As a result, the mandatory contract clause at the center of the FAR DEI Order remains in force: All federal contractors and subcontractors, including colleges and universities that hold federal contracts or subcontracts, will be required to accept a clause barring “racially discriminatory DEI activities,” backed by reporting and records-access obligations and termination and debarment remedies, as well as the risk of potential False Claims Act liability. At the same time, the court gave the clause a meaningfully narrow reading that contractors and subcontractors can rely on: The operative phrase, “disparate treatment based on race or ethnicity,” carries its settled legal meaning of intentional discrimination already prohibited by federal law.

Read on to learn more about the decision and what it means for higher education institutions.

Building on Executive Order 14402 and an August 18, 2026 memorandum regarding supplier transparency considerations, the reforms described in the Memorandum aim to lower barriers to entry and align procurement with commercial practices. With major actions due within 30 to 90 days, contractors should promptly assess the effects on accounting, pricing, systems, and compliance. For prime contractors, subcontractors and new entrants alike, the Memorandum signals a significant change in how DoW will price, audit, and oversee defense work, although many of its directives depend on further agency guidance, class deviations, rulemaking, and CAS Board action.

Key Takeaways

• CAS-to-GAAP Transition. GAAP will become DoW’s accounting baseline, with limited, specific exceptions where CAS will continue to apply.
• Fixed-Price as Default. Fixed-price contracts become standard; cost-based contracts are to be reserved for research and major-system development where no reliable market price exists.
• Business Systems, Audits, and Transparency. Business-system reviews will be consolidated around commercial-aligned criteria, independent CPA certification may replace government review, and audits will be risk-based without rereview of previously audited costs. Supplier requests will follow a price-first approach, use information already maintained, and prohibit automated system access absent contractual authorization.
• Timeline and Next Steps. Most implementing actions are due within 30, 60, or 90 days, with the most significant CAS-related changes requiring action by the CAS Board. Contractors should expect fewer government-unique accounting and business-system requirements alongside continued requests for cost data where market pricing is unavailable.

Background

The Memorandum is the latest step in a series of acquisition reforms. To that end, Executive Order 14402, “Promoting Efficiency, Accountability, and Performance in Federal Contracting,” signed April 30, 2026, directs agencies to use fixed-price contracts, tie profit to performance-based metrics, to the maximum extent consistent with law, and provide written justification for non-fixed-price contract types. Then, on August 18, 2026, the Deputy Secretary issued a memorandum titled “Supplier Cost and Pricing Transparency,” which established new DoW expectations for obtaining cost and pricing information from industry, including at the supplier level. And, most recently, the Memorandum seeks to tie these threads together. It describes the DoW’s goal as to rely on cost data drawn from a company’s existing records rather than invasive oversight if no market exists, while letting the market set price where competition, comparable sales, or reliable price history are available. The Memorandum also states that requesting cost or pricing information does not alone create a cost-reimbursement contract or mandate CAS coverage, and it does not alter the thresholds or exceptions for certified cost or pricing data. The CAS Board has already moved in a similar direction, rescinding several standards it found duplicative of GAAP in a July 8, 2026 final rule and raising CAS thresholds in a final rule that became effective on October 1, 2026.

Key Provisions of the Memorandum

The Memorandum includes a number of consequential provisions:

• The DoW will shift accounting from CAS towards GAAP and propose, within 60 days, changes to the CAS Board that would make CAS exemption the Department’s default process and attach any remaining CAS coverage requirements to specific contracts, not companies.
• The DoW will require commercial product and service determinations to  be completed within 15 business days, with prior determinations standing unless reversed in writing.
• The DoW will expand Other Transaction (OT) cost policy through interim guidance within 45 days and reissue full OT Guide within 120 days, to include terms related to milestone-based payments and streamlined eligibility procedures. Within 90 days, the Department also intends to begin DFARS rulemaking so negotiated profit reflects value, risk, and invested capital rather than cost alone.
• The DoW will consolidate business-system requirements into commercial-based criteria, with independent public accounting firm certification accepted in place of government review. Audits will be risk-based, consider GAAP financial statements first, and seek to avoid re-reviewing previously audited costs or reopening closed years absent indicia of fraud or material misstatement.
• The DoW will shift supplier transparency to a price-first approach and request cost supplier information only as needed in the contractor’s existing format and prohibit automated system access without contractual authorization.
• Finally, the DoW intends to pursue advance market commitments, including aggregated allied demand, to support demand certainty and industrial-base growth.

Implementation Timeline

The memorandum requires rapid implementation, to include the following key deadlines:

• 30 days (approximately October 14, 2026): procedures implementing the August 18 supplier-transparency memorandum, the prohibition on shadow CAS, an efficiency-assurance enforcement statement for fixed-price contracts and other transactions, and a consortium policy for other transactions.
• 45 days (approximately October 29, 2026): commerciality determination guidance and interim other transaction policy.
• 60 days (approximately November 13, 2026): CAS Board proposals, a CAS waiver policy with standing justification templates, risk-based audit direction, and business-system criteria with an accompanying class deviation.
• 90 days (approximately December 13, 2026): business-system consolidation, initiation of the profit-policy rulemaking, annotation of sub-FAR and sub-DFARS requirements with their authority, options for realigning DCAA and DCMA roles, and revision of inconsistent subordinate guidance.
• 120 and 180 days: reissuance of the full OT Guide and additional advance market commitments led by the Defense Innovation Unit.

Practical Implications for Government Contractors

While the Memorandum generally reduces compliance burden, it does not reduce DoW’s interest in seeking accurate cost information. Contractors should expect contracting officers to request cost data in the form already kept in corporate books whenever price, market, and sales data are insufficient.  These actions are consistent with the August 18 memorandum, which confirmed similar efforts at the supplier level.

