Get tomorrow's brief in your inbox
Today: The Navy stood up a new Office of the Defense Industrial Base to revitalize maritime supply chains and push dual-use tech to the fleet. PilieroMazza published guidance on how M&A transactions affect small business eligibility and facility clearances. GSA and Treasury kicked off post-quantum cryptography initiatives that will eventually cascade to DIB contractors. No CMMC Reform Task Force updates, no new FCA cyber-fraud settlements, no 800-171 guidance.
Navy creates Office of the Defense Industrial Base to accelerate dual-use tech and supply chain resilience. Acting Secretary Hung Cao announced the office on August 24, tapping Andrew Magliochetti (former director of the Navy's Office of Small Business Programs and a venture capital investor) as deputy assistant secretary. The office will "lead initiatives to expand the domestic manufacturing ecosystem, mitigate supply chain vulnerabilities, and integrate dual-use commercial technologies" to support the administration's "Golden Fleet" modernization push. This follows President Trump's August memo directing the Department of War (DoD) to restore capacity and competition to the maritime industrial base after "large backlogs of orders across six major Navy shipbuilding programs" exposed an "atrophied shipbuilding industrial base." (DefenseScoop)
What to do: If you supply the Navy or are pursuing dual-use tech opportunities, expect new pathways for early-stage companies and venture-backed firms to engage the service. Magliochetti's background signals the Navy wants commercial innovation and private capital flowing into the defense supply chain. Watch for RFIs and OTA opportunities from this office.
GSA updates FICAM architecture and Treasury launches Quantum-Readiness Task Force ahead of 2030/2031 post-quantum crypto deadlines. GSA is revising the Federal Identity, Credential and Access Management framework to support quantum-resistant algorithms and developing a testing process for physical access control tech. Treasury stood up a public-private task force to coordinate the financial sector's transition to quantum-safe cryptography. Both initiatives stem from Trump's June 22 executive orders: one requires agencies to migrate "high value assets" and "high impact systems" to post-quantum cryptographic keys by December 31, 2030, and PQC digital signatures by end of 2031; the other focuses on quantum research and commercialization. OMB's follow-up memo (issued in late June) told agencies to submit a "PQC Migration Plan" within 120 days (due in about 30 days from today) detailing how they will inventory cryptographic systems, define a migration strategy, and execute pilots between 2027-2028. (Federal News Network)
What to do: DIB contractors will inherit these requirements as agencies migrate their systems and update contract language. If you build or operate cryptographic systems for federal customers, start inventorying where you use traditional public-key crypto (RSA, ECC) and planning a phased migration to NIST's post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA). The 2030/2031 deadlines are for federal high-value assets, but expect primes and contracting officers to flow down PQC requirements earlier. Crypto agility (the ability to swap algorithms without re-architecting) is now a design requirement, not a nice-to-have.
Tetra Tech pays $57M to settle FCA allegations for falsifying soil radiation tests at Hunters Point Naval Shipyard. The settlement resolves claims that Tetra Tech EC, Inc. fabricated work and falsified data the Navy relied on to determine whether the former shipyard in San Francisco was free from harmful radiation. This is an environmental False Claims Act case, not a cyber-fraud case, but it illustrates the enforcement lever DOJ uses when contractors submit false attestations or test results the government relies on for compliance decisions. (DOJ)
Air Force member indicted for lying on background investigation forms to get NASA/IRS/NOAA contract work while on active duty. Davide Velarde, 44, of Tucson, was charged with making materially false statements on background investigation forms to obtain employment with federal contractors supporting NASA, the IRS, and NOAA. The indictment does not specify what he lied about, but the case is a reminder that background investigation fraud (SF-86 omissions, misrepresentations of foreign contacts, undisclosed financial issues) is prosecuted and that contract personnel clearances depend on truthful disclosures. (DOJ)
What to do: These cases are not cyber-specific, but they reinforce the enforcement pattern: when contractors submit false attestations or falsify compliance data, DOJ will pursue FCA or fraud charges. During the CMMC Phase 2 suspension, self-assessment is the only active pathway and the False Claims Act is the primary enforcement lever. Every NIST 800-171 self-assessment submission and SPRS score is a potential FCA exposure if it overstates your actual implementation. Ensure your POA&M, SSP, and SPRS entries reflect what you have actually deployed, not what you plan to deploy or what you think the government wants to see.
