Two certification announcements came out on November 10. One is about the people who check defense contractors. The other is about a display maker being checked like a car company. Both show how much of cybersecurity is now paperwork that someone has to sign.
Redspin and the CMMC assessor bottleneck
Redspin says it has earned ISO/IEC 17020:2012 accreditation as a CMMC Third Party Assessment Organization, or C3PAO. ISO 17020 is the standard for inspection bodies. It checks that an assessor is competent, impartial and consistent. Cyber AB assessors reviewed Redspin’s process documents and watched full CMMC assessments from first contract talks to the issued certificate.
Redspin calls itself one of the first C3PAOs to reach accredited status. It was the first authorized C3PAO back in May 2021, before Cyber AB even had an accreditation team. Accreditation was always meant to be the last step.
This matters because CMMC is now in Defense Department contracts. Any company that handles Controlled Unclassified Information has to show it meets NIST SP 800-171, and many need a third-party Level 2 assessment to win or keep work. The Defense Industrial Base runs to tens of thousands of firms. Assessors are the bottleneck. Every accredited C3PAO adds capacity, and accreditation also gives contractors a way to tell solid assessors from new entrants chasing the rush.
One thing to note: Redspin also sells managed security and migration services to the same defense contractors. ISO 17020’s impartiality rules exist for exactly that kind of overlap. Buyers should still ask how it’s handled.
DQS and Samsung Display
German certifier DQS said Samsung Display’s automotive cybersecurity management meets ISO/SAE 21434, the standard for cybersecurity across a vehicle component’s life, and awarded an ENX Vehicle Cyber Security label based on it. The certification covers the company’s OLED automotive business and was handed over at its Yongin headquarters.
A screen isn’t the first part people think of when they think about car hacking. But dashboards and center displays now run software, connect to the vehicle network and get updated over the air. Car makers selling into Europe have to show a cybersecurity management system under UN R155, and they push that duty down to suppliers. A certificate like this is what lets a supplier answer the question once, instead of in every customer audit.