In addition, DoW’s shift to fixed-price contracting under Executive Order 14402 and the Memorandum also shifts cost and performance risk to the contractor, placing a premium on reliable estimating. The efficiency assurance offers some comfort, since a contractor that is efficient in the performance of a negotiated fixed price is permitted to keep the savings on that contract.  That said, contractors should be advised that the Memorandum expressly preserves remedies for fraud, defective pricing, and CAS price adjustments, each of which remains actionable under controlling statutory law. Contractors may want to consider the following steps:

• Inventory CAS-covered and potentially covered contracts and business units and assess eligibility for the higher thresholds, available exemptions, and the forthcoming waiver policy.
• Evaluate whether GAAP-based records, audited financial statements, and internal-control attestations can support pricing and future business-system certifications.
• Review existing contracts for business-system, earned value management, and property clauses that may be removed through bilateral no-cost modifications and decide whether to request those modifications.
• Prepare for supplier-level cost and pricing requests, including how data will be produced, protected, and limited to the pricing action for which it was requested.
• Strengthen estimating and risk-pricing capabilities ahead of increased fixed-price awards.
• Review subcontracts and teaming agreements to ensure that flowdowns reflect the narrowed requirements and government-provided benefits pass through the supply chain.
• Monitor the implementing guidance, class deviations, CAS Board activity, and the DFARS profit-policy rulemaking and consider engaging with DoW while such guidance is being developed.

Because most of the Memorandum’s directives require further agency action, and the core CAS reforms depend on the CAS Board, the practical effect will turn on the implementing documents DoW issues over the coming months. McGuireWoods will continue to monitor these developments. For questions about the Memorandum or its effect on your contracts, accounting systems, or compliance programs, please contact the authors or another member of the McGuireWoods Government Contracts team.

Associate Attorney General Stanley E. Woodward, Jr. framed the revisions in terms of regulatory restraint: “The Department of Justice should enforce the law, not make law through enforcement. These updates reflect the Department’s commitment to fair notice, transparent enforcement, and the rule of law.”

I. Revisions to JM 1-19.000: Limits on Agency Guidance

First, the revisions provide that DOJ will not bring an enforcement action solely predicated on alleged violations of agency guidance that purports to create new legal obligations. The revised section incorporates the Administration’s previously communicated prohibition on the department’s use of “guidance documents” as the basis for creating substantive rights and obligations (Reinstating the Prohibition on Improper Guidance Documents.pdf) and builds upon similar restrictions on the use of sub-regulatory guidance issued during the first Trump Administration (memo_re_agency_guidance_documents.pdf) that were rescinded by Attorney General Merrick Garland in 2021 (attorney_general_memorandum_-_issuance_and_use_of_guidance_documents_by_the_doj712021.pdf). The revision explains that DOJ guidance may not be a substitute for regulation or impose new requirements on entities outside the Executive Branch unless authorized by law or contract. The revision also provides that the Department shall not issue guidance that purports to create binding rights or obligations outside the Executive Branch or otherwise establish the standard by which DOJ will determine compliance with existing law. To reinforce that distinction, the new requirements call for clear labeling, including disclaimers that the document has no force of law or binding effect outside the Executive Branch and an express statement that voluntary standards will not, by themselves, trigger enforcement. DOJ guidance also must avoid coercive or mandatory language, including “shall,” “must,” and “required,” unless it is accurately restating a clear statutory, regulatory, or judicial mandate.

More significantly for government contractors, healthcare providers, and federal grant recipients, the revised section also replaces the ability for attorneys to cite or rely on guidance as the basis for enforcement action with a more defined framework for bringing such actions. Stated differently, civil and criminal enforcement actions must be based on violations of applicable legal requirements, not mere noncompliance with agency guidance, under the new regime, and the Department may not proceed solely on an allegation that a party failed to follow a guidance document.

That said, the revisions also indicate guidance may nonetheless still be relevant when it bears on scienter, notice, knowledge, or other mens rea standards; provides evidence of professional or industry standards, duties, customs, or practices; reflects generally accepted scientific or technical processes; bears on a party’s compliance when that compliance is itself part of the claim, such as a false certification or a contractual commitment; or supplies legal or factual context in a filing. Those uses do not give the guidance force of law, establish the applicable mental-state standard, or make the agency’s interpretation conclusive. The revised section illustrates these categories with examples from healthcare, government fraud, and technical fields, while leaving the underlying statutory, regulatory, or contractual requirement as the basis for liability.  As a general matter, these carve outs from the broader policy may provide DOJ attorneys with ample grounds on which to rely on guidance documents, notwithstanding the broader policy statement.

Based on these changes, we would generally expect agencies attempting to change legal requirements or create new rights and obligations through an FAQ response, informal guidance documents, agency memoranda, directive, etc., may face reluctance (or at least questions) from the Department when attempting to bring enforcement actions predicated on violations of obligations ostensibly imposed by such guidance documents. That said, given the areas in which informal guidance may nonetheless be used, we would expect that the revisions do not necessarily mean that such guidance will be of no importance or play no role in the government’s evaluation of liability under the False Claims Act moving forward. Stated differently, notwithstanding these revisions, contractors, healthcare entities, and federal funding recipients remain well served to continue reviewing and considering agency guidance in connection with their broader compliance and operational activities to ensure that such guidance can continue to inform their actions in mitigating if not avoiding compliance risk.

II. Revision to JM 4-4.111: DOJ Dismissal of Qui Tam Actions

In addition, the revisions require prosecutors to evaluate every declined qui tam case for dismissal using a broadened list of factors.  Specifically, the prior version of this Justice Manual section directed prosecutors considering a declination to consider whether a motion to dismiss the qui tam complaint would serve the government’s interests. The revised language bolsters that consideration, mandating that the Department assess dismissal in every declined case. If dismissal is not warranted when the Department declines intervention, then the Department may reassess the issue as the litigation develops. The revised policy therefore requires a recurring evaluation without creating an automatic presumption that declined cases should be dismissed.

The Department also revised the list of factors for consideration when assessing whether to move to dismiss a qui tam complaint. The updated factors place greater emphasis on preventing parasitic or opportunistic actions that duplicate a pre-existing government investigation without adding useful information. That consideration now appears first, while the former (and previously more detailed) description of facially meritless claims has been condensed into a second factor addressing meritless qui tams, followed by factors concerning interference with agency policy or program administration, control of litigation brought on behalf of the United States, protection of classified information and national security, preservation of government resources, and egregious procedural errors that could frustrate a proper investigation.

These are positive developments for qui tam defendants, and we expect this Administration to continue to be more favorably disposed towards proactively moving to dismiss meritless whistleblower suits.

III. Practical Implications for Government Contractors, Healthcare Entities, and Federal Funding Recipients

Federal contractors, healthcare entities, and federal funding recipients now have a clearer basis to challenge FCA theories that treat sub-regulatory guidance as an independent legal obligation. Agency guidance may still support scienter or proof of professional standards, and it remains relevant where a party falsely certifies compliance or a contract or provider agreement makes compliance part of the bargain. For example, compliance programs would be well served to distinguish between voluntary guidance and binding requirements, and contractors should ensure that certifications or other statements to government officials do not overstate adherence to guidance that the organization does not follow.

