Evolving DoD Contractor Cybersecurity Requirements (Q3-2026 Update) - Govology

The United States’ adversaries are actively trying to steal the nation’s military and industrial advantages. Because federal contractors often store or process sensitive information, the government requires them to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within their internal IT systems.

Contractors supporting Department of Defense/Department of War programs face additional cybersecurity requirements under DFARS clause 252.204-7012. The DoW also uses DFARS clauses 252.204-7020 and 252.204-7021 to hold contractors accountable for meeting these requirements. Clause 252.204-7021 establishes the Cybersecurity Maturity Model Certification, commonly known as CMMC.

The DoW’s suspension of Phase II of the CMMC rollout has created uncertainty across the defense contracting community. Contractors are asking what the suspension means for certification timelines, upcoming contract requirements, assessments, and investments already made toward compliance. Many are also wondering whether they should slow down their preparations or continue moving forward.

In this webinar, Adam Austin, Co-Founder and President of Totem Technologies, will explain federal cybersecurity, DFARS, and CMMC requirements in plain language. He will clarify what has changed, what has not, and what the Phase II suspension may mean for contractors and the organizations that support them.

Attendees will also learn about common implementation challenges and practical resources that can help them navigate the evolving cybersecurity compliance landscape.

Target Audience: APEX Accelerator counselors, MEP counselors, DoD contracting officers and program managers, DoD contractors and their IT staff, managed service providers, and managed security service providers.

Speaker

Adam AustinCo-Founder and Cybersecurity Lead, Totem.Tech