Partnership helps organizations protect sensitive data, strengthen cyber resilience, and prepare for evolving compliance requirements, including CMMC 2.0

San Mateo, California – (July 23, 2026) – Kiteworks, which empowers organizations to effectively manage risk in every send, share, receive, and use of private data, today announced a strategic partnership with A-LIGN, a leading CMMC Third Party Assessor Organization (C3PAO), to help Defense Industrial Base (DIB) organizations strengthen their cybersecurity posture and navigate the path to CMMC 2.0 Level 2 certification. 

The Department of War suspended CMMC Phase II on July 13, 2026 and launched a 60-day review of the program, but the underlying responsibility has not changed: Phase I self-assessment requirements and DFARS 252.204-7012 obligations remain fully in force. The DoW has been explicit that it is reducing red tape, not cybersecurity expectations. Protecting the Controlled Unclassified Information handled by tens of thousands of DIB organizations remains essential to defending the supply chain against increasingly sophisticated threats. 

The Kiteworks and A-LIGN partnership is built around a shared goal of helping DIB contractors protect that data, whether they are beginning to build out their data exchange controls or already in the assessment process and stalled on control gaps or evidence deficiencies. Organizations deploy the Kiteworks Control Plane to implement a substantial majority of CMMC Level 2 requirements out of the box, covering domains that commonly surface as evidence gaps in third-party assessments. Then, they can separately engage A-LIGN to independently assess that evidence through its rigorous assessment process. A-LIGN’s role in this partnership is limited to independent assessment: A-LIGN does not consult, remediate, or advise on control implementation, and DIB organizations remain free to engage any authorized or accredited C3PAO. 

Kiteworks is FedRAMP High In Process and FedRAMP Moderate Authorized, with nine consecutive years of annual 3PAO audits validating 325 NIST 800-53 controls since 2017. The platform is FIPS 140-3 validated and deploys as a hardened single-tenant virtual appliance, eliminating the CUI isolation failures that are among the most common reasons DIB organizations require remediation cycles before earning CMMC certification. In addition, Kiteworks supports Hold Your Own Key (HYOK) encryption, giving DIB customers full ownership of their cryptographic keys and reducing audit scope and third-party exposure. 

“Protecting the DIB was never about a single deadline, but rather about building data security practices durable enough to hold up no matter how the compliance timeline evolves,” said Kurt Michael, Chief Revenue Officer at Kiteworks. “Kiteworks and A-LIGN share that same vision. Through our partnership, Kiteworks helps organizations put comprehensive controls at the data layer, and A-LIGN, a top C3PAO, brings the experience and rigor to help validate that work through independent assessment. Whether an organization is early in the process or already underway, Kiteworks helps them get the right controls in place so they can walk into the assessment room prepared.”  

A-LIGN is one of the leading C3PAOs in the market and has conducted nearly 100 CMMC Level 2 assessments across DIB organizations of every size. The firm’s assessors cover the full scope of CMMC Level 2, including the governance, personnel, physical, and organizational controls. Beyond CMMC, A-LIGN is also one of the top three FedRAMP assessors, with a team of auditors with deep, firsthand familiarity with how federal agencies expect compliance evidence to be documented and defended. 

“There’s some uncertainty right now about when, and in what form, CMMC’s third-party assessment requirements will return from the Department’s review, but the underlying requirements haven’t gone anywhere,” said Nicholas Ludy, Chief Growth Officer at A-LIGN. “The commitment to securing the DIB doesn’t hinge on any single implementation date. As CMMC requirements evolve, Kiteworks will keep giving DIB organizations a practical path to stronger data security and audit readiness, and A-LIGN will continue to deliver rigorous, independent assessments, so organizations are prepared whenever the certification timeline is finalized.”  

About Kiteworks 
Kiteworks’ mission is to empower organizations to effectively manage risk in every send, share, receive, and use of private data. The Kiteworks platform provides customers with a secure data exchange that delivers data governance, compliance, and protection in a unified control plane. Kiteworks unifies, tracks, controls, and secures sensitive data moving within, into, and out of their organization, significantly improving risk management and ensuring regulatory compliance on all private data exchanges. Headquartered in Silicon Valley, Kiteworks protects over 100 million end-users and thousands of global enterprises and government agencies. 

About A-LIGN
A-LIGN is the leading cybersecurity compliance partner, trusted by over 6,400 organizations worldwide to navigate the complexities of compliance, audit, and risk. With a tech-enabled delivery model and deep domain expertise, A-LIGN has completed more than 36,000 audits. It is the #1 issuer of SOC 2 reports and a top three FedRAMP assessor. Founded in 2009, A-LIGN delivers high-quality, efficient audits across frameworks including SOC 2, ISO 27001, FedRAMP, CMMC, ISO 42001, PCI, and HITRUST. To learn more, visit: https://www.a-lign.com. 

Footnote: A-LIGN’s recognition of this partnership does not constitute or imply partiality in our assessment activities. As a CMMC Third-Party Assessment Organization (C3PAO), A-LIGN applies the same rigor, scrutiny, and standardized processes to all assessments regardless of an organization’s RPO affiliation, technology platform, or partner status. A-LIGN maintains a diverse portfolio of partnerships expressly to prevent any single relationship from creating dependencies that could impair our professional judgment, objectivity, or independence. All assessments are conducted in strict accordance with CMMC assessment guidelines and our impartiality obligations. A-LIGN provides assessment services only. It does not consult, remediate, or advise on control implementation; CMMC certification outcomes are determined solely by independent evaluation of evidence against 32 CFR Part 170 and NIST SP 800-171; and DIB organizations may engage any Authorized or Accredited C3PAO.