Cybersecurity Updates at Department of Defense

The Department of Defense is progressing its Zero Trust cybersecurity implementation beyond traditional user and device protections to encompass operational technology and weapon systems, targeting full compliance within two years. A live webinar scheduled for August 26, 2026, will provide detailed updates on the current status, challenges, and future roadmap of Zero Trust adoption across the DoD and its defense industrial base. This initiative represents a significant modernization effort with direct implications for contractors and cybersecurity professionals engaged in defense IT and operational technology modernization.

• Why this matters: DoD's expansion of Zero Trust requirements signals increased demand for cybersecurity solutions that cover a broader range of defense systems, including critical operational technology and weapons.
• Contractors should prepare for evolving compliance standards and potential procurement opportunities related to Zero Trust implementation across multiple defense domains.
• Cybersecurity vendors and service providers can leverage insights from the upcoming webinar to align offerings with DoD's strategic roadmap and address emerging security challenges.
• Procurement professionals should anticipate updated contract requirements and evaluation criteria reflecting the expanded scope of Zero Trust security measures.

The Department of Defense (DoD) has suspended third-party Cybersecurity Maturity Model Certification (CMMC) assessments as a condition for contract awards but continues to enforce cybersecurity requirements through self-assessments and targeted government-led evaluations by the Defense Industrial Base Cybersecurity Assurance Center (DIBCAC). These non-voluntary assessments focus on compliance with DFARS 7012 and NIST SP 800-171 controls, emphasizing cyber incident reporting, subcontract flow-down requirements, and FedRAMP license ownership. Contractors and subcontractors handling Controlled Unclassified Information (CUI) supporting critical defense programs should maintain robust cybersecurity practices and be prepared for DIBCAC audits, which use a risk-based approach to verify compliance and protect sensitive defense technologies.

• Why this matters: The suspension of CMMC third-party assessments does not reduce cybersecurity obligations; instead, DoD relies on DIBCAC-led assessments and self-attestations to enforce compliance.
• Contractors should prioritize maintaining and documenting NIST SP 800-171 compliance, especially regarding incident reporting and subcontractor flow-downs.
• Organizations managing FedRAMP-authorized products must ensure clear client ownership and control of licenses to meet DIBCAC scrutiny.
• Procurement professionals should anticipate increased government-led cybersecurity verification activities and adjust contract compliance strategies accordingly.

The Defense Information Systems Agency (DISA) has selected AttackIQ as the Department of Defense's enterprise platform for Adversarial Exposure Validation. This procurement establishes a standardized capability to continuously evaluate and validate the effectiveness of cyber defenses across the DOD by simulating real-world adversary tactics and techniques. The selection of AttackIQ reflects the DOD's commitment to enhancing its cybersecurity posture through proactive, data-driven assessments that inform risk management and defense improvements.

• Why this matters: Procurement professionals should note the emphasis on continuous cyber defense validation as a critical requirement for DOD cybersecurity contracts.
• The adoption of AttackIQ's platform signals increased demand for adversarial simulation and validation tools within federal cybersecurity procurements.
• Contractors specializing in cybersecurity testing, red teaming, and automated adversary emulation may find new opportunities aligned with this platform.
• Agencies and vendors should prepare for integration and interoperability requirements consistent with enterprise-wide cybersecurity validation standards set by DISA and DOD.

The U.S. Department of Defense and Department of War have awarded over $1.4 billion in contracts across multiple military branches and agencies, including the Air Force, Navy, Army, Missile Defense Agency, and Defense Logistics Agency. These awards cover a broad range of services such as construction, aerospace systems, missile production, weapon system support, software platform management, and logistics, with contract durations extending through 2036. Major contractors like General Dynamics, Lockheed Martin, and Raytheon secured significant portions of these contracts, while numerous small businesses and specialized firms also received awards. This wave of contract activity highlights substantial opportunities for both prime contractors and subcontractors in defense-related technical, engineering, and support services.

