1. Home
  2. |Insights
  3. |DoD Issues Long-Awaited Interim Rule on Cyber Requirements and Cloud Services

DoD Issues Long-Awaited Interim Rule on Cyber Requirements and Cloud Services

Client Alert | 1 min read | 09.03.15

As discussed in our recent blog post, on August 26, DoD published an Interim Rule that would expand the already onerous requirements of the DFARS Safeguarding Clause by broadening its application to "covered defense information" and by requiring subcontractors to report cyber incidents directly to DoD. As discussed in a separate blog post, the Interim Rule also seeks to ensure uniformity in the DoD's IT acquisition and use of cloud computing services by adding T&C's, including that, unless otherwise authorized, cloud service providers must maintain all government data within the U.S., outlying areas, or DoD premises.


Contacts

Insights

Client Alert | 2 min read | 07.15.26

CMMC Phase II Suspension Requires Reconsideration of Such Requirements in Solicitations

As discussed in more detail here, the U.S. Department of War (DoW) recently issued a memorandum (Memo 26-P-1023, dated July 13, 2026) directing the immediate suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements (Level I and II self assessments are still permitted). Significantly, the memo directs that “all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice.” Moreover, the DoW issued a memorandum on implementing these requirements (available here), directing agencies to issue amendments removing CMMC Level 2 and 3 requirements from active solicitations “as soon as practicable.” Contractors should monitor the government’s compliance with this requirement and should be prepared, if needed, to file a bid protest to protect their rights....

View All Insights