For defendants in declined qui tam cases, the Department’s mandatory assessment may produce more motions to dismiss, particularly where a relator’s allegations duplicate an existing audit or investigation and add little information. This presents defendants with a possible opportunity to influence prosecutors’ decisions at such time, particularly where the defendant has played an active role in responding to government inquires and transparently cooperated with the government investigation. The Department may also revisit dismissal later, so parties should not assume that its initial decision to decline intervention will remain its final position, particularly as litigation lasts for a protracted period of time or results in multiple amended complaints following dismissals or the facts (or substantive lack thereof) warrant further reconsideration.

For questions or counsel about these topics, contact the authors of this article listed below, or another member of the McGuireWoods Government Investigations & White Collar Litigation, Government Contracts, or False Claims Act Investigations & Litigation Practice Groups.

Specifically, the settlement resolves allegations that, from April 2020 through December 2023, Honeywell Aerospace (then operating as a business unit of Honeywell International) submitted false claims for payment by failing to comply with cybersecurity requirements specified in National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-171 with respect to one of Honeywell’s networks, as required by the applicable DoW regulations and the company’s DoW contracts. The company’s DoW contracts incorporated Defense Federal Acquisition Regulation Supplement (“DFARS”) clause 252.204-7012, which requires contractors and subcontractors handling Controlled Defense Information, including Controlled Unclassified Information (“CUI”) to implement, or have a plan to implement, the 110 security controls set forth in NIST SP 800-171 rev. 2. These controls span an array of categories, including access controls, audit and accountability, incident reporting, physical protection, and risk and security assessments.

The allegations that resulted in the settlement arose out of a qui tam whistleblower lawsuit under the FCA by a former Honeywell employee. The FCA’s qui tam provisions allow private citizens to sue on behalf of the government and share in any recovery under the claim.  The resolution was a coordinated effort between the DOJ Civil Division’s Commercial Litigation Branch, the U.S. Attorney’s Office for the Western District of North Carolina, and the Defense Criminal Investigative Service. The case is captioned United States ex rel. Rachel Tenney v. Honeywell International Inc., Civil Action No. 3:22-cv-129 (W.D.N.C.). As with many FCA settlements, the settlement expressly provided that the claims resolved constituted only allegations, with no determination or admission of liability.

Significance and Enforcement Context

The Honeywell Aerospace settlement continues in DOJ’s escalating cyber-enforcement posture. Specifically, in October 2021, DOJ launched the Civil Cyber-Fraud Initiative, which leverages the FCA to pursue government contractors and grant recipients that provide deficient cybersecurity products or services, misrepresent their cybersecurity practices, or violate obligations to monitor and report cybersecurity incidents. Since its inception, the Initiative has produced a growing series of settlements,  including the $9 million Aerojet Rocketdyne settlement in 2022 and the $1.75 million Aero Turbine/Gallant Capital settlement in July 2025. To that end, DOJ has reported that cybersecurity fraud resolutions have more than tripled in each of the past two fiscal years; in fiscal year 2025 alone, DOJ recovered $52 million across nine cyber-related FCA settlements, part of a record-breaking $6.8 billion in total FCA recoveries.

The Honeywell Aerospace case involved a multi-year period of alleged noncompliance with controls related to a single network, reinforcing that DOJ scrutiny extends not only to systemic failures, but also to lapses affecting discrete systems or enclaves. The case also highlights the central role of whistleblowers, with the qui tam relator being a former employee, consistent with DOJ’s observation that insider tips remain a primary driver of cybersecurity FCA enforcement.

The enforcement trend also comes as the government has paused implementation of the Cybersecurity Maturity Model Certification (“CMMC”) 2.0 program, which was poised to require third-party assessments for certain levels of contractor cybersecurity compliance. The CMMC 2.0 pause has, at a minimum, extended the use of certain cybersecurity self-certifications and may place more significance on enforcement actions as a means for ensuring compliance with cybersecurity requirements. The evolving regulatory landscape thus creates an increasingly challenging enforcement environment for contractors and subcontractors handling CUI.

Key Takeaways for Government Contractors

DoW contractors and subcontractors would be well served to continue to regularly evaluate their cybersecurity compliance postures, including in the following areas:

1. Assess and document NIST SP 800-171 compliance rigorously. DoW contractors and subcontractors handling CUI should ensure that compliance with NIST SP 800-171 is not only implemented but also documented with current, scoped evidence. Having policies on paper is insufficient. Contractors may need to demonstrate that policies match operating practice and that gaps are identified, remediated, or formally accepted with a plan of action and milestones.
2. Scope your compliance precisely.  The Honeywell Aerospace case involved alleged noncompliance on a single network. Contractors should define clear system boundaries for each covered contractor information system, ensure that applicable controls are implemented and tested within those boundaries, and verify the accuracy of any Supplier Performance Risk System (“SPRS”) scores before submission.
3. Take whistleblower risk seriously. Many recent cybersecurity FCA cases have originated from qui tam relators, often current or former employees with inside knowledge of compliance gaps. DoW contractors and subcontractors should maintain robust internal reporting channels (as required under many government contracts), take employee cybersecurity concerns seriously, and investigate and address reported deficiencies promptly.
4. Consider the value of voluntary self-disclosure. While the Honeywell Aerospace settlement was triggered by a whistleblower’s qui tam complaint, DOJ has demonstrated (as in the recent Aero Turbine/Gallant Capital matter) that it will credit contractors that self-disclose cybersecurity violations, cooperate with investigations, and take prompt remedial action. Contractors that identify compliance gaps may wish to carefully evaluate whether voluntary self-disclosure may mitigate potential FCA exposure.
5. Prepare for the evolving regulatory landscape. With CMMC 2.0 implementation paused, the importance of cybersecurity self-certifications by defense contractors may be subject to increased scrutiny, including through Defense Industrial Base Cybersecurity Assessment Center (“DIBCAC”) and other DoW subagency audits or assessments. Contractors may wish to continue evaluating their readiness for third-party assessments and monitoring developments in both DFARS and CMMC requirements, given that those requirements mirror the DFARS 252.204-7012 requirements that are already mandatory under all DoW contracts involving CUI.

For questions about this settlement, the Cyber-Fraud Initiative, or how these developments may affect your organization’s government contracts or cybersecurity programs, please contact a member of the McGuireWoods Government Contracts or Data Privacy & Cybersecurity teams.

