Loading story…
The U.S. Department of Defense has finalized a rule requiring all defense contractors to comply with the Cybersecurity Maturity Model Certification (CMMC) program, effective November 9. Contractors must meet one of three CMMC levels based on the sensitivity of unclassified information they handle, with requirements ranging from annual self-assessments to government-led audits. Vendors failing to comply will be ineligible for new contracts, and conditional certifications will be available for those working toward compliance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Department of Defense has released the final Cybersecurity Maturity Model Certification (CMMC) Rule, mandating new cybersecurity requirements for over 300,000 U.S. military contractors. The rule introduces a three-year phased rollout starting November 10, 2025, with a reduction from five to three security levels and a mix of self-attestation and third-party assessments. The framework aims to address persistent cyber threats and industry concerns, but will require significant adjustments in governance and compliance practices across the defense industrial base.
Jun 29, 2026
The US Department of Defense is implementing the Cybersecurity Maturity Model Certification 2.0 (CMMC), requiring over 300,000 military contracting companies to enhance their cybersecurity protections. Despite the critical importance of these safeguards, more than half of defense contractors are reportedly unprepared for the initial phase of CMMC, which is set to begin imminently. Whistleblowers have played a significant role in exposing non-compliance, leading to major settlements by companies such as Raytheon and Aerojet Rocketdyne under the False Claims Act. The new requirements not only impact primary contractors but also extend to subcontractors and external service providers, including cloud service providers, who may not fully understand their obligations under CMMC. Many contractors and their service providers face confusion regarding the scope of CMMC, particularly in distinguishing between subcontractors and external service providers, and in understanding which IT and information security services fall under compliance requirements. Failure to include all relevant service providers in CMMC assessments could result in non-compliance and potential loss of business. Registered Practitioner Organizations are offering guidance to help organizations navigate these complexities, emphasizing the need for comprehensive compliance programs that address both direct and indirect CMMC obligations across the defense supply chain.
Jun 30, 2026
The Department of Defense has suspended the planned transition to **CMMC Phase 2**, pausing third-party compliance-attestation requirements while it reviews the Cybersecurity Maturity Model Certification program. The department received more than 1,100 responses totaling over 10,000 pages of feedback, with many commenters—particularly small and mid-sized defense contractors—describing the requirements as disproportionately burdensome. During the review, contractors are expected to demonstrate compliance with **NIST SP 800-171 Rev. 2** through self-assessments and selected government-led assessments; DoD has also halted CMMC waivers for 60 days. DoD CIO Kirsten Davies said the redesigned program should emphasize continuous cybersecurity and resilience, including protections for manufacturers' operational technology, rather than point-in-time compliance checks. Industry feedback also highlighted inconsistent government handling and marking of controlled unclassified information as a supply-chain challenge. Legal commentators warned that suspending requirements through memoranda may be vulnerable because the underlying CMMC and DFARS rules remain in force, and that restoring self-attestation removes independent validation intended to counter inaccurate contractor reporting amid continued state-sponsored espionage against the defense industrial base.
Sep 10, 2026