If you read nothing else
- CMMC Phase 1 started November 10. Level 1 and Level 2 self-assessments and annual affirmations now go in SPRS.
- The FBI, CISA and DoD's Cyber Crime Center warned that Akira ransomware mainly hits small and mid-sized businesses. Patch known exploited flaws and use phishing-resistant MFA.
- Install November's Windows update. A kernel flaw was already being used.
Seven things from November 2025. Each one says what happened, what it means for a small business or a small defense supplier, and one thing to do about it.
1. CMMC Phase 1 started
The first phase of CMMC began on November 10, 2025. Level 1 means an annual self-assessment and affirmation against the 15 FAR 52.204-21 requirements. Level 2 self-assessment means checking the 110 NIST SP 800-171 Rev 2 requirements every three years, with an annual affirmation. Results go into SPRS. Source: Department of War CIO, CMMC About page.
What this means for you: a contract can now ask for your CMMC status, and a senior official signs the affirmation.
Do this: confirm your SPRS score is posted, current, and matches your System Security Plan.
2. Akira ransomware targets small and mid-sized businesses
On November 13, the FBI, CISA, the DoD Cyber Crime Center (DC3), HHS and international partners updated their Akira ransomware advisory, warning of an imminent threat to critical infrastructure. Akira mainly targets small and mid-sized businesses, with manufacturing, education, IT, healthcare and financial services among its preferred sectors. In one June 2025 case the group got in through a SonicWall flaw, CVE-2024-40766. Source: FBI and CISA advisory AA24-109A.
What this means for you: this is a warning written about companies your size, co-signed by DoD.
Do this: do the advisory's three first steps: patch known exploited flaws, turn on phishing-resistant MFA, and keep tested offline backups.
3. Microsoft fixed a Windows kernel flaw already in use
November's Patch Tuesday on November 11 fixed 63 vulnerabilities. CVE-2025-62215 (CVSS 7.0) in the Windows Kernel was exploited as a zero-day and can give an attacker system-level privileges. Source: CyberScoop. CISA added it to the Known Exploited Vulnerabilities list on November 12. Source: CISA KEV catalog.
What this means for you: an attacker with a foothold on one PC can use this to take it over.
Do this: on every Windows PC, open Settings, then Windows Update, install, restart, and check again until it says you are up to date.
4. A web firewall flaw let attackers add their own admins
On November 14, Fortinet confirmed CVE-2025-64446 in FortiWeb was being exploited. Unauthenticated attackers could take over devices and added new administrator accounts to keep access. FortiWeb 8.0.2 fixes it, and CISA added it to the Known Exploited Vulnerabilities list the same day. Source: The Register.
What this means for you: security appliances get exploited too, sometimes before an advisory exists.
Do this: if you run FortiWeb, update it and check its administrator list for accounts nobody created.
5. An emergency alert vendor was hit by ransomware
An attack on Crisis24's OnSolve CodeRED platform disrupted emergency alerts used by local governments, police and fire agencies across the US. The INC Ransom gang claimed it. Crisis24 said user names, addresses, emails, phone numbers and passwords were stolen, and it restored service from a March 31, 2025 backup. Source: BleepingComputer, November 25.
What this means for you: a vendor's breach can expose passwords your people reused on work accounts.
Do this: move staff to a password manager with a unique password per site, and change any password that was reused.
6. A mortgage vendor's breach reached major banks
SitusAMC, which processes mortgages for banks, found a breach on November 12. It said corporate data such as accounting records and legal agreements was affected, plus some data about clients' customers, and that no encrypting malware was involved. The New York Times named JPMorgan Chase, Citi and Morgan Stanley as affected clients. The FBI is investigating. Source: BankInfoSecurity, November 24.
What this means for you: your data is only as safe as the vendors that hold it.
Do this: list the outside companies that hold your customer or employee data, and ask each one how it would tell you about a breach.
7. A Samsung phone flaw was used to install spyware
Palo Alto Networks' Unit 42 found LANDFALL spyware delivered through malformed image files, often sent over WhatsApp, exploiting CVE-2025-21042 (CVSS 8.8) in Samsung Galaxy phones. Samsung patched it in April 2025, after months of exploitation. Source: Security Affairs. CISA added it to the Known Exploited Vulnerabilities list on November 10. Source: CISA KEV catalog.
What this means for you: phones that read work email need updates as much as laptops do.
Do this: require current security updates on any phone that reaches company email or files.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.