Investigations, Enforcement, & Compliance Alerts

Last month, the U.S. Department of Defense (DOD) published a Proposed Rule setting out planned revisions to the Defense Federal Acquisition Regulations (DFARS) to implement the requirements of the Cybersecurity Maturity Model Certification program (CMMC 2.0) proposed in December 2023.[1] CMMC 2.0 is a framework for verifying a DOD contractor’s implementation of cybersecurity measures that the DOD requires to protect sensitive unclassified information including Controlled Unclassified Information (CUI), and Federal Contract Information (FCI). The Proposed Rule revises the DFARS to reference the CMMC 2.0 requirements that were proposed in December 2023. This includes changes to the existing CMMC clause at DFARS 252.204-7021, the creation of a new solicitation provision to accompany DFARS 252.204-7021 which will provide notice of the CMMC 2.0 requirement, the establishment of a plan for a phased rollout of the Proposed Rule, and the addition of certain new definitions. The Proposed Rule’s comment period ends on October 15, 2024.

On May 3, 2024, the federal government took steps to ban federal purchases of semiconductor products from certain U.S. foreign adversaries in a proposed rule that would affect the majority of federal contracts. The proposed rule would amend the Federal Acquisition Regulation (FAR) to implement section 5949 of the 2023 National Defense Authorization Act (Pub. L. 117-263) (NDAA).

The Department of Defense (DOD) is expected to finalize a new rule by the end of 2023 that will significantly enhance the Cybersecurity Maturity Model Certification (CMMC) framework and related cybersecurity requirements for defense contractors. 

The federal government will officially shut down at 12:01 a.m. on Sunday, October 1, unless Congress agrees to pass a spending bill or a continuing resolution. The Biden administration yesterday began notifying federal employees that a shutdown is likely. This would be the fourth government shutdown in the past ten years, the longest of which lasted 34 days.