Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 12 SEPTEMBER 2025

DoD Finalizes CMMC Rule: What Defense Contractors Need To Know

Bass, Berry & Sims PLC
Explore more from Bass, Berry & Sims PLC

The Department of Defense (DoD) has issued its long-awaited final rule implementing the Cybersecurity Maturity Model Certification (CMMC) program into the Defense Federal Acquisition Regulation Supplement (DFARS).

United StatesGovernment, Public Sector
Richard W. Arnholt
Richard W. Arnholt
Todd Overman
Todd Overman

The Department of Defense (DoD) has issued its long-awaited final rule implementing the Cybersecurity Maturity Model Certification (CMMC) program into the Defense Federal Acquisition Regulation Supplement (DFARS). The rule establishes a three-year phased rollout that will ultimately apply to nearly every contractor and subcontractor handling federal contract information (FCI) and controlled unclassified information (CUI) (the new requirements do not apply to awards that do not involve the handling or transmission of FCI or CUI).

For businesses across the defense industrial base, this marks a turning point in how cybersecurity compliance will be measured, enforced, and tied directly to contract eligibility.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

See more popular content from

Article

SBA Extends Deadline For Comments On Historic Overhaul Of Size Standards

The Small Business Administration has extended the comment period for two proposed rules that could dramatically reshape federal government contracting by significantly expanding the pool of entities eligible for small business set-aside procurements. With some size standard thresholds proposed to increase as much as tenfold, these changes would fundamentally alter the makeup of the small business contractor base.
United StatesGovernment, Public Sector
Crowell & Moring LLP
Crowell & Moring LLP
Article

D.C. Circuit Rules Pentagon Can Exclude Anthropic From Supply Chain

The U.S. Court of Appeals for the D.C. Circuit has ruled that the Department of War can exclude Anthropic from its supply chain under the Federal Acquisition Supply Chain Security Act, finding that the AI company's ability to manipulate its Claude model creates a supply chain risk. This decision contrasts with an earlier California district court ruling that blocked a similar designation under a different statute, creating a complex legal landscape for AI providers and government contractors.
United StatesGovernment, Public Sector
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

FMCSA MOTUS Implementation – Common Motor Carrier Concerns

The Federal Motor Carrier Safety Administration launched MOTUS in May 2026, replacing legacy registration platforms and fundamentally changing how motor carriers, freight brokers, and surface freight forwarders handle operating authority applications and license maintenance. While designed to combat fraud and streamline registration activities, the transition has created significant user experience challenges that threaten operating authority status and customer relationships for transportation service prov
United StatesGovernment, Public Sector
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

BIOSECURE Act Update: Court Enjoins WuXi AppTec’s 1260H Designation, but Strategic and Compliance Clocks Keep Running

The U.S. District Court for the District of Columbia has preliminarily enjoined the Department of War from enforcing WuXi AppTec's Section 1260H designation, finding the agency misread its evidence on state and military affiliation. However, this ruling does not close alternative pathways to biotechnology company of concern (BCC) designation under the BIOSECURE Act, and earlier supply-chain restrictions continue to drive near-term compliance decisions with a critical June 30, 2027 deadline for sub-tier supp
United StatesGovernment, Public Sector
Greenberg Traurig
Greenberg Traurig
Article

Massachusetts’ 2026 Ballot Questions: What Clients Need To Know

Massachusetts voters will decide nine statewide ballot questions in November 2026 that could fundamentally reshape the state's legal, regulatory, and fiscal landscape. These measures address government transparency, election reforms, housing development, marijuana regulation, firearms laws, and state revenue limits, with implications extending far beyond Election Day to implementation, regulation, and ongoing policy debates.
United StatesGovernment, Public Sector
Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.
Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.
Article

OFAC Broadens Cuba Sanctions And Restricts Payments And Travel

The U.S. Treasury Department's Office of Foreign Assets Control has implemented sweeping changes to Cuba sanctions, introducing a new regulatory framework that extends restrictions beyond U.S. persons to foreign entities and financial institutions. These measures eliminate key banking authorizations, expand transaction prohibitions to include intermediary payments, and significantly narrow travel permissions, creating new compliance challenges for businesses operating in or through Cuba-related channels.
United StatesGovernment, Public Sector
Barnes & Thornburg LLP
Barnes & Thornburg LLP
Article

