As we welcome 2026, it is a good time for government contractors to reflect on their cybersecurity posture and the major shifts in federal data protection policy from 2025. Last year was more than just a year of evolution in
On January 7, 2026, President Trump issued a new executive order, “Prioritizing the Warfighter in Defense Contracting” (the “EO”), which states that “[a]fter years of misplaced priorities, traditional defense contractors have been incentivized to prioritize investor returns over
Today, the Eleventh Circuit heard oral argument in United States ex rel. Zafirov v. Florida Medical Associates, LLC, a case addressing the constitutionality of qui tam relators that has drawn national attention. At stake is the future of qui tam whistleblower actions under the FCA—a
When the federal government reopens after a shutdown, the return to “business as usual” is rarely immediate. Agencies face backlogs, funding adjustments, and operational hurdles that can directly impact companies, contractors, and regulated entities. Below we outline several key issues
The wait is over – on September 18, 2025, almost 2 years after implementing the Interim Rule, the Office of the Director of National Intelligence (“ODNI”) issued a Federal Acquisition Supply Chain Security Act (“FASCSA”) order to remove and exclude
On September 19, 2025, the White House issued a Presidential Proclamation imposing a $100,000 filing fee for certain H-1B workers.
On September 10, 2025, the final rule to implement the Cybersecurity Maturity Model Certification (“CMMC”) program in the Defense Federal Acquisition Regulation Supplement (“DFARS”) was published with an effective date of November 10, 2025 (i.e., 60 days after publication). This
The inexorable expansion of the False Claims Act (“FCA”) to cover virtually all types of cybersecurity breaches and violations – to include allegedly poor practices and failure to fully adhere to security controls – continues. At one time, an organization
In United States v. Chastain, No. 23-7038, 2025 WL 2165839 (2d Cir. July 31, 2025), the United States Court of Appeals for the Second Circuit vacated wire fraud and money laundering convictions in what the government described as its
The U.S. Department of Justice (“DOJ”) Data Security Program (“DSP”) 90-day enforcement grace period ended as of July 8, 2025. While the program became effective April 8, 2025, DOJ implemented a 90-day enforcement grace period until July 8, 2025 for
