Get tomorrow's brief in your inbox
Today: The Ninth Circuit ruled that federal agencies cannot unilaterally define what is "material" under the False Claims Act, a holding that could reshape how DOJ pursues cyber-fraud attestation cases against defense contractors. ISOO issued two new CUI notices directing agencies to give contractors clearer marking, handling, and decontrol guidance. A new FCA cybersecurity settlement signals DOJ's Civil Cyber-Fraud Initiative remains active despite the Phase 2 suspension.
ISOO Releases CUI Notices 2026-07 and 2026-08: Agencies Must Give Contractors Explicit CUI Handling Guidance
NARA's Information Security Oversight Office published two notices on September 2 directing federal agencies to provide contractors, at minimum, 12 categories of CUI guidance on every contract requiring CUI access: identification of government-furnished CUI, process for marking contractor-developed CUI, challenge procedures, training, safeguarding, decontrol, disposition, and penalties for misuse. Notice 2026-07 also requires agencies to assign a specific decontrol date or event to all CUI and to resolve CUI status challenges promptly. Neither notice applies directly to contractors, but they create an obligation on the agency side that contractors can leverage. Status: Agency guidance (not rulemaking), effective immediately.
Action: On your next contract modification or new award involving CUI, request in writing that the contracting officer provide the 12-item list from ISOO Notice 2026-07. Document what you receive (or don't receive). This is useful evidence for any future dispute over whether you were properly notified of CUI scope, and it directly supports your NIST 800-171 scoping decisions and SSP boundary definitions. Source
Army Directive 2026-19: Commercial Software First
The Department of the Army issued a directive prioritizing commercial off-the-shelf software over custom-built solutions, implementing Secretary Hegseth's November 2025 acquisition overhaul memo. For DIB software suppliers, this signals faster procurement cycles and a preference for configurable commercial products. Status: Signed directive, in force.
Action: If you sell software to Army programs, review your product positioning. Proposals that emphasize configuration over custom development will align better with the directive's intent. Expect other service branches to follow. Source
SBA Prioritizing Defense-Critical 8(a) Applicants
SBA announced on September 10 that it will fast-track 8(a) Business Development Program applications from firms in defense-critical industries, alongside broader 8(a) reforms for individually owned firms. Status: Agency policy guidance, effective now.
Action: Small DIB firms not yet in the 8(a) program should evaluate whether the expedited processing changes their cost-benefit calculation for applying. Source
Ninth Circuit: Agencies Cannot Define FCA "Materiality" by Fiat (County of King v. Turner)
The Ninth Circuit ruled 2-1 on August 25 that HUD and DOT exceeded their authority by requiring grant recipients to certify that compliance with antidiscrimination laws "is material to the government's payment decisions" under the False Claims Act. The court held that Congress already defined "material" in the FCA statute (31 U.S.C. 3729(b)(4)), and the Executive Branch cannot override that definition through certification requirements. The holding is broadly applicable beyond the antidiscrimination context.
This matters for CMMC because DOJ's Civil Cyber-Fraud Initiative relies on the FCA to enforce cybersecurity self-attestation. If agencies try to expand what counts as "material" for FCA purposes through contract certifications or attestation requirements that go beyond the statutory definition, this decision gives contractors a potential defense. It does not gut the FCA's applicability to cybersecurity compliance, but it constrains how creatively the government can define materiality. Status: Ninth Circuit precedent. Expect government to seek rehearing or cert.
Action: Flag this case for your legal team. It does not change your obligation to attest accurately under DFARS 252.204-7012 or submit honest SPRS scores. It does provide a legal argument if DOJ attempts to pursue FCA claims based on agency-imposed materiality definitions that stretch beyond the statute. Watch for cert petitions. Source
New FCA Cybersecurity Settlement Reported
Foley & Lardner flagged another FCA cybersecurity settlement, signaling DOJ's Civil Cyber-Fraud Initiative continues to produce enforcement actions. Details are limited in the available summary, but the pattern is consistent: DOJ is not waiting for CMMC Phase 2 C3PAO assessments to resume before pursuing contractors whose self-attestations don't match reality. Status: Ongoing enforcement posture.
Action: If your SPRS score or self-assessment claims capabilities you haven't fully implemented, treat this as the reminder to close POA&M items or adjust your score. The FCA is the enforcement lever that works right now, with or without C3PAO assessments. Source
CUI Scoping Gets Clearer (Ties to ISOO 2026-07)
The ISOO notices described above directly affect how contractors scope their NIST 800-171 implementations. If your agency provides the 12-item CUI identification checklist, your CUI boundary definition becomes more defensible. If they don't provide it, you now have a documented basis to request it, and the gap itself may be relevant in any future dispute about whether you were protecting the right data.
Action: Update your SSP's CUI scoping section to reference ISOO Notice 2026-07. If your contracting officer has not provided explicit CUI identification for your contract, send a written request citing the notice. Document the response (or lack of one) in your compliance files.
CCP Exam Pass Report
A practitioner on r/CMMC reported passing the Certified CMMC Professional (CCP) exam, noting the breadth of the body of knowledge extends well beyond just the CMMC practices into CAP, scoping, assessment methodology, and ecosystem governance. Opinion: The CCP remains a viable credential even during the Phase 2 suspension because self-assessment work continues and the assessment methodology knowledge translates directly to preparing your own organization. Source
3.8.2 Media Access: USB Tracking Question
A practitioner asked whether NIST 800-171 control 3.8.2 ("limit access to CUI on system media to authorized users") requires sign-out tracking of USB drives. Their organization locks down servers and external drives physically but allows USB drives to be requested without inventory tracking. Opinion: The control requires demonstrable access limitation, not necessarily a specific tracking mechanism. If USB drives can contain CUI, you need a process that limits who gets them and a way to show you enforced that limit. A request-approval process with records likely satisfies the control; issuing USBs without tracking probably does not. Check your assessor's interpretation and document your rationale in the SSP. Source
Funding Level 2 Compliance: The Cost Question
A commercial banker posted asking about horror stories funding Level 2 compliance, noting the financing angle has been underaddressed. The poster characterized the Phase 2 suspension as "a stay of execution" likely timed around the midterm election. Opinion: The cost concern is real and widespread. Small DIB firms face $50K-$300K+ implementation costs depending on environment complexity, and traditional lenders don't underwrite compliance projects well. SBA grants exist but are limited. The banker's framing is worth noting: the financial sector sees CMMC compliance as inevitable even if the timeline is uncertain, which is the correct read. Source