As we welcome 2026, it is a good time for government contractors to reflect on their cybersecurity posture and the major shifts in federal data protection policy from 2025. Last year was more than just a year of evolution in the cybersecurity space—it was marked by long-anticipated regulatory milestones and an acceleration of federal enforcement and oversight. For government contractors, understanding these changes is key for internal policy decisions and mitigating risk in the months ahead.
Here is a look back on the most impactful updates from 2025—and what they mean for the coming year.
Finalization of CMMC
The most consequential development of 2025 likely was the finalization of Cybersecurity Maturity Model Certification (“CMMC”) 2.0. In September 2025, the Department of Defense (also known as the Department of War) (“DoD”) issued its final Defense Federal Acquisition Regulation Supplement (“DFARS”) rule, with new requirements in contracts to appear beginning in November 2025 (see our blog here). Contracting Officers now can require specific CMMC levels as a condition of award. DFARS 252.204-7025 is the new CMMC notice provision and DFARS 252.204-7021 is the new compliance provision. These clauses are incredibly important to look out for in solicitations and contracts as they trigger CMMC compliance requirements. The phased rollout means requirements will continue expanding through the late 2020s, but 2025 marked the turning point: CMMC compliance is now enforceable, auditable, and tied directly to contract eligibility.
FCA and Civil Cyber-Fraud Risk
The Department of Justice (“DOJ”) continued advancing its Civil Cyber-Fraud Initiative (“CCFI”), reinforcing that cybersecurity representations can form the basis of False Claims Act (“FCA”) liability. The nine cybersecurity-related settlements in 2025 totaled $52 million. More broadly, 2025 marked a record-breaking year for FCA settlements—totaling $6.9 billion, the highest single-year number in FCA history. Still, CCFI settlements have tripled in each of the past two years, signaling cybersecurity enforcement is a continuing priority for DOJ. This year’s enforcement actions focused on alleged misstatements about cybersecurity controls, incomplete implementation of required safeguards, and failures to disclose known gaps.
The enforcement landscape continues to evolve. Last year we saw a case where a private equity firm was held liable alongside its defense contractor portfolio company (see our blog here). In another case, a former senior manager at a government contractor was criminally indicted for major government fraud, wire fraud, and obstructing federal audits for an alleged scheme to mislead the government about the security of a cloud platform. Specifically, the alleged misrepresentation was that an information system met FedRAMP and DOD Impact Level 4 and 5 security controls.
The takeaway for contractors is clear: cybersecurity compliance is not merely aspirational. Inaccurate certifications, outdated assessments, or unsupported claims can expose companies to significant FCA risk. Going forward, there is a likelihood of increased enforcement risk under CMMC.
FedRAMP 20x and Cloud Modernization
On the cloud side, FedRAMP 20x was announced in March 2025 as a modernization effort designed to streamline cloud authorizations (see our blogs here and here). The initiative includes increased automation, collaboration between government and industry, and updates to the significant change process. We expect to see faster authorization and streamlined continuous monitoring requirements. The initiative rolled out in phases, with Phase One concluding in September 2025. Phase One focused on a general proof of concept with a small group of industry participants with lower impact cloud services. FedRAMP 20x began Phase Two, the FedRAMP moderate pilot, in November 2025. Phases Three, Four, and Five will stretch into 2027 before full implementation of FedRAMP 20x.
Executive Actions
With almost one year under the Trump administration, there has been a flurry of executive actions (see our tracker here for full coverage of executive orders for 2025). Cybersecurity was one of many areas that was not immune to change. A June 2025 Executive Order, Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144, amended prior cybersecurity directives and reaffirmed federal priorities around secure systems and digital infrastructure (see our blog here).
In April 2025, the Office of Management and Budget (“OMB”) released two new memorandums on artificial intelligence (“AI”) as directed by Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence. The first memo (M-25-21) provides guidance to agencies on federal AI use while the second memo (M-25-22) focuses on agency acquisition of AI (see our blog here).
FAR and DFARS Cases
In 2025, we also saw some long-awaited updates to Federal Acquisition Regulations (“FAR”) and DFARS clauses, as well as some that we will continue to wait on through 2026. In January 2025, the proposed FAR Controlled Unclassified Information (“CUI”) rule (FAR Case No. 2017-016) was published (see our full analysis here). At the start of this year, FAR and Defense Acquisition Regulation (“DAR”) staff are still processing feedback received from public comments.