Read on to learn more about expected congressional interest in corporate use of PRC-developed AI models.

The joint statement addresses SAR confidentiality under the Bank Secrecy Act (“BSA”) as applied to bank and credit union communications with customers about potentially fraudulent transactions, other suspicious activity (including check fraud), or account closures.  It does not alter existing BSA requirements or create new supervisory expectations.  Rather, the joint statement follows a June 2025 request for information from the public issued by the Federal Reserve, FDIC, and OCC concerning payments fraud.  In response, commenters raised concerns about the ability of bank personnel to communicate with customers when a bank may file or has filed a SAR concerning potentially fraudulent activity.  It also reflects concerns raised in Executive Order 14331, Guaranteeing Fair Banking for All Americans, which directed federal banking regulators to remove from supervisory materials the use of “reputation risk” – or equivalent concepts – that could result in unlawful debanking.  Instead, the Administration announced a policy that banking decisions should be based on “individualized, objective, and risk-based analyses” rather than a customer’s political or religious beliefs or lawful business activities.

The Key Distinction

Subject to limited carve-outs, the BSA and its implementing regulations prohibit disclosing a SAR, or information that would reveal the existence of a SAR, to a customer or other person who is the subject of the SAR.  But FinCEN’s implementing regulations exclude from the prohibition “the underlying facts, transactions, and documents upon which a SAR is based.”  That distinction is the heart of the guidance: banks and credit unions may discuss the underlying facts, transactions, and documents (including dates, amounts, and parties) with a customer or with third parties, including other banks or credit unions, and may notify a customer of an intended account closure for suspected fraud or other suspicious activity, provided the communication does not reveal the existence of a SAR.  Banks and credit unions should make those determinations on a case-by-case basis and take precautions when discussing information that could reveal a SAR’s existence.  This holds even if a reasonable and prudent person familiar with SAR requirements might suspect or deduce that one was filed; the underlying information alone cannot reveal the existence of a SAR.

Communications Typically Permitted

Banks and credit unions may file a SAR without taking any action on a customer account.  When action is taken, communications with customers are typically minimalist.  But the joint statement provides examples of communications, including due diligence questions, that would not run afoul of the confidentiality requirement.  The joint statement provides a non-exhaustive list of customer communications that typically would not reveal a SAR’s existence:

• Requesting due diligence information to understand a customer relationship.
• Notifying a customer that an account or service delay, restriction or closure, or a rejected deposit, may relate to suspected fraud or other suspicious activity.
• Inquiring about the purpose of a transaction or source of funds.
• Providing fraud-related warnings or educational resources.
• Communicating policies or account decisions, such as declining a transaction or closing an account, or requesting originator or beneficiary information on a funds transfer.

Practical Takeaways

Banks may consider:

• Updating training materials and internal guardrails to reflect the agencies’ clarification that discussing underlying facts, transactions, and documents with customers does not violate SAR confidentiality.
• Revising correspondence, i.e., account-closure notices, to remove unnecessarily restrictive language driven by SAR-related concerns.

• Coordinating with fair-banking teams responsible for compliance with Executive Order 14331’s focus on prohibiting politicized or unlawful de-banking.
• Reassessing policies on inter-institutional information sharing.
• Evaluating other applicable restrictions on information sharing, including privacy and other federal or state law requirements.

Bottom Line

Financial institutions should treat the joint statement as an opportunity to reassess customer communication practices and modify, as appropriate, unnecessarily restrictive interpretations of SAR confidentiality.  The joint statement gives institutions substantially more clarity on permissible communications regarding suspicious transactions and account actions without violating SAR confidentiality, while preserving the fundamental rule that neither a SAR nor information revealing its existence may be disclosed.

McGuireWoods will continue to monitor developments and publish updates as new guidance is issued.  For questions about SAR confidentiality or anti-money laundering compliance generally, contact the authors of this article or another McGuireWoods attorney you work with.

On August 17, 2026, the Department of War issued formal notifications to 30 domestic academic institutions directing them to initiate immediate and comprehensive reviews of their academic, financial, and research collaborations with foreign entities of concern.  The notifications were executed by the Office of the Under Secretary of War for Research and Engineering and announced in a press release from the Department.

The action targets active institutional ties and collaborations with foreign entities identified under Section 1286 of the FY19 National Defense Authorization Act, as well as organizations associated with rebranded Confucius Institutes.  Confucius Institutes, funded by the Chinese government, were established on campuses nationwide ostensibly as cultural exchange programs. The Department’s focus on “rebranded” institutes suggests concern that some programs may have continued operating under different names.

The Department’s list of problematic entities reportedly includes 130 organizations from China, Russia, and Iran, ranging from electronic measurement laboratories to scientific research centers.

Compliance Requirements

To maintain eligibility for future federal research funding, notified universities must take the following steps by August 31, 2026: (i) complete a comprehensive audit of all identified foreign collaborations; (ii) assess exposure of sensitive or export-controlled research to foreign entities; (iii) implement strict mitigation plans, including the termination of problematic partnerships; and (iv) report findings and actions directly to the Department.

Congressional Coordination

The Department is pursuing this effort alongside partners in Congress, including the House and Senate Armed Services Committees, the House and Senate Appropriations Committees, and the House Select Committee on the Chinese Communist Party.   This coordination signals a bipartisan, multi-branch commitment to protecting federally funded research from foreign exploitation.

Next Steps

Institutions should act now to assess and address their exposure. First, all recipients of federal funding (including those not notified by the Department) should review their foreign collaboration portfolios—particularly ties to entities in China, Russia, and Iran—against the Section 1286 list and known Confucius Institute affiliates. Institutions should also evaluate the status and effectiveness of their export control compliance protocols.  To the extent potentially problematic partnerships, as described in the notice, or export control gaps are identified, institutions should consider whether and what mitigation they can and are willing to implement.

Further, institutions should engage internal stakeholders and counsel early, as responding to the Department’s mandate, or preparing for potential future inquiries, will require close coordination among senior leadership, governing boards, general counsel, research offices, and compliance personnel. Given the extremely compressed August 31, 2026 deadline, this process should begin promptly for noticed institutions.

McGuireWoods will continue to closely monitor expanded actions, as the Department has indicated that these audits will help it identify emerging risks and respond to changing threat patterns, suggesting that this initiative may grow in scope or be followed by additional requirements. McGuireWoods has prepared a team internally that can assist targeted colleges and universities, if and as needed.  Whether you have received one of the notices, it is important for all research institutions—particularly R1 institutions—to understand that this security audit has occurred and could expand into a larger regulatory matter.

