Welcome to Our Q3 2026 Newsletter
This quarter, we’re featuring our partnership with Armis, a leader in asset intelligence and cyber exposure management helping federal and defense organizations secure complex IT/OT environments.
In our employee spotlight, we’re proud to introduce George Simmons, Principal Security Consultant and Managed Services Lead — a 35-year DoD cybersecurity veteran who helps our clients turn compliance requirements into sustainable, mission-focused security programs.
Finally, scroll down for a look at where August Schell will be this quarter across the federal and defense community.
— The August Schell Team
Logging in an M-26-14 World
The Problem
Threat actors are increasingly using AI to accelerate attacks — gaining unauthorized access, moving laterally, and persisting undetected faster than legacy defenses can respond. M-26-14 has now been released to replace M-21-31 completely. The core gap M-26-14 exposes is visibility: agencies cannot log what they cannot see, and today most agencies have near-non-existent logging visibility into their IoT and OT environments. Traditional agent-based tools simply can’t reach these devices, many of which have no native logging capability at all. The memo is largely aimed at addressing this glaring blind spot to ensure adequate visibility against the latest threats.
The Solution
Meeting M-26-14 requires closing that visibility gap end-to-end, which means:
- Complete asset inventory (HWAM/SWAM) across IT, IoT, and OT including unmanaged and non-communicating devices — full visibility is the prerequisite for every other requirement.
- Continuous Event Monitoring (CEM): real-time behavioral monitoring across every device class, not just managed endpoints, feeding actionable alerts to the agency SOC.
- THIRF-ready forensics: retained, enriched historical telemetry that lets teams reconstruct lateral movement and attack paths across IT/OT/IoT boundaries after a compromise.
- Centralized, normalized telemetry feeding into SIEM, SOAR, and CDM platforms for unified visibility.
- An approach that reaches OT/ICS/SCADA environments passively — without disrupting sensitive operational systems — and aligns with the Zero Trust Maturity Model’s Visibility & Analytics pillar.
- A path to Level 3 (Advanced) maturity within the 320-day window, without requiring a rebuild of existing infrastructure.
Why This Matters for Your Agency
- Agencies must produce searchable, retrievable logs (6 months searchable, 12 months retrievable minimum) and provide them to CISA and the FBI upon request. Without full-device visibility, that’s not achievable for IoT/OT assets.
- The compressed timeline (Level 3 within 320 days of the CISA LRA publication) means agencies with existing blind spots are already behind — this isn’t a future planning item, it’s an active gap.
- IoT and OT devices are where most agencies have the least visibility today — and where a security incident would be hardest to detect or reconstruct after the fact.
Interested in what this looks like for your organization? Contact August Schell to learn how you can meet M-26-14 requirements.
See Every Asset. Secure Every Mission.
August Schell + Armis.
You can’t protect what you can’t see. In today’s federal environment, agencies are managing a sprawling mix of IT workstations, OT systems, IoT sensors, and mission-critical devices — many of them unmanaged, unmonitored, and invisible to traditional security tools. That’s where Armis changes the game.
Armis Centrix™ is an AI-powered Cyber Exposure Management Platform that continuously discovers, monitors, and secures every connected asset across your environment, whether it’s managed or unmanaged, IT or OT, on-prem or cloud. And it does it agentlessly — meaning zero disruption to the very systems your mission depends on.
At August Schell, we help federal customers close the visibility gap before adversaries exploit it. By pairing Armis Centrix™ with our deep federal cybersecurity expertise, agencies gain a real-time, unified picture of their entire attack surface — with automated risk scoring, vulnerability prioritization, and threat detection built in. The result: less time chasing unknowns, more time protecting what matters.
Armis Centrix™ is FedRAMP and DISA IL authorized, and available through GSA and NASA SEWP V — contract vehicles ASE customers already know. Contact us to learn more.
As Principal Security Consultant & Managed Services Lead, George Simmons is dedicated to helping organizations navigate the increasingly complex world of cybersecurity compliance, cloud authorization, and operational risk management. Drawing on more than 35 years of Department of Defense cybersecurity experience, George helps organizations transform compliance requirements into practical, mission-focused security programs that enable business growth while maintaining rigorous security standards.
Prior to joining the private sector, George served as Chief of the Cloud Assessments and Authorization Division at DISA, where he led the assessment and authorization of commercial cloud service offerings seeking DoD Provisional Authorization at Impact Levels 4, 5, and 6. He also represented the DoD CIO and CISO communities as a technical lead within the FedRAMP authorization process.
With the recent addition of his Certified CMMC Professional (CCP) and Certified CMMC Assessor (CCA) credentials, George further strengthens our ability to guide organizations through the evolving CMMC landscape. His expertise spans CMMC, NIST SP 800-171, RMF, FedRAMP, DoD Cloud Computing SRG, continuous monitoring, and executive-level risk management.
Where You Can Find Us in Q3 2026
From Los Alamos to Chicago — here’s where August Schell will be this quarter.
2026
2026
2026
2026
2026
2026
2026
2026
2026
2026
2026
2026
2026
Have Questions?
Reach out to our team for consulting, solutioning, or to learn more about any topic in this newsletter.
info@augustschell.com