Former NASA CIO's Firm Brings Federal Records Discipline to Defense Contractors' Cyber Scores
Muse Technologies enters the commercial defense market with an evidence-first approach to SPRS and CMMC readiness: "Your IT provider runs the controls. We make them provable."
BOWIE, MD / ACCESS Newswire / October 28, 2026 / Muse Technologies, the firm founded by former NASA Chief Information Officer Dr. Linda Cureton, today launched a readiness practice for mid-sized U.S. defense contractors. It's built on a simple claim: most companies don't fail cybersecurity assessments because they lack technology. They fail because they can't prove what they've already done.
For more than a decade, Muse has managed records and IT programs for federal agencies, including more than a million federal case records handled under National Archives standards. The new practice applies that discipline to the problem defense suppliers now face every year: a self-assessed security score, posted to the Pentagon's Supplier Performance Risk System (SPRS), that a senior official has to sign.
"I spent my career on one question: can you prove it?" said Dr. Cureton, Muse's founder and chief executive. "Defense contractors are being asked that question now, and most of them have answered it with a number rather than a file. We help them build the file."
A records problem wearing a cybersecurity label
Contractors that handle controlled unclassified information must meet the 110 security requirements in NIST Special Publication 800-171. Assessors check those requirements against 320 individual objectives, using documents, interviews and tests, and they score only what a company can show.
That is where companies come apart. The common failures are rarely exotic: a System Security Plan that still describes systems retired years ago, controlled files sitting on drives the plan never mentions, a posted score that doesn't reconcile with the plan, and evidence that exists in practice but can't be produced on request.
"Those aren't technology failures. They're records failures," Dr. Cureton said. "Your IT provider runs the controls. We make them provable. Those are two different jobs, and most companies have only paid for the first one."
Why it matters now
The Defense Department suspended the second phase of its Cybersecurity Maturity Model Certification program in July, pausing third-party certification while it reviews the program. Self-assessments, SPRS scores and the annual affirmation remain in place.
So does enforcement. On Sept. 1, 2026, Honeywell Aerospace agreed to pay more than $2 million to resolve False Claims Act allegations that it failed to meet NIST SP 800-171 requirements on one of its networks, according to the Justice Department. In June, Alabama contractor LOGZONE settled after a government review put its self-reported perfect score of 110 at minus 170. Neither company admitted liability.
What Muse offers, and what it won't do
Muse's approach starts with two free steps. Contractors can estimate their own score in a few minutes with Muse's online SPRS self-check at sprs.muse-technologies.com. They can then book a free 60-minute SPRS Score Check, in which the Muse team reviews, on a screen share, a contractor's security plan, posted score and plan of action, then names where an assessor is likely to find problems and the three things to fix first. The contractor receives the findings in writing within 48 hours.
Contractors that want help can move to a six-week CUI and AI Exposure Review. It maps where controlled information actually lives, assigns each of the 320 assessment objectives a named owner and evidence source, documents what AI tools such as Microsoft Copilot can reach, and produces a file that supports the official who signs the affirmation. The client team's total time commitment is under 10 hours. Muse guarantees the work: every objective comes back with a named owner and evidence source, or the client isn't invoiced.
Muse is equally clear about its limits. It doesn't certify; only an authorized assessor can do that. It sells no software, licenses or managed services, installs nothing and hosts nothing, so it never becomes part of the client's assessment scope. The evidence it builds belongs to the client and can be exported.
"We work alongside a company's IT provider, not instead of them," Dr. Cureton said. "At the end, the provider gets a clearer list, and the person who signs gets something solid to sign against."
Built on federal practice
Dr. Cureton served as NASA's Chief Information Officer from 2009 to 2013 and founded Muse that year. The firm holds ISO 9001:2015 certification and continues to serve federal agencies through vehicles including GSA's Multiple Award Schedule and the 8(a) STARS III contract.
"Agencies learned long ago that if it isn't documented, it didn't happen," she said. "That's exactly how an assessor thinks. We're bringing that habit to the companies that build for the Department of Defense."
Defense contractors can check their score online at sprs.muse-technologies.com and book a free SPRS Score Check at www.muse-technologies.com.
About Muse Technologies
Muse Technologies, Inc. is a Maryland-based management consulting and IT services firm founded in 2013 by Dr. Linda Cureton, NASA's Chief Information Officer from 2009 to 2013. Muse helps federal agencies and defense contractors make their information provable, to assessors and to AI. Muse is an Economically Disadvantaged Woman-Owned Small Business and is ISO 9001:2015 certified. Learn more at www.muse-technologies.com.
Website: www.muse-technologies.com · SPRS self-check: sprs.muse-technologies.com · LinkedIn: linkedin.com/company/musetechnologies
Media contact
Dr. Linda Cureton
[email protected]
240-308-7100
Bowie, Maryland, US
SOURCE: Muse Technologies