cybersecurity

On September 9, 2025, the Department of Defense (DoD) released its long-anticipated final rule implementing the Cybersecurity Maturity Model Certification (CMMC) program. After several years of proposals, public comments, and interim measures, the DoD has now solidified the framework for its revamped CMMC program. The goal: ensure contractors in the Defense Industrial Base (DIB) properly protect sensitive information, particularly Controlled Unclassified Information (CUI) and Federal Contract Information (FCI), while clarifying legal obligations, streamlining processes, and providing a phased implementation. The final rule introduces a phased, three-year implementation period that begins on November 10, 2025. At a basic level, the CMMC program changes the […]

When Deputy Attorney General Lisa Monaco announced in October 2021 that the Department of Justice would be pursuing a new initiative to combat cybersecurity related fraud, white-collar criminal defense attorneys took notice. DAG Monaco’s message in that announcement was clear: DOJ plans to combine its expertise in fraud enforcement and government procurement to aggressively pursue cyber threats and cybersecurity related fraud. Since that time, DOJ has secured a number of high-profile settlements that have sent the message to government contractors that misrepresenting their cybersecurity posture or failing to report a breach will result in a costly DOJ enforcement action. The […]

In October 2021, the United States Department of Justice (DOJ) announced its Civil Cyber-Fraud Initiative. The purpose of this initiative is to combat cybersecurity vulnerabilities and cyber threats by ensuring federal contractors and grantees implement required cybersecurity standards. Whistleblowers play a critical role in the initiative. Cybersecurity fraud is often difficult for the government to detect, so the DOJ relies on insiders to report violations under the federal False Claims Act (FCA). The FCA allows whistleblowers, known as “relators,” to bring a lawsuit regarding an entity’s false claims to the United States for payment. This is known as a qui […]

The Federal Trade Commission (FTC) announced on October 27th that it has expanded the scope of its financial data security rule, which will now require nonbank financial institutions – like vehicle dealers and mortgage brokers – to report data breaches. This new amendment to the FTC Safeguards Rule imposes similar reporting requirements to those already applicable to banks. Specifically, the amendment will require nonbank financial institutions to report to the FTC any data breach affecting 500 or more consumers’ data. The rule gives financial institutions 30 days to report the breach, however the FTC encourages reporting as soon as possible. […]

The Securities and Exchange Commission (SEC) announced charges against SolarWinds Corp. and its chief information security officer (CISO), accusing the publicly traded company of misleading investors as to its vulnerability to cyberattacks. SolarWinds is accused of defrauding investors by overstating its cybersecurity practices, while failing to implement appropriate internal digital safeguards and ignoring red flags for years before announcing that it was the victim of a two-year long cyber attack in December 2020. This landmark lawsuit represents the first time in an SEC cyber case that the commission has alleged that an organization intended to deceive investors. Perhaps even more […]