For questions or assistance on evaluating your response to the Department’s letter, contact the authors or a member of McGuireWoods’ Higher Education Enforcement & Regulatory Counseling Practice Group.

The Story So Far

On January 1, 2021, Congress enacted the CTA as part of the Anti-Money Laundering Act of 2020, creating a sweeping new federal requirement for corporations, LLCs, and similar entities to report their beneficial owners to FinCEN.  The implementing regulations (the “Reporting Rule”) took effect January 1, 2024, and applied to tens of millions of domestic and foreign companies, many of whom invested significant resources to understand their compliance obligations.

What followed was a parade of legal challenges.  Federal courts issued multiple nationwide injunctions.  Deadlines shifted repeatedly.  Compliance timelines became a moving target.  (Readers of this blog will recall our many updates tracking each twist and turn.)

In March 2025, Treasury suspended enforcement against U.S. companies and issued an interim final rule exempting them on a temporary basis.  This week, the Trump administration ended the battle when FinCEN made those exemptions permanent.

Relief for Domestic Companies

For the vast majority of American businesses, the news is simple: you’re done.  The final rule permanently removes all domestic entities from the definition of “Reporting Company.”  U.S. companies need not file initial BOI reports, updates, or corrections — now or ever.  U.S. persons who are beneficial owners or company applicants of any reporting company have no obligation to provide their information.  And U.S. persons who previously obtained FinCEN IDs no longer need to keep that information current.  FinCEN also said it will delete previously submitted U.S. person data from its database.

But Not for Everyone: Foreign Reporting Companies Stay in Scope

Here’s the catch.  Entities formed under the law of a foreign country and registered to do business in the United States still must report.  These companies must provide:

• Entity-level identifying information (legal name, trade names, U.S. address, jurisdiction of formation, state of registration, and TIN).
• BOI for their non-U.S. beneficial owners.

They do not need to report any U.S. person beneficial owners or company applicants — that’s new relief from the final rule.  But their foreign owners remain reportable.

Foreign pooled investment vehicles have a special rule: they must report BOI only for a non-U.S. person who exercises substantial control.  If only U.S. persons exercise substantial control, the entity need not report any beneficial owners at all.  Foreign FinCEN ID holders must continue to update or correct their information within 30 days of any change.

Quick Q&A

• Q: What happens to BOI that U.S. persons already filed?  FinCEN will purge it.  The agency is developing a process to identify and remove records linked to U.S. persons (e.g., submissions tied to a U.S. passport or driver’s license) and expects to coordinate with the National Archives to ensure compliance with federal records-retention rules.
• Q: Why keep the requirement for foreign entities but not domestic ones?  Treasury views foreign-organized entities as posing heightened illicit-finance risk.  It also concluded that the CDD Rule already gives law enforcement meaningful visibility into domestic ownership, making a separate federal filing obligation for millions of small businesses unnecessary.
• Q: Will my bank stop asking for ownership information?  No.  The CDD Rule is a separate obligation that requires financial institutions to collect BOI from business customers at account opening.  It is unaffected by this final rule.
• Q: I have a FinCEN ID.  Do I still have obligations?  Not if you’re a U.S. person.  Non-U.S. persons must still update their FinCEN ID information within 30 days of any change.

McGuireWoods will continue to monitor developments and publish updates as new guidance is issued.  For questions about the CTA or anti-money laundering compliance generally, including customer due diligence and beneficial ownership rules, contact the authors of this article or another McGuireWoods attorney you work with.

Read on for an analysis of how existing discovery rules already reach AI-generated content, the sanctions companies may face for failing to preserve it, and the practical steps clients should take now to close the gap.

I. Why Generative AI Has Outpaced Existing Retention Policies

The rapid adoption of generative AI tools across the enterprise has exposed fundamental gaps in corporate information governance. Most retention policies define “records” by reference to a specific system or format—email servers, shared network drives, structured databases—rather than by the function the underlying information performs. This definitional approach leaves AI-generated content in a regulatory blind spot. Critically, however, whether AI-generated content qualifies as a formal “record” under a company’s retention schedule is largely beside the point once litigation is reasonably anticipated: a legal hold requires preservation of all potentially relevant information, regardless of its designation in the retention schedule.

Many AI platforms apply rolling default deletion schedules that destroy data within 30 days of creation. OpenAI, for example, automatically deletes ChatGPT conversations and API inputs and outputs from its systems within 30 days of a user’s deletion request or, in some configurations, as a matter of default retention practice. As a result, content can be permanently destroyed before a company appropriately issues and applies a legal hold. That potential problem is compounded by the fact that AI outputs are frequently generated outside corporate systems entirely, through public chatbots, browser-based tools, or personal accounts, often in violation of company policy. This creates visibility gaps that traditional IT-driven retention schedules may not be designed to address yet.

II. The Scope of Discoverable “Documents” May Already Reach AI Artifacts

Federal Rule of Civil Procedure 34(a)(1)(A) defines discoverable material to include “any designated documents or electronically stored information (“ESI”)—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained.” Fed. R. Civ. P. 34(a)(1)(A). And, increasingly, litigants are relying on this Rule to seek discovery of opposing parties’ AI prompts, model outputs, conversation logs, and related data compilations.

Recent litigation confirms that at least one court has treated AI-generated content as discoverable ESI subject to preservation obligations. In the consolidated copyright litigation against OpenAI, a United States Magistrate Judge for the Southern District of New York ordered OpenAI to “preserve and segregate all output log data that would otherwise be deleted on a going forward basis until further order of the Court.” The court’s order encompassed data “whether such data might be deleted at a user’s request or because of ‘numerous privacy laws and regulations’ that might require OpenAI to do so.” See In re: OpenAI, Inc., No. 25-md-3143 (SHS) (OTW), 2025 WL 1442678, at *1 (S.D.N.Y. May 13, 2025). The order arose after the court learned that OpenAI had been deleting output log data, which was reportedly consistent with its standard retention practices, and that “the volume of deleted conversations is significant.” Notably, the output log data at issue was directly relevant to the plaintiffs’ claims regarding how ChatGPT processes and generates content. In addition, the court’s willingness to order preservation even where the deletions appeared to follow OpenAI’s existing retention policy underscores that routine data management practices do not excuse a failure to preserve once a legal hold obligation has attached.