• Key agencies involved: Department of the Air Force, Missile Defense Agency, U.S. Army, Navy, and Defense Logistics Agency
• Significant contract values: $450 million roofing and repair task orders for Air Force installations; $229 million awarded to General Dynamics; $745 million missile production contract for U.S. and Japan Foreign Military Sales
• Contract types: Multiple-award task orders, indefinite-delivery/indefinite-quantity (IDIQ), cost-plus-fixed-fee, and firm-fixed-price contracts
• Why this matters: Procurement professionals should note the extended contract periods through 2033-2036, indicating long-term engagement opportunities
• Actionable insights: Companies specializing in aerospace, missile systems, construction, software management, and geophysical detection technologies should evaluate these awards for partnership or bidding opportunities; small businesses have notable participation, suggesting avenues for subcontracting and teaming arrangements

The Department of Homeland Security awarded $1.5 billion in counter-unmanned aircraft system (C-UAS) contracts to 12 companies, split into two tracks covering hardware/software and comprehensive services, signaling a significant investment in counter-drone capabilities. Concurrently, the Department of Defense continues to advance missile defense and naval modernization with recent contracts including a $271 million award to RTX for AEGIS Weapon System Fire Control System MK 99 modernization and a $230 million modification to General Dynamics Mission Systems for Hammerhead mine units and support equipment. The U.S. Space Force confirmed Lt. Gen. Douglas Schiess as Chief of Space Operations, emphasizing space-based defense priorities. These developments highlight robust procurement activity across multiple defense domains through 2028, including missile defense, unmanned systems, and advanced weaponry.

• Why this matters: Procurement professionals should note the scale and scope of DHS’s C-UAS awards, which open opportunities for hardware and service providers specializing in counter-drone technologies.
• The DoD’s continued investment in naval and missile defense systems indicates sustained demand for modernization and advanced weapons integration.
• The leadership change in the U.S. Space Force underscores a strategic focus on space-based defense capabilities, potentially influencing future space-related procurements.
• Companies should evaluate their positioning for multi-year contracts in missile defense, unmanned systems, and space technologies, considering the involvement of prime contractors like Lockheed Martin and L3Harris and emerging vendors such as Quantum Sky and Kratos Defense.

Government agencies in the U.S., Canada, and the U.K. are responding to the rapid integration of artificial intelligence by nation-state adversaries into cyberattack operations by shifting cybersecurity strategies from reactive crisis management to proactive resilience and harm reduction. Senior officials from the Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, Canadian Centre for Cyber Security, and U.K. National Cyber Security Centre emphasize the need for enhanced defenses against AI-enabled threats targeting supply chains, critical infrastructure, and zero-day vulnerabilities. This evolving threat landscape is driving procurement priorities toward AI-informed cybersecurity solutions and updated operational guidance to maintain essential government services amid persistent cyberattacks.

• Why this matters: Procurement professionals should anticipate increased demand for advanced cybersecurity technologies that incorporate AI capabilities to detect and mitigate autonomous cyber threats.
• Agencies are prioritizing contracts that support supply chain security, zero-day vulnerability response, and infrastructure protection, signaling opportunities for vendors specializing in AI-driven defense tools.
• Organizations can leverage insights from federal and international cybersecurity leaders to align proposals with emerging resilience-focused policies and operational frameworks.
• This shift indicates a growing emphasis on continuous defense posture enhancements rather than episodic incident response, affecting contract scopes and evaluation criteria.

Securin, a cybersecurity firm based in Albuquerque, New Mexico, is expanding its operations by relocating to a larger facility and creating 93 new high-wage jobs with an average salary of $71,000. This expansion is supported by a $350,000 Local Economic Development Act (LEDA) grant awarded in July 2026 from the State of New Mexico and the City of Albuquerque. The funding aims to bolster the region's cybersecurity sector and workforce development, reinforcing New Mexico's position as a growing hub for cybersecurity and AI talent.

