Everyone in the room knows the unsanctioned chat groups exist. Nobody has a plan for them that survives an incident, an audit or a records request.
Somewhere in your organization right now, a program manager is on a WhatsApp group with a subcontractor, and a field engineer is on Signal with a customer. Your policy says it shouldn't happen, and it happens anyway, because the approved tools are slow for anyone outside your tenant.
Wednesday, December 9, 2026 · 11:00 AM Central
Your confirmation email is on its way from Zoom with your personal joining link and an option to add the session to your calendar.
See you on Wednesday, December 9 at 11:00 AM Central.
Open your joining linkIn 2025 the same thing happened at the top of the US government. Strike plans were discussed on Signal with a journalist added by mistake. The archiving tool officials used to keep records of those chats was breached in around 20 minutes and taken offline. In December, the Pentagon's own inspector general found the use did not comply with Department policy, which bars non-Department messaging for nonpublic information "regardless of the service's perceived appearance of security."
For a defense supplier the question isn't whether staff use consumer apps. In a 2025 survey of US and UK financial services firms, 67% thought it likely their staff still use unmonitored channels such as WhatsApp and Signal, up from 63% a year earlier. That's the sector that has already been fined for it.
The CMMC pause in July removed a certification date. DFARS 252.204-7012 still requires you to protect controlled unclassified information wherever it travels, including on phones.
The question is what you can show when the contracting officer, the auditor or the lawyer asks three things about a chat group:
While keeping what people like about them: a phone, a message and an outside party added in seconds.
And why policy on its own hasn't fixed it. The approved tools are slow for anyone outside your tenant, so the work goes where the outsider already is.
The policy line, the records finding, and the archiving breach, and what each one means for a supplier handling controlled information.
What a contracting officer, an auditor or opposing counsel will want to know, and how to answer them with evidence rather than assurances.
Who can add an outsider, who can see it, what is kept, and who gets removed when a person leaves the company.
Find the groups, pick the ones that matter, and move them without a mandate nobody follows.
A template for listing every group outside your sanctioned tools: who is in it, what it carries and who owns it. It is the first step of the 30-day plan, and it is yours to use the day after the session.
Registrants receive the template along with the recording, whether or not they can join live.
An educational session, not a product pitch.
Heads of Cyber, Heads of IT, CISOs and compliance leads at defense and aerospace suppliers, and the program managers who coordinate with subcontractors, primes and customers every day.
Wire is messaging, calls, conferencing and file sharing, fully end-to-end encrypted and open source. It runs in the cloud or on your own premises, and it is trusted by governments, critical national infrastructure and more than 1,800 organizations worldwide.
The WhatsApp and Signal groups your security team already knows about
Register now