The latest tech news, analyzed for
IT infrastructure decision makers

Most of the cost of defense cybersecurity compliance sits in the security controls, not in the audit that checks them.

Federal News Network reported internal Defense Department documents on Monday, October 26th. They summarize 997 responses to the department’s request for information on the Cybersecurity Maturity Model Certification program. Respondents said the main cost was meeting the NIST SP 800-171 controls, not the CMMC assessment. They pointed to Microsoft 365 GCC High licensing, dedicated enclaves, and inconsistent guidance on what counts as controlled unclassified information. Based on figures from some respondents, the department put the average CMMC assessment cost at $47,000. Small Business Administration head Kelly Loeffler said in July that complying with CMMC could cost as much as $600,000.

The department suspended Phase 2 on July 13th. That phase would have required third-party assessments starting November 10th. The department gave a review team 75 days to report, and the review has now run past 100 days. A September 3rd memo told contracting officers to remove third-party assessment requirements from contracts. Federal News Network reports that 2,433 companies held Level 2 third-party certifications as of September. The department declined to comment.

The pause removed the audit, not the obligation. Contracts that handle controlled unclassified information still require Phase 1 self-assessments and DFARS 252.204-7012. A self-attested score that overstates what’s in place still carries enforcement risk. Contractors that slowed their 800-171 work during the pause should start with the cost items respondents named: GCC High licensing, enclave scope, and what their managed service and cloud providers actually cover.

Should the Defense Department restart third-party CMMC assessments now that its own survey puts most compliance cost in the NIST controls?

Order books for data-center fuel cells now far exceed what the industry can build in a year.

Revenue at Bloom Energy rose 138% to $1.24 billion in the third quarter, and the fuel-cell maker posted net profit of $250.3 million after a loss of $23.1 million a year earlier. Bloom reported the results on Thursday, October 22nd, and raised its 2026 revenue forecast to between $4.4 billion and $4.6 billion. Oracle plans to buy up to 2.8 gigawatts of Bloom systems and has contracted 1.2 gigawatts so far.

Demand is coming from data centers that can’t wait for the grid. Rystad Energy estimates that connecting large loads to the US grid takes three to six years. It projects that fuel-cell investment for data centers will rise to about $30 billion by 2030, up from $2.8 billion in 2025.

Rystad puts the industry’s order book at roughly 9 gigawatts, including framework agreements with Oracle, American Electric Power, Equinix and Brookfield. Those agreements don’t necessarily commit buyers to the full stated capacity. Annual manufacturing capacity is about 1.8 gigawatts today, and Rystad expects it to reach 4 gigawatts by 2030. Bloom’s chief commercial officer, Aman Joshi, told Reuters that on projects above 100 megawatts, site readiness, permits and supporting infrastructure drive the schedule more than the fuel cells do.

Most enterprises will feel this through their colocation and cloud providers, not through fuel-cell contracts of their own. When negotiating new capacity, ask the provider how the site will be powered and how much depends on on-site generation that isn’t built or permitted yet. Also ask what happens to delivery dates if that power arrives late. Headline gigawatt figures in vendor deals are ceilings, not delivery schedules.

Should colocation providers disclose how much of a new site’s power depends on on-site generation that is still under construction?

Google is funding a gigawatt-scale virtual power plant in PJM, and the capacity comes from homes and businesses agreeing to cut load at peak.

The expanded agreement between Google and Voltus builds on a 100 MW deal signed in June. Voltus says the expansion adds 1,070 MW of distributed capacity, which Google describes as a tenfold increase on the initial commitment. Headlines round the program to 1 GW. Voltus aggregates flexible load from participating businesses and homes into a Google-funded virtual power plant. When the grid is under strain, Voltus signals those sites to reduce use through batteries, smart thermostats or industrial process adjustments. Participants earn bill savings or direct payments for that flexibility. Through its Bring Your Own Capacity program, Voltus positions the aggregated load as market-accredited capacity that hyperscalers can bring to the grids they draw from.

Infrastructure leaders evaluating PJM data center sites should separate contracted flexible capacity from power deliverable at a specific interconnection. A virtual power plant earns capacity accreditation in PJM’s market. It does not connect a facility faster. Ask the utility or grid operator how much capacity is accredited for a proposed site and when it becomes available, and pin down whether a program is 1 GW or 1.17 GW before the headline figure becomes a planning assumption.

Should accredited flexible capacity count toward a data center’s power plan before the interconnection is secured?

PC shipments fell more than 20% last quarter, and memory now makes up nearly 40% of a PC’s component cost. Barclays says the strong enterprise revenue at Dell, HPE and NetApp reflects those memory prices more than AI demand.

This week’s Row House Tech Newsletter covers what that means for refresh budgets, supplier contracts and when to buy.

Software sold to federal agencies now has to be free of DeepSeek, even deep inside a vendor’s product.

Federal civilian agencies must remove DeepSeek technology from their IT systems and stop buying it, under a U.S. Department of Homeland Security order made public on October 19th. The ban also covers third-party products and services built using DeepSeek’s models. DHS issued the order on July 24th and gave agencies 60 days to comply. It covers agencies including the Treasury, State and Justice departments, but not Defense Department national security systems, state and local governments or private companies. DHS cited DeepSeek’s servers in China, an account sign-up process that collects personal data and may fingerprint users, and the risk that prompts send sensitive government data to China. Agencies can seek exceptions with a written justification. Earlier restrictions came from the Defense Information Systems Agency in January 2025, Commerce Department bureaus in March 2025 and the intelligence community in December 2025.

Vendors selling to federal agencies now need to show which AI models sit inside their products, including open-weight models they host themselves. Ask software suppliers which models power their AI features and where prompts are processed, and add model-change notice to contracts. Companies outside government are not covered, but many will face the same questions from federal customers and from boards reviewing AI supply chains.

Should private companies follow the federal lead and remove DeepSeek models from their own software supply chains?