In recent years, the U.S. federal government has taken significant interest in the cybersecurity compliance of its contractor base. In 2025 alone, the U.S. Department of Justice’s (DOJ) Civil Cyber-Fraud Initiative recovered more than $50 million across nine False Claims Act (FCA) cybersecurity fraud settlements, and it has secured almost 20 settlements since its launch in October 2021. Because most defendants facing FCA liability for alleged cybersecurity noncompliance enter into pre-litigation settlements, the last court decision in a cybersecurity FCA case was in 2022. However, earlier this month, on September 2, 2026, in United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145, 2026 WL 2593317 (N.D. Ill. Sept. 2, 2026), Judge Sunil R. Harjani of the U.S. District Court for the Northern District of Illinois granted a motion to dismiss on materiality grounds and offered additional guidance on what a plaintiff must allege to adequately state an FCA cybersecurity claim.
Continue Reading In a First, District Court Dismisses FCA Cybersecurity Complaint for Lack of Materiality
New ISOO Guidance Directs Federal Agencies to Provide More CUI Guidance to Contractors
On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08.
Continue Reading New ISOO Guidance Directs Federal Agencies to Provide More CUI Guidance to ContractorsDepartment of War Immediately Suspends CMMC Phase II Requirements, Launches 60-Day Reform Review
The Department of War (DoW) is immediately suspending Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026.
Continue Reading Department of War Immediately Suspends CMMC Phase II Requirements, Launches 60-Day Reform ReviewAll Things Protest: Blue & Gold and Late is Late
Crowell & Moring’s “All Things Protest” podcast keeps you up to date on major trends in bid protest litigation, key developments in high-profile cases, and best practices in state and federal procurement. In this episode, Crowell’s Christian Curran, Zachary Schroeder, and Bryan Dewan discuss a recent Federal Circuit appeal on the Blue & Gold waiver rule, and a Court of Federal Claims protest about the “late is late” rule in the world of electronic proposal submissions.
Continue Reading All Things Protest: Blue & Gold and Late is LateTime for a Change: FedRAMP Fundamentally Revamps Program With Consolidated Rules for 2026
On June 25, 2026, the Federal Risk & Authorization Management Program (FedRAMP) launched its Consolidated Rules for 2026, marking a significant turning point in how the U.S. government administers security authorizations of private sector cloud offerings. The Consolidated Rules apply to all variants of the FedRAMP ecosystem, including legacy “Rev5” authorization holders, as well as future certifications under the new 20x program. Importantly, the Rules are intended in part to transition Rev5 authorizations over to 20x, with the Rev5 authorization status expected to terminate by the end of 2028.
Continue Reading Time for a Change: FedRAMP Fundamentally Revamps Program With Consolidated Rules for 2026All Things Protest: Final Proposal Revisions and Federal Circuit Opinions
Crowell & Moring’s “All Things Protest” podcast keeps you up to date on major trends in bid protest litigation, key developments in high-profile cases, and best practices in state and federal procurement. In this episode, Crowell’s Christian Curran, Zachary Schroeder, and Bryan Dewan discuss a recent GAO sustain about final proposal revisions, along with two notable Federal Circuit opinions from May 2026 covering bid protest intervention and the discretion afforded to agencies in evaluating proposals.
Continue Reading All Things Protest: Final Proposal Revisions and Federal Circuit OpinionsFedRAMP Solicits Public Comment on Overhaul to Incident Communications Procedures
Introduction
The Federal Risk and Authorization Management Program (FedRAMP) continues to advance its modernization agenda. On April 8, 2026, FedRAMP released RFC-0031, Updated Incident Communications Procedures for public comment. This RFC proposes replacing the current FedRAMP Incident Communications Procedures (ICP) with what FedRAMP calls “a clear set of reporting requirements … established using a modern rules-based format.”
Below is a summary of key changes proposed in RFC-0031.
Continue Reading FedRAMP Solicits Public Comment on Overhaul to Incident Communications ProceduresAll Things Protest: Challenging Agency Evaluations of Proposals
Crowell & Moring’s “All Things Protest” podcast keeps you up to date on major trends in bid protest litigation, key developments in high-profile cases, and best practices in state and federal procurement. In this episode, Crowell’s Christian Curran, Zachary Schroeder, and Bryan Dewan discuss challenges contractors face when protesting agency evaluations of proposals, along with
All Things Protest: Corrective Action at the Court of Federal Claims
Crowell & Moring’s “All Things Protest” podcast keeps you up to date on major trends in bid protest litigation, key developments in high-profile cases, and best practices in state and federal procurement. In this episode, Crowell’s Christian Curran, Zachary Schroeder, and Bryan Dewan cover two recent protests at the Court of Federal Claims— Advantaged Solutions
DHS Announces Virtual Town Halls on CIRCIA Final Rule
On February 13, 2026, the U.S. Department of Homeland Security (DHS) announced upcoming virtual town hall meetings scheduled for March 2026 regarding the implementation of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). The meetings will allow industry stakeholders to provide input to DHS to refine the “scope and burden” of the forthcoming CIRCIA final rule.
Continue Reading DHS Announces Virtual Town Halls on CIRCIA Final Rule