Reality Check (CMMC + DFARS + FedRAMP Reuse) (R10a) TBA
A walkthrough of what “compliant cloud” means for DIB products in 2026: scoping boundaries, evidence expectations, typical failure modes, and how to avoid building a “compliance dead-end” architecture that can’t sustain CMMC + DoD + FedRAMP demands.

9:30 FedRAMP Modernization — What Changes for Product Teams and Compliance Ops (R10b) TBA
Operator impacts of OMB M‑24‑15: “presumption of adequacy,” reuse expectations, what evidence should become machine-readable, and how product teams should design release processes for continuous monitoring rather than episodic “ATO sprints.”

10:00 DoD Cloud SRG Impact Levels — Designing for IL4/IL5 and the Authorization Path (R10c) TBA
What IL4/IL5 mean for architecture and business strategy: where vendors blow it (connectivity constraints, identity boundary assumptions, multi-tenant risk), and how to align cloud-native design with the DoD cloud authorization process and SRG expectations.

10:30 Talk: DoD Zero Trust by FY27 — Vendor Requirements for Identity, Devices, Data, Telemetry (R10d) TBA
A vendor-focused translation of Zero Trust: what DIB product teams must support (identity signals, device posture, data tagging/controls, continuous telemetry), what “target level by FY27” implies for roadmaps, and how vendors can avoid building non-interoperable “one-off” ZT features.

11:30 Panel: One Evidence Story Across CMMC, DFARS 7012, FedRAMP, and DoD PA/ATO (R11a) TBA
A working session on the hard part: building a single, defensible authorization boundary and evidence narrative that satisfies overlapping frameworks without duplicative audits and rework. Expect concrete discussion of SSP boundaries, inherited controls, evidence automation, and what “continuous monitoring” means in the real world. 

13:30 Secure DevSecOps & cATO — Continuous Evidence, Pipelines, and “Factory-to-ATO” Tactics (R12a) TBA
How product teams prove security continuously: pipeline-based evidence, policy-as-code, artifact integrity, audit-ready logs, and how to keep speed without accumulating authorization debt. The talk should be explicit about what’s different for regulated buyers vs commercial “DevSecOps theater.”

14:00 Container/Kubernetes Security for Regulated Workloads — Hardening, Runtime Defense, and Isolation (R12b) TBA
A pragmatic guide to shipping container/K8s workloads that can survive regulated scrutiny: image provenance, admission control, runtime detection, least privilege, node hardening, and what breaks when you introduce multi-tenant/managed services into CUI environments.

14:30 Cloud & Software Supply Chain Risk — SBOM/Attestation at Scale and Third‑Party Reality (R12c) TBA
SBOM is not the finish line. This talk focuses on operationalizing SBOMs, signing/attestation, third-party dependency governance, and what the DIB should learn from incidents where the supply chain or a cloud dependency became the outage/root cause.

15:00 High-Assurance Protection — KMS/HSM, CMKs, Enclaves/TEE, and Confidential Computing (R12d) TBA
For DIB workloads, “encrypt at rest/in transit” is table stakes. This session focuses on key management patterns (CMKs, separation of duties, HSM integration), enclave/TEE value and limits, remote attestation, and when confidential computing materially changes risk in multi-tenant environments.

16:00 Panel: Mission Assurance — Resilience, Performance, Cost (FinOps), and Contracting Tradeoffs (R13a) TBA
A closing panel dedicated to the hard tradeoffs: controlling spend without breaking mission performance, designing resilience that survives dependency failures, and writing contracts/SLA language that can be monitored and enforced continuously (not just promised).