Authored by:
Scott Singer, CEO, CyberNINES and
Nicole Vele, Of Counsel, Holland & Hart LLP
Cyber-attacks against America’s defense industrial base are becoming more sophisticated and more frequent. To reduce the risk of sensitive national security information landing in the hands of bad actors, the Department of Defense requires all defense contractors and subcontractors to protect their networks with specified network security requirements.[1] So, whether your company stores Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) or merely transmits it via your company’s unclassified information system, you are required to comply with the Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) Program.[2]
Finalized on December 16, 2024, and anticipated to be written into contracts starting in September 2025, the DoD’s CMMC Program has three certification levels: (1) CMMC Level 1 (Self-Assessment); CMMC Level 2 (Self-Assessment) & (2) CMMC Level 2 (Certification); and (3) CMMC Level 3 (Certification). The CMMC Level required of your information system is based on your company’s contracts. Upon release this fall of the contract clause associated with CMMC, companies will initially be required to self-attest to either CMMC Level 1 or Level 2. DoD will have the option to require CMMC Level 2 certification in the first year, but after that it will be phased over time into all contracts.
As important as these rules are, it’s not always easy to navigate them. To ensure you are ready to meet CMMC’s rigorous standards, this article will highlight the Federal Acquisition Regulations (FAR) and Defense Federal Acquisition Regulations Supplement (DFARS) clauses in your contracts that govern CMMC, provide some practical advice for understanding the basics of compliance under each clause, and discuss the risks associated with non-compliance.
Despite the complexities associated with effective cybersecurity, you will only find a handful of clauses in your federal contracts that discuss the safeguarding requirements and procedures for contractor-owned or -operated information systems. The first clause we will discuss is FAR 52.204-21. This clause became effective June 15, 2016, and it, along with FAR 4.19[6], set the baseline safeguarding requirements for all contractor-owned or -operated information systems that process, store, or transmit FCI[7].
Per FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, there are fifteen security controls (figure 1) that covered contractors and subcontractors must employ to safeguard their information systems if they want to work with the federal government. These requirements were meant to include the most basic safeguards that a prudent businessperson would exercise even if a federal regulation did not exist.
| 1 | Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) |
| 2 | Limit information system access to the types of transactions and functions that authorized users are permitted to execute |
| 3 | Verify and control/limit connections to and use of external information systems |
| 4 | Control information posted or processed on publicly accessible information systems |
| 5 | Identify information system users, processes acting on behalf of users, or devices |
| 6 | Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems |
| 7 | Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse |
| 8 | Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals |
| 9 | Escort visitors and monitor visitor activity, maintain audit logs of physical access, and control and manage physical access devices |
| 10 | Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems |
| 11 | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks |
| 12 | Identify, report, and correct information and information system flaws in a timely manner |
| 13 | Provide protection from malicious code at appropriate locations within organizational information systems |
| 14 | Update malicious code protection mechanisms when new releases are available |
| 15 |
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. |
Figure 1 - FAR 52.204-21 Security Controls
Around the same time FAR 52.204-21 was implemented, the National Archives and Records Administration (NARA) issued its final rule on CUI,[8] and NARA worked with NIST to develop guidelines for how CUI should be protected when not under direct federal control.[9] These guidelines are found in NIST SP 800-171. Based on NARA’s CUI rules, the DoD implemented DFARS 252.204-7012, which requires contractors to implement NIST 800-171 for all information systems they own or operate that handle Covered Defense Information (CDI).
Bottom line: a contractor or subcontractor working directly or indirectly with the DoD that handles CDI must protect it. Per DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, DoD contractors are required to:
The next clause we will discuss is DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements. This clause requires DoD contractors and subcontractors to review the solicitation to determine whether they are required to implement NIST SP 800-171 to be considered for award. If so, contractors and subcontractors must have a current assessment for each covered contractor information system relevant to the offer, contract, task order, or delivery order and submit their results to the DoD’s Supplier Performance Risk System (SPRS).
