Compliance

Social media posts allege that the Office of Personnel Management is using or considering nondisclosure agreements for people affected by the Department of Government Efficiency. The posts provide no corroborating documents or evidence of a procurement action, so contractors should not treat the claims as established policy or a change to contract obligations.

The Multistate Tax Commission’s Uniformity Committee postponed final action on its draft model for sourcing partnership income and will accept additional comments through February 1, 2027. The proposal is not an adopted requirement or procurement opportunity, but its eventual approach could affect multistate contractors’ tax compliance and pricing considerations.

Marlin Equity Partners made a strategic growth investment in Insight Assurance to support international expansion and growth in federal cybersecurity compliance and AI governance services. The development signals potential growth in independent assurance capacity, including CMMC- and FedRAMP-related services, but does not identify a government solicitation, award, or contract value.

A possible change in congressional control after the 2026 midterms could bring more investigations of companies and federal contractors, including scrutiny of AI, privacy, labor, consumer protection, and tax issues. Contractors should prepare for committee and individual-member inquiries, subpoenas, and potential conflicts between congressional information requests and executive-branch privilege claims; the report identifies no new procurement opportunity or legal requirement.

New Jersey Senator Declan O’Scanlon introduced S-4906, a proposal requiring agencies to identify two existing regulations for repeal for each new rule, and is cosponsoring S-2444 to create a regulatory review commission. The proposals are not current requirements, but if enacted could change compliance assumptions and costs for contractors operating or doing business with the state.

A December 8 virtual briefing will examine foreign-research risks in federally funded grants, including visiting-scholar vetting, researcher identity checks, and pre-award portfolio screening. The event may help agencies and contractors assess research-security needs and tools, but it announces no solicitation, award, or mandatory requirement.

The SEC Division of Examinations’ FY 2027 priorities emphasize scrutiny of firms’ AI use, cybersecurity, customer-information safeguards, and third-party service-provider risks. The announcement is a regulatory signal—not a federal solicitation or award—but may prompt financial firms to seek support with governance, testing, incident response, and compliance documentation.

A cyber-extortion group claims it stole roughly 590 gigabytes from a vendor hosting PwC employee learning records. The incident underscores third-party cyber risk, a core component of federal supply chain security requirements and vendor risk assessments.

Google Cloud and Mandiant warn that patched PHP packages may leave systems exposed unless services are restarted and runtime versions verified. Government contractors hosting PHP applications must audit running processes and review logs back to October 17 for exploitation attempts.

The IRS plans to hire roughly 1,000 employees across its Small Business and Self-Employed and Large Business and International divisions, plus about 175 for Criminal Investigation, after substantial workforce reductions. The staffing plan may affect the agency’s enforcement capacity, but the source identifies no solicitation, contract award, or other procurement opportunity.

Reports say an FBI public-corruption inquiry into Navatek, campaign contributions, and alleged efforts to secure defense contracts ended in 2025 after the investigative team was removed or disbanded. The allegations—including a reported $10 million contract proposal—remain disputed, and the source material does not establish that the contract was awarded or that lawmakers were charged.

A community discussion raises questions about future federal or state legal scrutiny of DOGE-related actions and access to sensitive government data, but identifies no active investigation, ruling, directive, or procurement action. Contractors should review existing access logging and records-retention practices against applicable contract terms and agency instructions; the discussion creates no new legal hold or compliance deadline.

Understanding the correct treatment of VAT is paramount for bidders in government procurement processes. Miscalculating whether a tender price is VAT inclusive or exclusive can lead to significant financial discrepancies.

Computer Aid (CAI) rejected a subcontractor's insurance certificate for lacking **Cyber Liability** and **Professional Liability** coverage. This situation emphasizes the importance for subcontractors to ensure their insurance meets specific contract requirements, which could affect approval processes for federal contracts.

Recent insights indicate that federal procurement reforms could significantly alter contractor risk management strategies. With **$793 billion** in federal contract commitments and a **66%** competition rate in **FY2025**, companies must adapt to compressed timelines and heightened financial implications arising from procurement centralization.

Forvis Mazars LLP has achieved C3PAO accreditation under the Cybersecurity Maturity Model Certification program, enabling it to perform Level 2 assessments. This milestone is critical for assisting Department of Defense contractors in meeting stringent cybersecurity requirements essential for federal contract eligibility.

