RegScale earns CMMC Level 2 certification after A-LIGN review
3 companies named across 4 categories, one of 5 articles referencing RegScale. Previous coverage: Netskope, CISA, EU AI Act, and NSS Labs updates - Q3 2026 (Aug 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Chief Information Security Officer
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Decision stage
- Which to buy
- Adoption curve
- Early Majority
- Technology maturity
- Operational Expansion
- Industry
- Information Technology / Cybersecurity / Exposure, Risk & Governance / Governance, Risk & Compliance (GRC) & Security Ratings
Our classification, not the publisher's statement. Best suited for, not only for.
RegScale reported it achieved Cybersecurity Maturity Model Certification (CMMC) Level 2, a step aimed at verifying how its security environment handles Controlled Unclassified Information (CUI) within the U.S. defense supply chain. The company said the certification supports its readiness for U.S. Department of War (DoW) contracts and follow-on opportunities across the Defense Industrial Base (DIB).
CMMC Level 2 applies to organizations that handle CUI and requires meeting 110 security requirements aligned with NIST SP 800-171. An independent assessment by a Certified Third-Party Assessment Organization (C3PAO) is used to demonstrate effectiveness, according to the company’s description of the certification basis.
In RegScale’s case, the PR said an independent assessment by A-LIGN evaluated 320 NIST SP 800-171A Rev. 2 objectives. It reported that RegScale met 110 of 110 security requirements and 14 of 14 CMMC domains, and it listed zero POA&M items, stating that the posture was already found to be robust relative to the DoW requirements.
“A resilient security program should do more than simply pass an assessment,” said Dale Hoak, CISO of RegScale. “At RegScale, we’ve built a model that continuously proves our controls work, and the results speak to the value of that approach. When controls are continuously monitored, and evidence is generated from the pipeline through production, compliance becomes an outcome of operational excellence in cybersecurity versus an annual fire drill to pass an audit.” The company also described a compliance-as-code architecture used to centralize requirements, gather evidence, monitor controls, and provide auditors a view into its security posture.
Press release, provided by Globe Newswire on behalf of RegScale. Read the original.