Mandatory Breach Notification Requirements Are Coming For Government Contractors

The Biden Administration is imminently expected to release an executive order that will require government contractors to notify the government in the event of a cybersecurity breach. Despite the relatively steady rise in cyberattacks and breaches over the years, and the enactment of consumer data breach disclosure laws in all 50 states, there is currently no standardized reporting requirement for government contractors. However, the Biden administration has promised executive action on the issue, largely in response to a cyberattack by a suspected nation-state against multiple software companies, including the SolarWinds software company.

SolarWinds gained national attention because the cyberattack inserted malicious code into SolarWinds' IT performance monitoring system known as Orion. Beginning in March 2020, SolarWinds disseminated software updates for Orion containing the malicious code. The updates appear on their face to be legitimate patches but resulted in