Rule 34 requires production of ESI within a party’s “possession, custody, or control,” without a stated exception for AI-generated or AI-processed data. Fed. R. Civ. P. 34(a)(1). Given the relatively recent advent of generative AI, it is not surprising that no provision of the Federal Rules distinguishes between data generated by human authors and data generated through interaction with an AI system. A party’s obligation to preserve and produce relevant ESI may extend to AI artifacts just as it does to any other ESI.

That said, courts might apply Rule 34 differently to companies that simply use or license AI tools for use in day-to-day work, as opposed to the OpenAI MDL, where the defendant developed, created, and owned the specific AI tool at issue. Most companies that simply license or use AI tools without substantial modification to those tools may be viewed as more distant from the necessary “possession, custody, or control” of data within an AI tool. In those more common scenarios, the OpenAI MDL may be ripe for Rule 34 distinction.

III. Sanctions Exposure Under Rule 37(e)

The failure to preserve AI-generated content that is (or should be) subject to a legal hold could expose litigants to sanctions under Federal Rule of Civil Procedure 37(e), which governs the loss of electronically stored information that should have been preserved in the anticipation or conduct of litigation. Rule 37(e)(1) authorizes a court to order curative measures “no greater than necessary to cure the prejudice” upon a finding that ESI “that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it” and “cannot be restored or replaced through additional discovery.” Fed. R. Civ. P. 37(e)(1).

Though courts do not appear to have yet grappled with what steps are reasonable in the AI world, some have warned against treating some inherently more temporary ESI differently than electronic records for preservation purposes.  Where the court additionally finds that a party “acted with the intent to deprive another party of the information’s use in the litigation,” Rule 37(e)(2) permits more severe sanctions, including an adverse inference instruction, dismissal of claims, or entry of default judgment. Fed. R. Civ. P. 37(e)(2).

Spoliation encompasses not only the active destruction of evidence but also the negligent or reckless failure to preserve information once a duty to preserve has been triggered. The duty to preserve arises when a party knows or reasonably should know that litigation is on the horizon. That duty may be triggered, for example, on receipt of a claim letter, demand, or even a cease and desist letter in certain contexts. Given the default deletion schedules employed by AI platforms, where data may be permanently destroyed within 30 days, the window between trigger of the preservation obligation and irreversible data loss is dangerously narrow. Companies that fail to intervene promptly to halt automatic deletion of AI-generated content risk a finding that they did not take “reasonable steps to preserve” that information within the meaning of Rule 37(e). When, precisely, a duty attaches and whether ensuing steps are reasonable are entirely context-driven and difficult to boil down to a pinpoint rule. By way of example, however, if a company has been notified that it is being sued for price fixing and its employees use an AI tool to develop algorithms for price modeling, it may be wise to preserve that tool’s ESI.

IV. Third-Party AI Vendors: Distinguishing What Is Actually in the Company’s Control

The “possession, custody, or control” standard of Rule 34(a)(1) extends discovery obligations beyond documents a party physically holds to include documents the party has the legal right or practical ability to obtain. Fed. R. Civ. P. 34(a)(1). This principle has direct application to AI-generated data held by, or generated and created on behalf of a company by, third-party vendors.

If a company maintains a contractual right to access, export, or retrieve its usage data from an AI vendor, that may be within the company’s “control” for purposes of its discovery obligations. The In re: OpenAI litigation illustrates the practical complexity of this issue. OpenAI represented to the court that “a fraction of ChatGPT Free, Pro, and Plus conversations ... have not been retained” as a result of its “default” policy of retention. OpenAI responded by citing user privacy preferences and “numerous privacy laws and regulations throughout the country and the world” as justification for its deletion policies. Nonetheless, the court ordered preservation, signaling that a vendor’s internal deletion practices may not relieve the parties of their obligations to hold responsive data whenthat preservation duty arises in response to actual or likely litigation.

To be sure, In re: OpenAI’s lesson came in the context of a suit against the creator of ChatGPT, not a company that merely licenses it. But its lesson may well extend to the latter context. Data that resides on a vendor’s server does not fall outside the scope of a company’s preservation obligations. Where contractual terms permit data retrieval, export, or extended retention, or where a company has the practical ability to request that a vendor suspend its default deletion schedule, a court may well conclude that the data is within the company’s control. OpenAI itself acknowledged that enterprise customers and customers who choose “zero-data-retention” plans operate under different data handling frameworks where the customer controls retention. This distinction further underscores that the allocation of control is a fact-specific inquiry that turns on the contractual and operational relationship between the company and its AI vendor.

V. Practical Takeaways

In light of the developments described above, clients may consider certain steps to align information governance practices with their company’s AI usage in this ever-evolving landscape.

First, legal hold notices and company policies, including litigation hold policies, records retention policies, and records retention schedules, should be updated to establish retention standards for AI prompts, outputs, chat logs, and associated metadata. Standard hold notices that reference only email, documents, and traditional databases may fail to capture AI-generated content. Given that AI platforms such as ChatGPT automatically delete data within 30 days absent affirmative intervention, hold procedures must be designed to operate within that compressed timeline.

Second, companies should establish a comprehensive AI acceptable use policy governing employee interactions with AI tools. This policy, which may be standalone or integrated into an existing employee handbook, should specify which AI platforms are approved for business use, define the types of information that may and may not be input into AI systems, and make clear that use of unsanctioned AI tools with company data may constitute a data breach. By establishing clear guardrails, companies create an enforceable framework that supports both information security and downstream preservation obligations.

Third, companies should conduct an assessment of all AI tools in use across the organization. This assessment should catalog approved enterprise AI deployments and, to the extent possible, identify unsanctioned consumer-tier use by individual employees. Even data generated through free consumer accounts may be subject to preservation and discovery obligations, so understanding which AI tools are in use is a critical first step.

Fourth, companies should review their contractual relationships with AI vendors to determine whether they possess the legal right to retrieve, export, or direct the preservation of their usage data. Where such rights exist, the company’s preservation obligation likely extends to that vendor-held data under the “possession, custody, or control” standard of Rule 34(a)(1). Companies may also consider the inclusion of their standard data retention policies in contracts with AI vendors so as to ensure company-wide consistency in preservation. Even beyond AI-specific vendors, companies should review their broader vendor agreements to ensure appropriate protections are in place, including provisions prohibiting vendors and their personnel from inputting company data into unapproved AI platforms, which could constitute a data breach and create additional preservation complications.

