A firm founded by a former NASA chief information officer has launched a service targeting a problem that has cost defense contractors millions: companies aren't failing cybersecurity assessments because their technology is weak, but because they can't document what they've already implemented. Muse Technologies, led by Dr. Linda Cureton, who served as NASA's top IT official from 2009 to 2013, announced the readiness practice on October 28, 2026. The service focuses on mid-sized defense suppliers who must submit annual self-assessed security scores to the Pentagon's Supplier Performance Risk System.
The new practice draws on Muse's decade-long track record managing federal IT programs and more than a million federal case records under National Archives standards. Defense contractors handling controlled unclassified information face 110 security requirements detailed in NIST Special Publication 800-171, which assessors evaluate against 320 separate objectives through documentation, interviews, and testing. According to the announcement, the most frequent stumbling blocks aren't sophisticated: System Security Plans that still reference retired systems, controlled files stored on drives never mentioned in formal plans, posted scores that don't match documentation, and evidence that exists in daily operations but can't be retrieved when auditors ask.
"I spent my career on one question: can you prove it?" Dr. Cureton said in the announcement. "Defense contractors are being asked that question now, and most of them have answered it with a number rather than a file." The company positions its offering with a sharp division of labor: "Your IT provider runs the controls. We make them provable," treating cybersecurity compliance and records management as separate functions that most firms have only funded once.
The launch comes as enforcement pressure intensifies even while the Defense Department paused third-party certification under its Cybersecurity Maturity Model Certification program in July 2026 to review the initiative. Self-assessments, SPRS scores, and annual affirmations remain mandatory and enforceable. On September 1, 2026, Honeywell Aerospace agreed to pay over $2 million to settle False Claims Act allegations tied to failure to meet NIST SP 800-171 requirements on one network, the Justice Department announced. In June, Alabama contractor LOGZONE reached a settlement after government review found its self-reported perfect score of 110 should have been minus 170, though neither company admitted liability. The pattern suggests that proving compliance has become as critical as achieving it, with documentation gaps now carrying the same financial and legal risk as actual security failures.
For contractors navigating this environment, the ability to produce evidence on demand may determine whether their existing security investments translate into contract eligibility or costly settlements. Firms that assumed their IT vendors were handling the full compliance picture now face a reckoning where what can't be shown in an audit effectively doesn't exist, regardless of whether the controls themselves are running correctly.