DoD's Drone OTA Consortium opens Joint UGV demo for October. The Defense Department is planning a mid-October unmanned ground vehicle demonstration (GroundBreaker 1) at Camp Grafton, North Dakota. Only members of the DoW Drone OTA Consortium are eligible to participate. The Pentagon launched the consortium a few months ago to "facilitate the rapid solicitation, evaluation, and award" of OTAs for prototyping and production, cutting through traditional acquisition bureaucracy and bringing nontraditional vendors into the procurement pipeline. Vendors whose UGV systems demonstrate "high tactical value and technical maturity" at the demo may be invited to submit full proposals for OTA awards. (DefenseScoop)
What to do: If you build robotic or autonomous systems and want access to DoD prototyping dollars, join the Drone OTA Consortium. OTAs bypass FAR-based acquisition processes, which means faster awards but also less predictable contract structure and terms. The consortium model signals how DoD is trying to onboard commercial and dual-use tech firms that would not traditionally compete for defense contracts. Expect more of these domain-specific consortia (cyber, AI, quantum, biotech) as the administration pushes "tactical speed" procurement.
SBA tightens 7(a) lending rules effective October 1, making acquisitions harder to finance. SOP 50 10 8.1 raises the debt-service coverage requirement for most change-of-ownership transactions from 1.15x to 1.25x, restricts financing to U.S. citizens and U.S. nationals (no more green card holders as owners or guarantors), and subjects all acquisitions to full standard underwriting regardless of size (previously, deals under $350K qualified for streamlined small-loan treatment). Historical cash flow will matter more than projections: a business with attractive growth potential may not qualify if its existing cash flow cannot support the proposed debt under the new 1.25x coverage test. The changes apply to all lending applications issued an SBA loan number on or after October 1, 2026. (PilieroMazza)
What to do: If you are buying or selling a defense contractor and planning to use SBA 7(a) financing, get your application submitted and a loan number issued before October 1. After that date, expect lenders to demand stronger historical financials, full appraisals, and site visits even for smaller deals. Non-citizen owners (including green card holders) will no longer qualify, which could kill deals for companies with foreign-born founders or investors. Structure the transaction around SBA requirements from the start; retrofitting a deal after it fails underwriting is expensive and often fatal.
M&A buyers need to understand which GovCon assets survive closing and which do not. PilieroMazza published a detailed guide on due diligence for government contractor acquisitions, focusing on the assets that depend on ownership structure, size, control, and regulatory status. Small business eligibility, contract vehicle positions (OASIS+, Polaris, VETS 2, CIO-SP3, GSA MAS), facility security clearances, FOCI mitigation arrangements, past performance, and pending proposals can all be affected by a change of ownership. A transaction that triggers SBA recertification can cost the target its access to set-aside work. Different contract vehicles have different off-ramping provisions and post-recertification order eligibility rules; a vehicle position worth tens of millions in projected task orders may not retain that value after closing. Facility clearances do not automatically transfer and may require new FOCI mitigation if the buyer has foreign ownership. The timing of an acquisition relative to active procurements and proposal deadlines can determine whether the target keeps an award that was central to the acquisition thesis. (PilieroMazza)
What to do: If you are acquiring a defense contractor or being acquired, model the transaction's effect on every revenue-generating asset: set-asides, vehicle positions, clearances, pending proposals, and past performance. Do not assume a contract vehicle or small business status survives closing. Recertification timing, SBA affiliation rules, and vehicle-specific terms can kill projected revenue that looks solid on a balance sheet. Engage a GovCon M&A attorney early (before LOI) to map what stays, what goes, and what requires government approval or mitigation. If the deal depends on a major IDIQ position or a facility clearance, get DCSA and the relevant vehicle program office involved before closing.
No new NIST SP 800-171 or 800-172 guidance this cycle. No updates to CUI handling requirements, assessment methodology, or FedRAMP intersections with the DIB. The post-quantum crypto transition (covered under Policy & Rulemaking) will eventually require updates to 800-171's cryptographic protection controls (3.13.11, 3.13.16), but NIST has not published revised guidance yet.
Secure communications remain a human problem, and approved tools still lose to convenience. Federal News Network published commentary noting that employees choose communications platforms by familiarity and ease of use, not security architecture. "There's a price to convenience," said David Wiseman of BlackBerry. "How convenient is it when it actually comes out that your account had been hacked for a six-month window?" Policies and training can explain which communications must be preserved and which systems are approved, but compliance improves when the technology enforces the rules rather than depending on users to remember administrative steps. The article focuses on federal employees, but the dynamic applies to cleared contractor personnel: if the approved secure messaging tool is harder to use than Signal or WhatsApp, people will use the unapproved tool and rationalize it later. (Federal News Network)
What to do: If your SSP requires encrypted communications for CUI and you have deployed an approved platform (e.g., government-furnished devices, FIPS 140-2 validated messaging), audit whether your personnel are actually using it. Spot-check phones and laptops. Ask project managers how they coordinate classified or CUI discussions. If people are using personal devices or commercial apps for convenience, you have a 3.1.20 (external system use) and 3.13.8 (collaborative device control) gap that an assessor or an insider threat investigation will find. Fix it by making the compliant tool the path of least resistance (pre-provision accounts, integrate with Outlook/Teams, train people on the workflow), not by issuing another policy memo.