Finally, companies should provide employees with AI training, which may include specific guidance regarding how AI work product may fall within the scope of a legal hold. Employees should understand that conversations with AI chatbots, prompts submitted to AI assistants, and outputs generated by those systems may constitute discoverable ESI that must be preserved when a hold is in effect.

Courts have demonstrated a willingness to order preservation of AI output data even over objections grounded in privacy law, platform design, and practical burden. Companies that fail to adapt their preservation practices to the realities of generative AI risk possible sanctions, from adverse inferences, to the loss of otherwise meritorious claims or defenses.

VI. Conclusion

In light of these developments, companies may consider: (1) reviewing existing retention policies and legal hold procedures to analyze whether they adequately account for AI-generated content; (2) establishing a comprehensive AI acceptable use policy governing employee interactions with AI tools; (3) conducting an assessment of AI tools in use across the organization to identify preservation risks; (4) evaluating contractual rights to retrieve or preserve data held by third-party vendors; and (5) providing employees with targeted training on how AI-generated work product may fall within the scope of a legal hold.

McGuireWoods’ AI Practice Group is available to assist clients with any questions regarding preservation obligations for AI-generated data, updates to records retention and legal hold procedures, or vendor contract review.

The authors thank McGuireWoods summer associate Destiny Washington for assistance preparing this article. She is not licensed to practice law.

On July 13, 2026, the Department of War (DoW) announced the immediate suspension of all Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had originally been scheduled to take effect November 10, 2026, including the transition to mandatory third-party assessments by CMMC Third-Party Assessment Organizations (C3PAOs) for contractors handling Controlled Unclassified Information (CUI). The DoW simultaneously established a CMMC Reform Task Force charged with delivering a comprehensive report within 60 days recommending “realistic, scalable security measures” for the Defense Industrial Base (DIB).

The suspension, announced by DoW Chief Information Officer Kirsten A. Davies, aligns with Secretary of War Pete Hegseth’s Acquisition Transformation System (ATS) directives and the broader “Arsenal of Freedom” initiative. Critically, the action does not relieve contractors of their underlying obligations to protect federal data, which includes the current DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and the NIST SP 800-171 Rev. 2 security controls upon which the CMMC Phase II requirements are based.

Key Takeaways

• Immediate Phase II / III suspension: CMMC Phase II (third-party C3PAO assessments) and all future CMMC milestones are suspended immediately. Phase I self-assessments remain in place.
• No changes to current requirements: DFARS 252.204-7012, NIST SP 800-171 Rev. 2 requirements, SPRS scores, and cyber incident reporting obligations remain fully in place, mandatory, and actionable from an enforcement perspective.
• FCA risk unchanged: Failure to comply with these cybersecurity requirements remain subject to False Claims Act enforcement under DOJ’s Civil Cyber-Fraud Initiative.
• 60-day clock: The CMMC Reform Task Force must deliver its final report by mid-September 2026. DoW published an RFI to solicit industry input, with comments due by 12:00 PM ET on Friday, August 14, 2026.
• Interim standard: DoW will enforce cybersecurity through self-assessments and select government-led assessments, using DoW’s “Brilliant at the Basics” IT/OT Top 10 standards as a practical benchmark.
• At present, program reform—not elimination: DoW has signaled its intent to reform, not dismantle, cybersecurity certification. DoW intends for contractors to maintain compliance readiness.

Background – The CMMC Program to Date

The DoW has been developing the CMMC program for the better part of a decade. The CMMC 2.0 final program rule (32 CFR Part 170) was published in the Federal Register on October 15, 2024, following a nearly five-year rulemaking process. The corresponding DFARS contract clauses (DFARS 252.204-7021 and 252.204-7024) were finalized in a rule published September 10, 2025, effective November 10, 2025.

The DoW had anticipated implementing the CMMC program across a three-tiered model:

• Level 1: Self-assessment against 15 FAR 52.204-21 requirements for Federal Contract Information (FCI).
• Level 2: Compliance with 110 controls from the NIST SP 800-171 Rev. 2 requirements for CUI, verified via self-assessment or third-party C3PAO certification depending on the sensitivity of the contract.
• Level 3: Compliance with 110 controls from the NIST SP 800-171 Rev. 2 requirements plus 17 additional NIST SP 800-172 controls, assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

The CMMC 2.0 rollout was planned in the following phases:

• Phase I (November 10, 2025): Level 1 and Level 2 self-assessment requirements took effect.
• Phase II (November 10, 2026): Third-party C3PAO assessment requirement for Level 2 contracts.
• Phase III (November 10, 2027): Level 3 DIBCAC assessments.
• Phase IV (no later than November 10, 2028): Full incorporation into all DoW contracts.

The DoW’s actions have suspended the latter three of these four phases.

What the Announcement Does—And Does Not—Change

Requirements Suspended (Effective Immediately):

• The transition to mandatory third-party C3PAO assessments under CMMC Level 2 (Phase II), previously scheduled for November 10, 2026;
• All pending and future CMMC implementation milestones across DoW solicitations and contracts (Phases III and IV); and
• Any new solicitation requirements referencing the suspended CMMC phases.

Remaining in Full Force:

• Phase I requirements, including both Level 1 and Level 2, self-assessment requirements remain in place (Level 1 and Level 2 self-assessments under DFARS 252.204-7021).
• DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) remains the baseline CUI-based contractual cybersecurity self-certification obligation for all DoW contractors and subcontractors.
• The NIST SP 800-171 Rev. 2 remains the baseline DoW CUI security control framework, enforced through self-assessments and select government-led assessments focused on “tangible cyber hygiene rather than administrative overhead.”
• Supplier Performance Risk System (SPRS) score submission and maintenance requirements remain in place.
• All contractual obligations to protect Covered Defense Information (CDI) and report cyber incidents remain in place.

New Initiatives:

• CMMC Reform Task Force:  The DoW announcement establishes a “CMMC Reform Task Force,” a DoW CIO-led body, that is charged with conducting a complete review of the CMMC program. The task force is expected to synthesize industry feedback received through a public Request for Information (RFI) on compliance challenges, which DoW published on July 14, 2026 with comments due by 12:00 PM ET on Friday, August 14, 2026.  The Task Force must deliver a final report to the DoW CIO within 60 days of the announcement (approximately mid-September 2026).
• “Brilliant at the Basics” Initiative:  The DoW announcement also establishes the new “Brilliant at the Basics” Initiative, a DoW CIO cybersecurity campaign that provides IT and Operational Technology (OT) “Top 10” best-practices lists designed to empower DIB partners—particularly small, mid-sized, and non-traditional companies—to secure their networks and protect sensitive DoW information during the interim period.