See Tables 1 and 2 for the status of other cyber FAR and DFARS cases to keep an eye on:
| Case | Summary | Status – January 8, 2026 |
| Cyber Threat and Incident Reporting and Information Sharing (Case No. 2021-017) | Authorizes agencies to increase the sharing of information about cyber threats and incident information between Government and certain providers; requires certain contractors to report cyber incidents to the Government to facilitate effective incident response and remediation. | On Oct. 4, 2023, the FAR Council published the proposed FAR rule in the Federal Register (88 FR 68402). The Public Comment period closed on Feb. 2, 2024. On Feb. 28, 2024, the Defense Acquisition Regulations Council (“DARC”) Director tasked the FAR Acquisition Technology Team to review public comments and draft the final FAR rule. The Report was originally due on April 17, 2024, but has been extended again to Feb. 18, 2026. |
| Standardizing Cybersecurity Requirements for Unclassified Federal Information Systems (Case No. 2021-019) |
Ensures Federal information systems are better positioned to protect from cybersecurity threats by standardizing common cybersecurity contractual requirements across agencies for Federal information systems. | On Oct. 4, 2023, the FAR Council published the proposed FAR rule in the Federal Register (88 FR 68402). The Public Comment period closed on Feb. 2, 2024. On Oct. 30, 2024, DARC received the FAR Acquisition Technology Team draft final FAR rule from DAR staff. The team agreed to draft the final rule during a meeting on Nov. 13, 2024. However, on Dec. 5, 2024, FAR staff notified DAR staff of Civilian Agency Acquisition Council (“CAAC”) differences between the team report and DARC suggested changes. DAR and FAR staff are working to resolve the open issues. |
| Supply Chain Software Security (Case No. 2023-002) | Implements Section 4(n) of Executive Order 14028, which requires suppliers of software available for purchase by agencies to comply with, and attest to complying with, applicable secure software development requirements. | On Nov. 2, 2022, the DARC Director tasked FAR Acquisition Technology to draft proposed FAR rule. The initial report was originally due on Dec. 14, 2022, though it has been extended several times. On May 30, 2024, OMB identified draft proposed FAR rule issues. The Office of Federal Procurement Policy, FAR, and DAR staffs are currently resolving issues. |
| Controlled Unclassified Information (“CUI”) (Case No. 2017-016) | Implements (1) NARA CUI program of Executive Order 13556, which provides implementing regulations to address agency policies for designating, safeguarding, disseminating, marking, decontrolling and disposing of CUI; and (2) OMB Memo M-17-12, which provides guidance on PII breaches occurring in cyberspace or through physical acts. | The proposed rule was published in the Federal Register on Jan. 15, 2025 and public comment was open until Mar. 17, 2025. The FAR and DAR staff are now processing comments. |
Table 2 – Pending DFARS Cases
| Case | Summary | Status – January 8, 2026 |
| Updates to the Safeguarding Covered Defense Information and Cyber Incident Reporting Clause (Case No. 2023-D024) | This rule updates DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, to incorporate references to National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-172 requirements, harmonize certain terminology, address international agreements, and streamline the vendor identification process. | On Oct. 4, 2023, the DARC Director tasked the FAR Acquisition Technology Team to draft proposed DFARS rule. The report was originally due on Dec. 20, 2023, but was extended again to Jan. 28, 2026. |
| NIST SP 800-171 DoD Assessment Requirements (Case No. 2022-D017) | This rule was split from DFARS Case 2019-D041, to implement the NIST SP 800-171 DoD Assessment Methodology, which enables the DoD to assess contractor implementation of the cybersecurity requirements in NIST SP 800-171. | This rule is in the “Final Rule Stage” and Final Action was anticipated in Oct. 2024. The report was originally due on Apr. 6, 2022, but has been extended again to Jan. 28, 2026. |
Looking Ahead
As we step into 2026, government contractors find themselves navigating an evolving landscape of data security requirements. Recent regulatory updates, especially CMMC, and heightened enforcement priorities underscore the federal government’s commitment to safeguarding sensitive data and combating emerging cyber threats. Understanding these changes is essential to managing risk and maintaining eligibility for federal awards. Contractors must remain proactive to avoid missteps.