Compliance Stuff

US defense contractors are now encountering CMMC cybersecurity requirements in their contracts. Ambika Biggs of Hirschler reviews the program’s structure, the levels at which contractors may self-certify and where inaccurate certifications have drawn False Claims Act scrutiny from the Justice Department. A US government focus on cybersecurity is not new. DFARS 252.204-7012 , which is included in defense contracts involving controlled unclassified information (CUI), became effective in 2016. However, after a defense department inspector general report in 2019 found that defense contractors were not consistently implementing security requirements to protect CUI, the defense department developed the cybersecurity maturity model certification (CMMC) program to assess implementation of cybersecurity requirements by defense contractors and subcontractors.  A final rule was published in November 2020 and became effective in 2024; the department began incorporating CMMC program requirem...

The FAR Council recently issued  much-anticipated guidance  implementing Executive Order (EO) 14398, “Addressing DEI Discrimination by Federal Contractors.” 00:00 11:12 Quick Hits New clause FAR 52.222-90 declares contractor compliance “material” to the government’s payment decisions, creating direct False Claims Act liability for contractors who maintain prohibited programs. Agencies must bilaterally modify existing contracts to include the new clause by July 24, 2026 , and if a contractor refuses, agencies are told to consider whether the contract should be terminated for convenience. Prime contractors must flow the clause down to all tiers and report any subcontractor’s “known or reasonably knowable” violations to the contracting officer. While  EO 14398 , issued in March 2026, set the policy stage, this  new memorandum  provides the technical architecture and aggressive deadlines that federal contractors and subcontractors must navigate immediately. Below, w...