Practical Implications for Defense Contractors

1. No “Stand Down” on Cybersecurity Compliance.  The suspension eliminates the near-term C3PAO assessment requirement but does not roll back existing cybersecurity requirements, including Level 2 self-assessments.  Moreover, DFARS 252.204-7012 remains a binding regulatory and contractual requirement.  The DoW will continue to enforce NIST SP 800-171 Rev. 2 compliance through self-assessments and targeted government-led assessments. Contractors who relax cybersecurity efforts do so at their own risk.  To that end, the Level 2 self-certification requirements implemented through Phase I of CMMC remain in effect.

2. False Claims Act Risk Persists.  The Department of Justice is continuing to pursuant cybersecurity compliance failures under the False Claims Act (FCA), including through the Civil Cyber-Fraud Initiative.  Contractors who (1) expressly certify compliance in SPRS submissions, or (2) hold contracts that include cybersecurity requirements may face FCA liability if the contractor’s cybersecurity posture is inconsistent with those requirements, regardless of whether a C3PAO has conducted a formal CMMC assessment.

3. Reassess—But Do Not Abandon—C3PAO Preparation Timelines.   Contractors that have invested in preparing for Level 2 third-party certification may want to reassess timelines for finalizing CMMC Level 2 certification efforts, but should not abandon remediation efforts. The 60-day task force review may result in a modified (not eliminated) assessment regime, and contractors who maintained compliance posture during the suspension will be better positioned when requirements resume in any form.  Moreover, the CMMC Level 2 requirements are consistent with the DFARS 252.204-7012 requirements, meaning that such efforts may help limit potential civil and administrative exposure.

4. “Brilliant at the Basics” as an Interim Benchmark.  The DoW CIO’s IT and OT Top 10 best-practices lists, available at dowcio.war.gov/BrilliantBasics/, identify DoW’s expectation for “tangible cyber hygiene” for, at a minimum, the next sixty days. Contractors may want to benchmark their cybersecurity programs against the standards and activities described in these lists and document compliance as evidence of good faith.

5. M&A and Due Diligence Considerations.  For transactions involving DIB companies, CMMC certification status has been a relevant valuation and risk factor. The Phase II suspension may shift deal dynamics: targets that had not yet achieved C3PAO certification face reduced near-term risk.  That said, acquirers should still assess the target’s NIST SP 800-171 compliance posture, SPRS score accuracy, and readiness to comply with whatever regime emerges from the 60-day review and limit risk from a cyber fraud standpoint.

6. Subcontract Flow-Down Obligations.  Prime contractors should review subcontract terms referencing CMMC Phase II milestones. While the DoW suspension applies to government solicitations and contracts, primes that contractually required subcontractors to achieve C3PAO certification by specific dates may wish to consider formal guidance to their supply chains given the suspension and interim steps being taken by the DoW.

Recommended Action Items

In light of the Phase II suspension, we recommend that defense contractors take the following steps:

1. Continue Phase I Self-Assessments and SPRS Score Maintenance.  These obligations are unaffected by the suspension.  Contractors must ensure that SPRS scores accurately reflect their current implementation status.
2. Do Not Pause NIST SP 800-171 Rev. 2 Remediation Efforts.  The underlying control set remains the compliance standard. Plans of Action and Milestones (POA&Ms) should continue to be executed and documented (except where such efforts are not permitted under CMMC Phase I).
3. Maintain DFARS 252.204-7012 Cyber Incident Reporting Readiness.  None of the DoW’s efforts have changed the 72-hour reporting obligation for cyber incidents affecting covered contractor information systems.
4. Benchmark Against the “Brilliant at the Basics” IT/OT Top 10 Lists. Contractors may want to treat these “lists” as DoW’s interim compliance guidelines and document alignment with those terms.
5. Monitor the CMMC Reform Task Force and Consider Responding to the RFI. The 60-day review will shape the future of the program. Contractors with strong views on compliance costs, scalability, or alternative approaches should consider submitting comments.  This is particularly true for small, mid-sized, and non-traditional companies, which the DoW has suggested is the primary focus of the 60-day suspension.  Comments are due by 12:00 PM ET on Friday, August 14, 2026. 
6. Review Subcontract Flow-Down Provisions.  Contractors may want to assess whether subcontract terms referencing Phase II milestones require modification or formal communication to supply chain partners.
7. Evaluate Pending Proposals and Solicitations.  Contractors should assess whether any pending proposals reference Phase II requirements that may now be inapplicable and seek guidance from contracting officers as appropriate.
8. Consult Counsel on FCA Risk.  Contractors should ensure that cybersecurity compliance representations in proposals, SPRS submissions, and contract performance are accurate and defensible.  To the extent that any issues, risks, or non-compliances are identified, we recommend that contractors speak to counsel regarding mitigation or disclosure requirements that may be implicated.

The DoW’s suspension of CMMC Phase II represents a significant shift in the near-term compliance landscape for defense contractors, but it does not mean that contractors should reduce cybersecurity vigilance. Contractors should view the interim period as an opportunity to strengthen foundational compliance while positioning for whatever regime emerges from the 60-day review. McGuireWoods is continuing to monitor developments from the CMMC Reform Task Force, the  open RFI , and any further DoW guidance.

For questions about the CMMC Phase II suspension, the interim compliance framework, or how these developments may affect your organization’s government contracts or cybersecurity programs, please contact a member of the McGuireWoods Government Contracts or Data Privacy & Cybersecurity teams.

Related McGuireWoods Coverage

• Department of Defense Issues Final Rule on Cybersecurity Standards for Contractors (Subject to Inquiry, September 2025)
• DoD Issues Final CMMC Framework for Defense Contractors (McGuireWoods Legal Alert, October 23, 2024)
• DHS Issues Final Rule Regulating Federal Contractors’ Handling of Controlled Unclassified Information (McGuireWoods Legal Alert, July 19, 2023)
• CMMC 2.0: Department of Defense Revamps Cybersecurity Maturity Model Certification Program (Subject to Inquiry, November 19, 2021)
• Ready or Not ... Government Contractor Cybersecurity Requirements Roll Out This Month (McGuireWoods Legal Alert, November 9, 2020)