Cybersecurity

Subscribe to Cybersecurity via RSS
Photo of Nkechi KanuPhoto of Brian Tully McLaughlinPhoto of Kate GrowleyPhoto of Matthew FerraroPhoto of Jessica ChaoPhoto of Jacob HarrisonPhoto of Ajan JayantPhoto of Bryan Dewan

In recent years, the U.S. federal government has taken significant interest in the cybersecurity compliance of its contractor base. In 2025 alone, the U.S. Department of Justice’s (DOJ) Civil Cyber-Fraud Initiative recovered more than $50 million across nine False Claims Act (FCA) cybersecurity fraud settlements, and it has secured almost 20 settlements since its launch in October 2021. Because most defendants facing FCA liability for alleged cybersecurity noncompliance enter into pre-litigation settlements, the last court decision in a cybersecurity FCA case was in 2022. However, earlier this month, on September 2, 2026, in  United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145, 2026 WL 2593317 (N.D. Ill. Sept. 2, 2026), Judge Sunil R. Harjani of the U.S. District Court for the Northern District of Illinois granted a motion to dismiss on materiality grounds and offered additional guidance on what a plaintiff must allege to adequately state an FCA cybersecurity claim.

Continue Reading In a First, District Court Dismisses FCA Cybersecurity Complaint for Lack of Materiality
Photo of Nkechi KanuPhoto of Kate GrowleyPhoto of Jacob HarrisonPhoto of Bryan Dewan

On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08. 

Continue Reading New ISOO Guidance Directs Federal Agencies to Provide More CUI Guidance to Contractors
Photo of Peter J. EyrePhoto of M.Yuan Zhou
Fraud Enforcement, Offensive Cyber Operations, Executive Privilege

This week’s episode covers a memo outlining the National Fraud Enforcement Division’s enforcement priorities, a White House memo that authorizes certain private sector offensive cyber operations, and a DOJ opinion relating to executive privilege, and is hosted by Peter Eyre and Yuan Zhou. Crowell & Moring’s “Fastest 5…

Photo of Olivia LynchPhoto of Cherie Owen

As discussed in more detail here, the U.S. Department of War (DoW) recently issued a memorandum (Memo 26-P-1023, dated July 13, 2026) directing the immediate suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements (Level I and II self assessments are still permitted). Significantly, the memo directs that “all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice.” Moreover, the DoW issued a memorandum on implementing these requirements (available here), directing agencies to issue amendments removing CMMC Level 2 and 3 requirements from active solicitations “as soon as practicable.” Contractors should monitor the government’s compliance with this requirement and should be prepared, if needed, to file a bid protest to protect their rights.

Continue Reading CMMC Phase II Suspension Requires Reconsideration of Such Requirements in Solicitations
Photo of Kate GrowleyPhoto of Nkechi KanuPhoto of Jessica ChaoPhoto of Jacob HarrisonPhoto of Ajan JayantPhoto of Bryan DewanPhoto of Caitlyn Weeks

The Department of War (DoW) is immediately suspending Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026.

Continue Reading Department of War Immediately Suspends CMMC Phase II Requirements, Launches 60-Day Reform Review
Photo of Kate GrowleyPhoto of Jacob HarrisonPhoto of Ajan JayantPhoto of Bryan Dewan

On June 25, 2026, the Federal Risk & Authorization Management Program (FedRAMP) launched its Consolidated Rules for 2026, marking a significant turning point in how the U.S. government administers security authorizations of private sector cloud offerings. The Consolidated Rules apply to all variants of the FedRAMP ecosystem, including legacy “Rev5” authorization holders, as well as future certifications under the new 20x program. Importantly, the Rules are intended in part to transition Rev5 authorizations over to 20x, with the Rev5 authorization status expected to terminate by the end of 2028. 

Continue Reading Time for a Change: FedRAMP Fundamentally Revamps Program With Consolidated Rules for 2026
Photo of Kate GrowleyPhoto of Nkechi KanuPhoto of Jessica ChaoPhoto of Bryan DewanPhoto of Jacob HarrisonPhoto of Ajan Jayant

Introduction

The Federal Risk and Authorization Management Program (FedRAMP) continues to advance its modernization agenda. On April 8, 2026, FedRAMP released RFC-0031, Updated Incident Communications Procedures for public comment. This RFC proposes replacing the current FedRAMP Incident Communications Procedures (ICP) with what FedRAMP calls “a clear set of reporting requirements … established using a modern rules-based format.” 

Below is a summary of key changes proposed in RFC-0031.    

Continue Reading FedRAMP Solicits Public Comment on Overhaul to Incident Communications Procedures
Photo of Kate GrowleyPhoto of Matthew FerraroPhoto of Jacob CanterPhoto of Jacob HarrisonPhoto of Ajan JayantPhoto of Bryan Dewan

On February 13, 2026, the U.S. Department of Homeland Security (DHS) announced upcoming virtual town hall meetings scheduled for March 2026 regarding the implementation of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).  The meetings will allow industry stakeholders to provide input to DHS to refine the “scope and burden” of the forthcoming CIRCIA final rule.

Continue Reading DHS Announces Virtual Town Halls on CIRCIA Final Rule
Photo of Kate GrowleyPhoto of Jessica ChaoPhoto of Jacob HarrisonPhoto of Ajan Jayant

What is FedRAMP?

The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide initiative established to standardize the security assessment, authorization, and continuous monitoring of cloud products and services used by federal agencies. FedRAMP’s primary objective is to ensure that cloud service providers (CSPs) implement robust security controls to protect federal information in cloud environments. By leveraging a consistent framework for security assessment and authorization, FedRAMP is intended to reduce duplication of effort, cost, and time for both agencies and vendors.

Continue Reading FedRAMP Proposes Updates to Authorization Process—Six New RFCs Released for Public Comment
Photo of Kate GrowleyPhoto of Nkechi KanuPhoto of Brian Tully McLaughlinPhoto of Scott WisePhoto of Jessica ChaoPhoto of Jacob HarrisonPhoto of Jasmine Masri

Earlier this month, the Department of Justice (DOJ) announced that Swiss Automation Inc., an Illinois-based precision machining company, agreed to pay $421,234 to resolve allegations that it violated the False Claims Act (FCA) by inadequately protecting technical drawings for parts delivered to Department of Defense (DoD) prime contractors.  This settlement reflects DOJ’s persistent emphasis on cybersecurity compliance across all levels of the defense industrial base, reaching beyond prime contractors to encompass subcontractors and smaller suppliers.  The settlement is also a reminder to all contractors not to overlook the often confusing relationship between Controlled Unclassified Information (CUI) and export-controlled information.

Continue Reading An ITAR-ly Critical Reminder of Cybersecurity Requirements: DOJ Settles with Swiss Automation, Inc.