• Why this matters: This public-private partnership highlights state and municipal commitment to attracting and retaining cybersecurity firms, signaling opportunities for contractors and vendors in cybersecurity services and workforce training.
• Procurement professionals should note the role of LEDA funding as a tool to incentivize technology sector growth and job creation within the state.
• Companies specializing in cybersecurity, AI, and related professional services may find increased demand and collaboration opportunities in New Mexico's expanding tech ecosystem.
• Economic development agencies and contractors can leverage this model to support similar expansions and workforce initiatives in other regions.

New York State has allocated over $9 million through the SECURE grant program to enhance cybersecurity across 153 local water and wastewater systems statewide. This funding supports compliance with newly established state cybersecurity standards aimed at protecting critical water infrastructure from escalating cyber threats. The grants enable local utilities to conduct vulnerability assessments, implement security upgrades, and strengthen defenses against cyberattacks that could disrupt essential water services and public health. Notably, the Town of Yorktown received a $36,400 grant to improve cybersecurity at its wastewater treatment plant, exemplifying targeted support within the broader statewide initiative.

• The SECURE grant program represents a significant state investment aligned with a broader $3.75 billion clean water infrastructure budget for 2027, emphasizing cybersecurity as a critical component of water system resilience.
• Procurement professionals should note the emphasis on compliance with new cybersecurity regulations for water utilities, creating demand for cybersecurity assessments, technical assistance, and infrastructure upgrades.
• Contractors specializing in cybersecurity solutions for critical infrastructure have opportunities to support local governments in meeting these standards and securing grant-funded projects.
• The program's statewide scope and funding scale indicate ongoing and expanding procurement activities in water sector cybersecurity, relevant for strategic planning and partnership development.

The Japanese Ministry of Defense (MoD) has outlined strategic initiatives to bolster its domestic defense industry amid regional security challenges, particularly from China. The 2026 white paper emphasizes legislative reforms aimed at increasing contractor profit margins to incentivize innovation and competitiveness. Japan is expanding international defense partnerships, notably with the United States, through co-production programs such as the SM-3 Block IIA missile interceptors and AIM-120 AMRAAM air-to-air missiles, as well as participation in the Global Combat Air Programme. Additionally, Japan is advancing significant naval shipbuilding efforts, including a $6.5 billion sale of Mogami-class frigates to Australia, reflecting a focus on enhancing maritime capabilities.

• Procurement professionals should note the legislative reforms that may improve contract profitability and foster innovation within Japan's defense industrial base.
• Contractors with expertise in missile systems, naval shipbuilding, and advanced aerospace technologies may find increased opportunities through co-production and international collaboration programs.
• The ongoing partnerships with the U.S. signal a preference for interoperability and technology sharing, which could influence future contract requirements and standards.
• Companies should consider the strategic importance of locations such as Nagasaki (Ainoura) and Tokyo, which are central to Japan's defense manufacturing and administrative activities.

The Department of Defense has paused the implementation of Cybersecurity Maturity Model Certification (CMMC) Phase Two, affecting contractors who invested early in certification efforts. This pause has created challenges, especially for small businesses that have incurred significant costs and resource commitments to meet the cybersecurity requirements ahead of schedule. Industry leaders emphasize the importance of maintaining verified cybersecurity compliance rather than relying on self-attestation and urge the DoD to adhere to established deadlines while considering support mechanisms to alleviate certification burdens for smaller contractors.

• Contractors who obtained early CMMC certification face uncertainty and potential financial impacts due to the implementation hold
• Small businesses may require additional support or cost reduction measures to sustain compliance efforts
• Procurement professionals should anticipate adjustments in cybersecurity requirements and certification timelines impacting contract eligibility
• Organizations should evaluate their cybersecurity posture and certification status in light of the DoD's evolving CMMC implementation plans