Cybersecurity Awareness Month 2026: CISA’s four habits line up with CMMC

Checked on 8 October 2026.

What happened

On 1 October 2026 CISA (the Cybersecurity and Infrastructure Security Agency, the nation’s cyber defense agency) opened Cybersecurity Awareness Month. The theme for 2026 is “Securing the Next 250”. CISA asks businesses and government organizations that own, operate or support the country’s critical infrastructure to take a few core actions.

It named four practices as foundational, to be as automatic as buckling a seatbelt:

  1. Teach employees to avoid phishing scams.
  2. Require strong passwords.
  3. Require MFA (multi-factor authentication: a password plus a second check, such as a code on your phone).
  4. Update software.

Its next steps include keeping activity logs, backing up data, encrypting data, and having an incident response plan that you practice.

What it means for you

None of this is a new rule. For a defense contractor, each habit lines up with a CMMC (Cybersecurity Maturity Model Certification) requirement you may already be working on.

CISA’s habit What CISA suggests The CMMC requirement
Avoid phishing Teach people the red flags: urgent language, odd requests, strange links. Check a message by looking up the sender’s number yourself, never by using one in the message. Report it and delete it. Level 2: make managers, admins and staff aware of the security risks of their work and of your security rules (AT.L2-3.2.1)
Strong passwords At least 16 characters, random, and used for one account only. Give staff a password manager. Change default passwords before using new equipment. Level 2: set password rules and make your systems refuse new passwords that break them (IA.L2-3.5.7)
MFA Turn it on for email, file storage and remote access, admin accounts first. A security key is the strongest kind; a code sent by text or email is the weakest. Level 2: MFA for admin accounts, and for every account signing in over the network (IA.L2-3.5.3)
Update software Turn on automatic updates where you can. Replace equipment and software that no longer gets security updates. Levels 1 and 2: find, report and fix flaws in your systems within times you set (SI.L1-b.1.xii and SI.L2-3.14.1)

CISA’s 16 characters is its advice. At Level 2 you set your own password rules, write them down, and make your systems refuse new passwords that break them.

Level 1 does not ask for training or MFA. CISA suggests both for small businesses anyway. Three of CISA’s next steps are also Level 2 requirements: activity logs, a working way to handle incidents that you test, and encrypting CUI on phones and other mobile devices.

CISA also asks for cyber incidents to be reported to CISA. If your contract has the clause DFARS 252.204-7012 (DFARS: the Defense Federal Acquisition Regulation Supplement, the defense rules written into your contracts), that clause sets its own report for an incident affecting CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes) or the systems holding it. It goes to the Department of War (the new name of the Department of Defense) at dibnet.dod.mil, within 72 hours of discovery.

What to do now

  1. Ask your IT provider whether MFA is on for email, file storage and remote access. Start with admin accounts.
  2. Send your team a short note on phishing: the red flags, how to check a message, and who to tell.
  3. Ask your IT provider to confirm automatic updates are on, and to list anything that no longer gets security updates.
  4. Write down who calls whom if something goes wrong. If your contract has DFARS 252.204-7012, include the 72-hour report to the Department.

Sources