Contractors may also be subject to DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements. If so, contractors must ensure their facilities, systems, and personnel are available for Government assessors to conduct a Medium or High NIST SP 800-171 DoD Assessment.
Finally, DFARS 252.204-7021, Cybersecurity Maturity Model Certification Requirements, outlines what CMMC certification level DoD contractors must achieve and maintain to be eligible for a DoD contract. CMMC certifications must be renewed every three years, and contractors must maintain yearly self-affirmations that all requirements applicable to the certification level are maintained.
Now that you know the cybersecurity clauses to look for in your federal contracts, it is just as important to understand the risks of noncompliance. Data shows that defense contractors are increasingly the target of recurrent and progressively sophisticated cyberattacks.[11] These attacks can have several severe consequences, including the loss of contracts, financial damage, reputational harm, and disruptions to national security.[12] And if the threat of those consequences fails to deter your company from noncompliance, there is also the threat of civil False Claims Act liability and suspension or debarment.
In 2021, the Department of Justice (DOJ) instituted a Cyber-Fraud initiative and began pursuing False Claims Act cases against companies and individuals who fail to abide by the cybersecurity requirements in government contracts.[13] Under this program, the DOJ has initiated multiple civil actions against corporations and universities for violations of cybersecurity requirements. In fiscal year 2024, those actions resulted in more than $14M in recoveries.[14] Additionally, agencies have started pursuing suspension and debarment actions against contractors for willful failures of cybersecurity requirements.[15] Given the gravity of what is at stake, defense contractors and subcontractors cannot afford to disregard their contractual cybersecurity requirements. Not only does their business depend on it, but so does our national security.
Please feel free to contact CyberNINES or Holland and Hart for more information on how we can help you with CMMC compliance or with your questions on federal contracts.
[1] See DoD Instruction 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information.
[2] See 32 C.F.R. § 170.
[3] See Office of the Secretary of Defense Memorandum Implementing the Cybersecurity Maturity Model Certification (CMMC) Program: Guidance for Determining Appropriate CMMC Compliance Assessment Levels and Process for Waiving CMMC Assessment Requirements, Attachment 1, dated January 17, 2025.
[4] Id.
[5] Id.
[6] FAR 4.1903 requires contracting officers to include FAR 52.204-21 in solicitations and contracts when the contractor or a subcontractor at any tier may have FCI residing in or transiting through its information system.
[7] Federal contract information is defined as information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as that necessary to process payments.
[8] Wallace, Janel C., “Safeguarding Federal Data,” Defense Acquisition Magazine, November-December 2017, accessed on April 28, 2025, at Safeguarding Federal Data | www.dau.edu.
[9] Id.
[10] CMMC and DFARS 252.204-7012 overlap significantly in that CUI, which requires CMMC certification at Level 2 or higher, is a subset of CDI and must be protected.
[11] Faver, Alan D., “Cybersecurity in the Defense Industrial Base: Evolving Cybersecurity Regulations for Defense Contractors,” Deloitte, accessed on May 1, 2025, at Cybersecurity in Defense: New Approaches for Contractors | Deloitte US.
[12] Id.
[13] “Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative,” U.S. Department of Justice, Press Release Number: 21-971, October 6, 2021, accessed on May 1, 2025, at Office of Public Affairs | Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative | United States Department of Justice.
[14] “False Claims Act Settlements and Judgments Exceed $2.9B in Fiscal Year 2024,” U.S. Department of Justice, Press Release Number: 25-58, January 15, 2025, accessed on May 1, 2025, at Office of Public Affairs | False Claims Act Settlements and Judgments Exceed $2.9B in Fiscal Year 2024 | United States Department of Justice.
[15] “Miller, Dustin, Risks of Non-Compliance and Lack of Risk Management for CMMC Companies,“ March 11, 2025, Sikich, accessed on May 1, 2025, at Risks of CMMC Non-Compliance and Lack of Risk Management - Sikich.