Cybersecurity professionals emphasize the need for clear scoping documentation in CMMC Level 2 assessments. Precise boundary definitions help streamline compliance efforts and reduce costs by focusing resources only on the relevant environments.

The Department of Defense has allocated a **$620 million** loan to Vulcan Elements for the development of drone magnet technology. However, the involvement of politically connected individuals, including Donald Trump Jr., has raised significant procurement oversight issues, emphasizing the necessity for enhanced vetting processes.

The EU's NIS2 Directive introduces a uniform cybersecurity framework, yet country-specific variations complicate compliance for contractors. Key differences require targeted strategies for successful engagement in national cybersecurity markets, especially regarding certifications and enforcement policies in various member states.

JSOC IT and Trava Security have initiated a partnership to provide integrated cybersecurity compliance solutions to government contractors and agencies. This collaboration aims to streamline procurement by offering a single source for compliance advisory and technical remediation services.

The DoD has paused the implementation of Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. This decision aims to alleviate compliance burdens, especially for small and medium-sized businesses, and appears to shift towards continuous cybersecurity verification models moving forward.

The UK Ministry of Justice is introducing AI tools for probation officers to aid in setting license conditions for offenders. This opens procurement opportunities for vendors in AI, case management, and compliance technology, while emphasizing the necessity of human oversight in critical decision-making processes.

The Department of Defense has paused the rollout of CMMC Phase II, maintaining the requirement for contractors to follow NIST SP 800-171 standards. This change underscores the necessity for contractors to stay compliant and ready for ongoing audits while preparing for future updates in cybersecurity requirements.

SecurityMetrics has introduced CMMC Assess, a self-assessment tool aimed at aiding Level 1 and Level 2 contractors with Cybersecurity Maturity Model Certification (CMMC) compliance. This tool streamlines the compliance process, potentially enhancing the competitiveness of contractors navigating multiple CAGE codes.

AI solutions are streamlining procurement processes by enhancing spend visibility and automating classification. Vendors like Levelpath help organizations manage costs, mitigate risks, and improve compliance through real-time insights from unified data.

The Department of War has postponed the CMMC Phase II certification requirements, initially set for November 10, 2026. During this review period, defense contractors must continue to adhere to existing cybersecurity standards, emphasizing the necessity for robust cybersecurity protocols within the defense industrial base.

Manufacturers and distributors in the U.S. are reducing vital cybersecurity practices in 2026. This trend raises serious concerns for compliance with federal mandates, especially within the Department of Defense (DoD), creating potential risks for contractors and their government engagements.

The **Department of Defense (DoD)** and the **Department of Veterans Affairs (VA)** are leveraging AI to reduce civilian hiring timelines to 30 days by automating essential administrative tasks. However, several systemic challenges must be navigated to fully realize these efficiencies, presenting both hurdles and opportunities for procurement professionals.

The UK's Information Commissioner's Office is reevaluating AI safety practices following cyber incidents. A shift to mandatory regulations may impact contractor compliance and create new opportunities in security consulting and AI assessments.

The U.S. Government is hosting the Federal Cyber Certification Series on November 2-3, 2026, focused on federal suppliers and cybersecurity professionals. This conference will address crucial cybersecurity compliance issues affecting federal contracts, emphasizing the need for advanced preparedness in areas like FedRAMP modernization and post-quantum cryptography.

Australian federal agencies are promoting phishing-resistant authentication to enhance AML compliance. This shift aims to protect sensitive data across the accounting sector and is expected to result in increased demand for cybersecurity solutions and services.

Training Heights Canada is set to launch a cybersecurity training program focused on the NIST Cybersecurity Framework in August 2026. This initiative aims to enhance the skills of both industry professionals and newcomers, addressing the pressing demand for qualified cybersecurity talent among Canadian employers.

Intech Hawaii has become the first managed service provider in Hawaii and Guam to achieve CMMC Level 2 certification, with Terence Tang serving as a Certified CMMC Assessor. This local expertise will significantly aid Department of Defense contractors in meeting their cybersecurity compliance needs, streamlining the pathway to certification.

George Kollitides, head of the Economic Defense Unit, has taken a strategic role in a defense finance company. This move may indicate a surge in procurement opportunities within critical technology sectors such as rare earth minerals and AI, signaling broader investments in defense-related technologies.

Recent discussions among federal agencies on Controlled Unclassified Information (CUI) highlight difficulties in aligning commercial tech adoption with stringent cybersecurity regulations. Notably, the evolving landscape involving CMMC and FAR Part 40 emphasizes the need for balancing innovation with compliance, impacting procurement strategies and vendor engagement.

The DoD has suspended new cybersecurity regulations that would have increased compliance costs for contractors. This decision, influenced by an estimated $7 billion cost impact, allows contractors to delay their compliance efforts, affecting contract plans and risk management strategies.

The Defense Contract Management Agency (DCMA) is accelerating its Blue List process to enhance the validation of unmanned systems for the Department of War. This initiative aims to improve reliability and speed compliance pathways for contractors, increasing market opportunities in the unmanned systems sector.

Inseego Corp. has attained CMMC Level 2 certification for its subscriber lifecycle management platform, Inseego Subscribe. This milestone ensures that communication service providers can effectively comply with the Department of Defense's cybersecurity mandates, streamlining government wireless service deployments.

Starting in 2026, federal agencies will begin phased assessments under the CMMC 2.0 framework. Contractors must achieve this certification to maintain federal contract eligibility, creating new demand in cybersecurity service sectors.

A compliant Kenyan firm is looking to partner with U.S. contractors to enhance operations in Nairobi and Mombasa. By leveraging local knowledge, this firm aims to support USAFRICOM and NAVFAC projects and facilitate compliance with Kenyan laws.

Recent attacks on npm and PyPI ecosystems have highlighted vulnerabilities in software supply chains. Government and industry professionals are urged to enhance security measures to comply with emerging cybersecurity mandates, particularly affecting vendors and developers within the **Indian market**.

CISO Global has automated and expanded its FedRAMP-certified TiGRIS platform to address complex compliance needs of federal clients. The integration of generative AI capabilities positions TiGRIS as a critical tool for contractors looking to enhance compliance operations and reduce risks in line with evolving federal standards.

The Department of Defense is assessing the Cybersecurity Maturity Model Certification (CMMC) program following a new 60-day review. This review halts the implementation of Phase 2 requirements, allowing for industry feedback on compliance costs and burdens. Contractors, especially small firms, should prepare for potential regulatory shifts that could affect contract eligibility and operations.

The Department of War has suspended Phase II of the CMMC program, affecting over 100,000 defense contractors. This postponement stalls federal cybersecurity compliance, necessitating a reassessment of procurement timelines and risk management strategies amidst persistent regulatory demands.

NM FAST will host a workshop on July 21 to educate New Mexico startups on DoD compliance and CMMC requirements. This initiative is vital for local businesses aiming to enhance their competitive stance in federal procurement, particularly in defense contracts.

The Department of Defense has suspended CMMC Phase II third-party assessments, addressing small contractors' cost concerns. Despite the pause, compliance with existing cybersecurity mandates remains essential, presenting both challenges and opportunities for defense contractors.

The Department of Defense has mandated that all defense contractors comply with CMMC 2.0 by November 10, 2025. This requirement emphasizes stringent cybersecurity measures, particularly for small and mid-sized contractors, and failure to comply could jeopardize their eligibility for future contracts.

Quantum eMotion Corp. has attained the NIST Implementation Under Test (IUT) designation for its SecureKey Cryptographic Module, paving the way for FIPS 140-3 compliance. This enables the company to offer validated cryptographic solutions, thereby expanding procurement options for federal agencies and contractors in need of certified cybersecurity technologies.

The Department of War has suspended the CMMC Phase II requirements, impacting third-party assessments for contractors managing Controlled Unclassified Information. This move aims to ease compliance costs for small and medium businesses while ensuring adherence to NIST cybersecurity standards, indicating potential shifts in the cybersecurity certification landscape.

The Department of War has halted its CMMC Phase II requirements, addressing compliance concerns. This decision aims to alleviate cost pressures on over 100,000 small defense contractors, promoting their participation within the Defense Industrial Base while ensuring cybersecurity standards are upheld.