CMMC Cybersecurity Rules Are Rolling Into Defense Contracts

The U.S. Department of Defense is moving forward with the phased implementation of the Cybersecurity Maturity Model Certification (CMMC) program to ensure contractors adequately protect controlled unclassified information. Following a 2019 inspector general report highlighting security gaps, the program transitioned from a final rule in 2020 to active contract incorporation starting in November 2025. This shift marks a significant escalation in oversight, as the Department of Justice increasingly utilizes the False Claims Act to penalize firms that misrepresent their cybersecurity posture.

The CMMC program was developed as a response to a 2019 Department of Defense inspector general report which found that contractors were inconsistently implementing the security requirements established by DFARS 252.204-7012. While a final rule for CMMC was published in November 2020 and became effective in 2024, the department officially began incorporating these requirements into defense contracts in November 2025. The implementation is structured as a phased approach over three years, concluding in 2028, to allow contractors sufficient time to prepare for the rigorous and often costly third-party certification process required for higher-level security compliance.

Currently, defense contractors can self-certify compliance with Level 1 and Level 2 cybersecurity requirements, but this flexibility carries substantial legal risks. The Department of Justice (DOJ) launched its civil cyber-fraud initiative in 2021 specifically to target contractors that provide deficient products, misrepresent protocols, or fail to report breaches. Under the False Claims Act (FCA), the government applies the 'implied-certification theory,' meaning that submitting a claim for payment is an implicit statement that the contractor has met all material contractual provisions, including cybersecurity standards.

Enforcement of these standards is bolstered by the FCA's qui tam provisions, which allow whistleblowers—often referred to as relators—to receive between 15% and 30% of recovered damages. The financial consequences for non-compliance or false certification are severe, potentially reaching three times the government's actual damages plus penalties ranging from approximately $14,300 to $28,600 for each false invoice. To mitigate these risks, industry experts advise contractors to identify all Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within their systems, perform thorough gap assessments, and ensure all requirements are flowed down to subcontractors to secure the entire supply chain.