Weekly Sanctions Update: September 14, 2026

The Treasury Department intensifies economic pressure on Iran through Operation Economic Outcast, suspending aviation licenses and sanctioning dozens of entities while implementing a presumption of denial for Iran-related transactions. Meanwhile, new enforcement actions target Chinese cybercrime platforms, Ecuadorian terrorist organizations, and Israeli settlers, as Congress considers comprehensive Russia-Iran sanctions legislation.
GlobalGovernment, Public Sector
Steptoe LLP
Steptoe LLP
Article

FCC Replaces TCPA “Revoke All” Rule: New Category-Specific Opt-Out Rules For Robocalls And Robotexts

The Federal Communications Commission has fundamentally altered how businesses must handle consumer opt-out requests under the Telephone Consumer Protection Act, replacing the broad "revoke all" mandate with a more nuanced, category-specific approach for informational messages. This regulatory shift allows companies to maintain separate consent tracks for different types of non-marketing communications while preserving stricter opt-out requirements for telemarketing messages. The Updated Order introduces ne
United StatesConsumer Protection
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Healthcare Trends & Transactions Q2 2026

Healthcare M&A activity maintained steady momentum through Q2 2026, driven by physician practice consolidation, AI-enabled technology acquisitions, and strategic outpatient expansion. Private equity investment persisted despite intensifying regulatory scrutiny of MSO arrangements, while digital health buyers paid significant premiums for platforms demonstrating production-grade AI capabilities and proprietary data assets.
United StatesCorporate/Commercial Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

DOJ Continues DEI False Claims Act Enforcement With $25 Million Accenture Settlement

The Department of Justice announced a $25 million settlement with Accenture Federal Services over allegations that the company violated the False Claims Act by falsely certifying compliance with anti-discrimination requirements while allegedly using race or sex in hiring, promotion, and access to professional development programs. This marks the third major DEI-related FCA enforcement action in 2026, following similar settlements with IBM and Deloitte.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

DOJ's $2 Million Honeywell Settlement Under The Civil Cyber-Fraud Initiative: What Compliance Failures Mean For Defense Contractors

The Department of Justice secured a $2 million settlement with Honeywell Aerospace for allegedly failing to comply with NIST SP 800-171 cybersecurity requirements under a Department of War contract. This case demonstrates how cybersecurity compliance failures can trigger False Claims Act liability even without an actual data breach or cyberattack, and highlights the growing role of whistleblowers in exposing contractors' gaps between contractual obligations and actual security practices.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

No More SEC Responses To Rule 14a-8 No-Action Requests: What Public Companies Should Know For The Upcoming Proxy Season

The SEC's Division of Corporation Finance has announced it will no longer respond to Rule 14a-8 no-action requests, marking a significant shift in the shareholder proposal process. Companies must still comply with notification requirements under Rule 14a-8(j), but without staff guidance on exclusion decisions, they will need to rely on existing SEC guidance, precedent, and judicial decisions.
United StatesCorporate/Commercial Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

CAS Board Raises Contract Thresholds To $35 Million And Eliminates CAS 407: What Federal Contractors Need To Know As DoW Demands Cost And Pricing Transparency

The CAS Board has raised contract thresholds to $35 million and eliminated CAS 407, fundamentally changing cost accounting requirements for federal contractors. At the same time, the Department of War is demanding unprecedented cost and pricing transparency through new memoranda requiring actual cost information for negotiations valued at $10 million or more, creating a complex landscape where contractors face fewer formal CAS requirements but heightened scrutiny of their pricing data.
United StatesAccounting and Audit
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Still Tracking, Still Suing: Website Privacy Litigation After SB 690

California's SB 690 eliminates private lawsuits under CIPA for pen register and trap-and-trace device theories, but website tracking litigation continues under federal wiretapping statutes, ECPA's crime-tort exception, and sector-specific claims. Businesses face ongoing risk from cookies, pixels, and tracking technologies that may unlawfully intercept visitor communications or collect routing data without proper consent.
United StatesPrivacy
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

BIS Settlement Highlights Export Control Risks For Medical And Research Technology

The U.S. Department of Commerce's Bureau of Industry and Security reached a $1.7 million settlement with Plexon, Inc. over unlicensed exports of neural recording systems to a Chinese research institution on the Entity List. This enforcement action demonstrates that medical and research products are subject to U.S. export controls, and even EAR99 items may require licenses based on destination, end user, or end use.
United StatesInternational Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC